Security Bulletin: Multiple vulnerabilities in IBM Java SDK and IBM Java Runtime affect IBM® Db2®.

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Version 6.0.16.55 and earlier, 6.1.8.55 and earlier, 7.0.10.15 and earlier, 7.1.4.15 and earlier, 8.0.5.7 and earlier used by IBM® Db2®. These issues were disclosed as part of the IBM Java SDK updates in January 2018...

Security Bulletin: IBM® Db2® is affected by a vulnerability in IBM Spectrum Scale (CVE-2017-1654)

Summary Db2 is affected by a vulnerability in IBM® Spectrum Scale Version 4.1.1 that is used by DB2® pureScale™ Feature on AIX and Linux. A security vulnerability has been identified in IBM Spectrum Scale that could allow a local unprivileged user access to information in dump files, and result i...

Security Bulletin: IBM Db2 Hosted is affected by the vulnerabilities known as Spectre and Meltdown

Summary IBM Db2 Hosted is affected by the vulnerabilities known as Spectre and Meltdown, which can enable CPU data cache timing to be abused to bypass conventional memory security restrictions to gain access to privileged memory that should be inaccessible. Vulnerability Details CVEID:...

Security Bulletin: IBM Db2 Warehouse has released a fix in response to the vulnerability known as Spectre (CVE-2017-5753)

Summary IBM has released the following fix for IBM Db2 Warehouse in response to CVE-2017-5753. Vulnerability Details CVEID: CVE-2017-5753 Affected Products and Versions IBM dashDB Local v1.0.0 - v1.9.0, IBM Db2 Warehouse v1.10.0 - v1.11.1, and Db2 Warehouse v2.0.0 - v2.3.0; all container types...

Security Bulletin: IBM® Db2® is affected by vulnerabilities in the IBM® SDK, Java Technology Edition Quarterly Critical Patch Updates (CVE-2016-9840, CVE-2016-9841, CVE-2016-9842, CVE-2016-9843)

Summary Db2 is affected by vulnerabilities in IBM® JDK. This only affects customers using Integrated Text Search. Vulnerability Details CVEID: CVE-2016-9840 DESCRIPTION: zlib is vulnerable to a denial of service, caused by an out-of-bounds pointer arithmetic in inftrees.c. By persuading a victim ...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect DB2 Recovery Expert for Linux, Unix and Windows

Summary Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Version Java 1.8.0 SR4 FP1 used by DB2 Recovery Expert for Linux, Unix and Windows. These issues were disclosed as part of the IBM Java SDK updates in Jul 2017. Vulnerability Details CVEID: CVE-2017-10115...

Security Bulletin: : Security vulnerabilities have been identified in Tivoli Storage FlashCopy Manager shipped with IBM Db2.

Summary IBM Tivoli Storage FlashCopy Manager FCM is shipped as a component of IBM Db2. Information about security vulnerabilities affecting IBM Tivoli Storage FCM has been published in a security bulletin. Vulnerability Details Please consult the security bulletin "Vulnerabilities in OpenSSL affe...

Security Bulletin: Security vulnerabilities have been identified in SSL/TLS with InfoSphere Optim Query Workload Tuner [for LUW, z/OS] (CVE-2017-10115 CVE-2017-10116)

Summary SSL/TLS are used in InfoSphere Optim Query Workload Tuner for LUW, z/OS. Information about security vulnerabilities affecting SSL/TLS have been published in a security bulletin. Vulnerability Details CVEID: CVE-2017-10115 DESCRIPTION: An unspecified vulnerability related to the Java SE JC...

Security Bulletin: Multiple Java Vulnerabilities affect DB2 Text Search Stand Alone Accessories Suite

Summary There are multiple vulnerabilities in the JDK bundled by the DB2 Text Search Stand Alone Accessories Suite Vulnerability Details CVEID: CVE-2016-5568 DESCRIPTION: An unspecified vulnerability in Oracle Java SE related to the AWT component has high confidentiality impact, high integrity...

Security Bulletin: Security vulnerabilities have been identified in IBM® DB2® shipped with IBM InfoSphere Information Server and IBM InfoSphere DataClick (CVE-2013-6747, CVE-2014-0963)

Summary IBM DB2 is shipped as a component of IBM InfoSphere Information Server and IBM InfoSphere Data Click. Information about security vulnerabilities affecting IBM DB2 has been published in a security bulletin. Vulnerability Details Please consult the security bulletin IBM DB2 is impacted by...

Security Bulletin: TLS padding vulnerability affects IBM InfoSphere Balanced Warehouse C3000, C4000, IBM Smart Analytics System 1050, 2050, 5600, 5710, 7600, 7700 and 7710 (CVE-2014-8730)

Summary Transport Layer Security TLS padding vulnerability via a POODLE Padding Oracle On Downgraded Legacy Encryption like attack affects IBM InfoSphere Balanced Warehouse C3000, C4000, IBM Smart Analytics System 1050, 2050, 5600, 5710, 7600, 7700 and 7710. Vulnerability Details CVE-ID:...

Security Bulletin: Vulnerabilities in IBM DB2 for Linux, UNIX, and Windows affects IBM PureData System for Transactions (CVE-2014-6209, CVE-2014-6210, CVE-2014-8901)

Summary Security vulnerabilities have been discovered in IBM DB2® shipped with IBM PureData™ System for Transactions. Vulnerability Details CVE ID: CVE-2014-6209 DESCRIPTION: IBM DB2 contains a denial of service vulnerability. A remote, authenticated DB2 user could exploit this vulnerability by...

Security Bulletin: Buffer overflow vulnerability in IBM® DB2® LUW (CVE-2017-1105)

Summary IBM DB2 for Linux, UNIX and Windows includes DB2 Connect Server is vulnerable to a buffer overflow that could allow a local user to overwrite DB2 files or cause a denial of service. Vulnerability Details CVEID: CVE-2017-1105 DESCRIPTION: IBM DB2 for Linux, UNIX and Windows includes DB2...

Security Bulletin: Privilege escalation vulnerability affects IBM® DB2® LUW (CVE-2017-1134)

Summary DB2 LUW is affected by a vulnerability in IBM Tivoli System Automation for Multiplatforms TSAMP. Vulnerability Details A privilege escalation vulnerability affects IBM Reliable Scalable Cluster Technology shipped with IBM Tivoli System Automation for Multiplatforms. CVEID: CVE-2017-1134...

Security Bulletin: Vulnerabilities in open source zlib library affect IBM Data Server Driver Package and IBM Data Server Driver for ODBC and CLI

Summary Vulnerabilities have been addressed in the open source zlib library component of IBM Data Server Driver Package and IBM Data Server Driver for ODBC and CLI. Vulnerability Details CVEID: CVE-2016-9840 DESCRIPTION: zlib is vulnerable to a denial of service, caused by an out-of-bounds pointe...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect DB2 Recovery Expert for Linux, Unix and Windows

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Version Java 1.8.0 SR1 FP10 used by DB2 Recovery Expert for Linux, Unix and Windows. These issues were disclosed as part of the IBM Java SDK updates in Jan 2017. Vulnerability Details CVEID: CVE-2016-5546 DESCRIPTION: An...

Security Bulletin: Information Disclosure vulnerability affects IBM® DB2® LUW (CVE-2017-1150)

Summary When a table is renamed and a new table is created with the old name, users who had access on the old table may be able to access the new table. Vulnerability Details A user may incorrectly acquire privileges on a table if the table is created with the same name as a previously renamed...

Security Bulletin: IBM® DB2® LUW is vulnerable to Sweet32 Birthday Attack (CVE-2016-2183)

Summary GSKit is an IBM component that is used by IBM DB2 for SSL support. The GSKit that is shipped with IBM DB2 is vulnerable to the Sweet32 Birthday attack. By default, DB2 does not use SSL for client-server communication and therefore DB2 is vulnerable only if SSL is enabled and a Triple-DES...

Security Bulletin: IBM® DB2® LUW on AIX and Linux Affected by a Vulnerability in GPFS (CVE-2016-2119)

Summary DB2 LUW is affected by a vulnerability in IBM® Spectrum Scale Version 4.1.1 that is used by DB2® pureScale™ Feature on AIX and Linux. IBM Spectrum Scale is previously known as General Parallel File System GPFS, Vulnerability Details CVEID: CVE-2016-2119 DESCRIPTION: Samba could allow a...

Security Bulletin: Multiple OpenSource Expat XML Vulnerabilities affect IBM DB2 Net Search Extender for Linux, Unix and Windows

Summary There are multiple vulnerabilities in open source expat XML parser that is used in DB2 Net Search Extender. Vulnerability Details CVEID: CVE-2012-0876 DESCRIPTION: Expat is vulnerable to a denial of service, caused by insufficient randomization of hash data structures. By sending multiple...