============================================================================
Copyright © Aricent Holdings Luxembourg S.a.r.l. 2018.  All rights reserved.
============================================================================

=================================================
Maintenance for IBM Connect:Direct for UNIX 6.0.0
=================================================

This maintenance archive includes module replacements for the C:D UNIX 6.0.0 
code base. It is applicable to C:D UNIX version 6.0.0, and contains all the new 
functionality and fixes as described in the C:D UNIX 6.0.0 Release notes, as 
well as fixes for the issues listed below.

This release implements IBM's standard V.R.M.F method of identifying software. 
V, R, M and F are Version, Release, Modification and Fix Pack respectively.  In 
general, V.R.M imply new functionality, while F is an accumulation of fixes 
called a Fix Pack.  The term Fix Pack will be used going forward in place of 
Cumulative Maintenance.  Individual fixes also have a new name, Interim Fixes, 
or iFixes for short.  iFixes are numbered sequentially from one starting with 
any increment to V, R, M or F.  Please see IBM's website for further details 
regarding this methodology.  

After applying the maintenance, the CLI banner will report that your C:D 
version is 6.0.0.x, where x is the current Fix Pack.  It will also display the 
date that the maintenance was created.

For more information, please refer to the C:D UNIX 6.0.0 Release Notes.

=================================================
iFixes listed below apply to C:D for UNIX 6.0.0.0
=================================================

001) MFT-10001 / APAR IT26905  commit date:  16 Nov 2018
--------------------------------------------------------
     IBM Sterling Connect:Direct for UNIX uses IBM Runtime Environment Java.
     (JRE) Versions 8.0.5.15 and 8.0.5.17. These JREs are vulnerable to the
     following issues, disclosed as part of the IBM Java SDK updates in July
     2018:

     CVE-2018-12539: Eclipse OpenJ9 could allow a local attacker to gain
                     elevated privileges on the system, caused by the failure
                     to restrict the use of Java Attach API to connect to an
                     Eclipse OpenJ9 or IBM JVM on the same machine and use
                     Attach API operations to only the process owner. An
                     attacker could exploit this vulnerability to execute
                     untrusted native code and gain elevated privileges on the
                     system.

     CVE-2018-1656: The IBM Java Runtime Environment's Diagnostic Tooling
                    Framework for Java (DTFJ) does not protect against path
                    traversal attacks when extracting compressed dump files.

002) CDUA-1234 commit date:  10 Dec 2018
--------------------------------------------------------
     Trace file names having absolute path are set correctly for PMGR/CMGR/SMGR.

003) CDUA-1235 commit date:  24 Dec 2018
--------------------------------------------------------
     Delete Secure+ remote node operation, whose alias node name with upper case letter is present, returns Error code SPCG270E.