PT-2021-18505

Name of the Vulnerable Software and Affected Versions IBM Db2 for Linux, UNIX and Windows includes Db2 Connect Server affected versions not specified Description The issue could disclose sensitive information when using ADMIN CMD with LOAD or BACKUP. There is no information provided about the...

CVE-2021-29825: Undefined Security Weakness

IBM Db2 for Linux, UNIX and Windows includes Db2 Connect Server could disclose sensitive information when using ADMINCMD with LOAD or BACKUP. IBM X-Force ID: 204470...

PT-2021-18461

Name of the Vulnerable Software and Affected Versions IBM Db2 for Linux, UNIX and Windows includes Db2 Connect Server versions 11.1 and 11.5 Description The issue could allow a local user to keep running a procedure that could cause the system to run out of memory and cause a denial of service...

Security Bulletin: IBM® Db2® could allow an authenticated user to overwrite arbitrary files due to improper group permissions. (CVE-2020-4945)

Summary IBM Db2 for Linux, UNIX and Windows includes DB2 Connect Server could allow an authenticated user to overwrite arbirary files due to improper group permissions. Vulnerability Details CVEID: CVE-2020-4945 DESCRIPTION: IBM DB2 for Linux, UNIX and Windows includes DB2 Connect Server could...

CVE-2020-4885

IBM Db2 for Linux, UNIX and Windows includes Db2 Connect Server 11.5 could allow a local user to access and change the configuration of Db2 due to a race condition of a symbolic link,. IBM X-Force ID: 190909...

CVE-2020-4945

CVE-2020-4945 affects IBM Db2 LUW (11.5, includes Db2 Connect Server) and IBM Cloud Pak System Software, where an authenticated user could overwrite arbitrary files due to improper group permissions. The root cause is file-permission misconfigurations that grant the attacker enough access to repl...

CVE-2021-20579: Undefined Security Weakness

IBM Db2 for Linux, UNIX and Windows includes Db2 Connect Server 9.7, 10.1, 10.5, 11.1, and 11.5 could allow a user who can create a view or inline SQL function to obtain sensitive information when AUTOREVAL is set to DEFFEREDFORCE. IBM X-Force ID: 199283...

PT-2021-3399

Name of the Vulnerable Software and Affected Versions IBM Db2 for Linux, UNIX and Windows includes Db2 Connect Server version 11.5 Description The issue is caused by a race condition of a symbolic link, allowing a local user to access and change the configuration of Db2. It is also described as...

CVE-2021-29777: Inclusion of Functionality from Untrusted Control Sphere

IBM Db2 for Linux, UNIX and Windows includes Db2 Connect Server 9.7, 10.1, 10.5, 11.1, and 11.5, under specific circumstance of a table being dropped while being accessed in another session, could allow an authenticated user to cause a denial of srevice IBM X-Force ID: 203031...

PT-2021-14053

Name of the Vulnerable Software and Affected Versions: IBM Db2 for Linux, UNIX and Windows includes Db2 Connect Server versions 9.7, 10.1, 10.5, 11.1, and 11.5 Description: The issue allows a user who can create a view or inline SQL function to obtain sensitive information when AUTO REVAL is set ...

PT-2021-18473

Name of the Vulnerable Software and Affected Versions IBM Db2 for Linux, UNIX and Windows includes Db2 Connect Server versions 9.7, 10.1, 10.5, 11.1, and 11.5 Description The issue allows an authenticated user to cause a denial of service under specific circumstances, such as when a table is bein...

PT-2021-18419

Name of the Vulnerable Software and Affected Versions Db2 for Linux, UNIX and Windows includes Db2 Connect Server affected versions not specified Description The issue is related to a denial of service, where the server terminates abnormally when executing a specially crafted SELECT statement...

CVE-2021-29703: Undefined Security Weakness

Db2 for Linux, UNIX and Windows includes Db2 Connect Server is vulnerable to a denial of service as the server terminates abnormally when executing a specially crafted SELECT statement. IBM X-Force ID: 200659...

PT-2021-3398

Name of the Vulnerable Software and Affected Versions IBM Db2 for Linux, UNIX and Windows includes Db2 Connect Server version 11.5 Description The issue is related to improper group permissions, allowing an authenticated user to overwrite arbitrary files. This could potentially be exploited by a...

CVE-2020-4885: Improper Link Resolution Before File Access

IBM Db2 for Linux, UNIX and Windows includes Db2 Connect Server 11.5 could allow a local user to access and change the configuration of Db2 due to a race condition of a symbolic link,. IBM X-Force ID: 190909...

PT-2021-18418

Name of the Vulnerable Software and Affected Versions Db2 for Linux, UNIX and Windows includes Db2 Connect Server versions 11.1.4 and 11.5.5 Description The issue allows for a denial of service, causing the server to terminate abnormally when it executes a specially crafted SELECT statement...

CVE-2021-29702: Improper Neutralization of Special Elements in Output Used by a Downstream Component

Db2 for Linux, UNIX and Windows includes Db2 Connect Server 11.1.4 and 11.5.5 is vulnerable to a denial of service as the server terminates abnormally when executing a specially crafted SELECT statement. IBM X-Force ID: 200658...

CVE-2019-4588

The CVE-2019-4588 issue affects IBM Db2 for Windows (and Db2 Connect Server) across Db2 9.7, 10.1, 10.5, 11.1, and 11.5. The root cause is DLL hijacking in the check-for-updates (Flexnet agent) component, allowing a local user to execute arbitrary code. Impact is high for confidentiality, integri...

Security Bulletin: IBM® Db2® is vulnerable to weak file permissions allowing access to specific files (CVE-2020-4976)

Summary IBM Db2 for Linux, UNIX and Windows includes DB2 Connect Server could allow a local user to read and write specific files due to weak file permissions. Vulnerability Details CVEID: CVE-2020-4976 DESCRIPTION: IBM DB2 for Linux, UNIX and Windows includes DB2 Connect Server could allow a loc...

CVE-2020-4976

CVE-2020-4976 affects IBM Db2 LUW (Linux/UNIX/Windows) including DB2 Connect Server, with versions 9.7, 10.1, 10.5, 11.1, and 11.5 at risk from a local attacker who can read and write specific files due to weak file permissions. The connected IBM security bulletins locate the fixed releases and r...