This hotfix should only be applied on top of SBM 11.5. If you are running a different version or if you have already installed a different SBM 11.5 hotfix, contact Serena Support. Please note that these CVE's are also fixed in SBM 11.4.2 - please go to the Support Site downloads section if you require this version..
These are addressed in 11.4.2 and 11.5.1+. For SBM 11.5 there is the following hotfix : http://knowledgebase.serena.com/InfoCenter/index?page=content&id=P2821