Security Bulletin: Multiple security vulnerabilities may affect IBM DB2 shipped with Predictive Maintenance and Quality and Predictive Maintenance Insights On-Premises

Summary

IBM DB2 is shipped with IBM Predictive Maintenance and Quality and Predictive Maintenance Insights On-Premises. Information about security vulnerabilities affecting DB2 has been published in multiple security bulletins as below.

Vulnerability Details

Refer to the security bulletin(s) listed in the Remediation/Fixes section

Affected Products and Versions

Remediation/Fixes

IBM® Db2® could allow a local authenticated attacker to execute arbitrary code on the system, caused by DLL search order hijacking vulnerability in Microsoft Windows client. (CVE-2020-4739)
Security Bulletin: <https://www.ibm.com/support/pages/node/6370023&gt;
Affected Releases: v9.1, v10.1, v10.5, v11.1, v11.5

IBM® Db2® is vulnerable to a buffer overflow (CVE-2020-4701)
Security Bulletin: <https://www.ibm.com/support/pages/node/6370025&gt;
Affected Releases: v10.5, v11.1, v11.5

IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow local attacker to cause a denial of service inside the “DB2 Management Service”. (CVE-2020-4642)

Security Bulletin: <https://www.ibm.com/support/pages/node/6391652&gt;

Affected Releases: 9.7, 10.1, 10.5, 11.1, 11.5

Please refer to above security bulletins for the detailed fix information.

Workarounds and Mitigations

None