Security Bulletin: IBM® Db2® is vulnerable to a denial of service after entering a specially crafted malformed SQL statement into the db2expln tool. (CVE-2022-35637)

Summary IBM® Db2® is vulnerable to a denial of service after entering a specially crafted malformed SQL statement into the db2expln tool. Vulnerability Details CVEID:CVE-2022-35637 DESCRIPTION: IBM Db2 for Linux, UNIX and Windows 9.7, 10.1, 10.5, 11.1, and 11.5 is vulnerable to a denial of servic...

Security Bulletin: IBM® Db2® is vulnerable to an information disclosure in some scenarios due to unauthorized access caused by improper privilege management when CREATE OR REPLACE command is used. (CVE-2022-22483)

Summary IBM® Db2® is vulnerable to an information disclosure in some scenarios due to unauthorized access caused by improper privilege management when CREATE OR REPLACE command is used. Vulnerability Details CVEID:CVE-2022-22483 DESCRIPTION: IBM Db2 for Linux, UNIX and Windows 9.7, 10.1, 10.5,...

IBM DB2 Denial of Service Vulnerability (CNVD-2022-78139)

IBM DB2 is a relational database management system from International Business Machines IBM of the United States. The system is implemented in UNIX, Linux, IBMi, z/OS, and Windows server versions.A denial-of-service vulnerability exists in IBM DB2 versions 9.7, 10.1, 10.5, 11.1, and 11.5. An...

Security Bulletin: IBM® Db2® is vulnerable to an information disclosure caused by improper privilege management when table function is used. (CVE-2022-22390)

Summary IBM® Db2® is vulnerable to an information disclosure caused by improper privilege management when table function is used. Vulnerability Details CVEID:CVE-2022-22390 DESCRIPTION: IBM Db2 may be vulnerable to an information disclousre caused by improper privilege management when table...

Security Bulletin: Multiple vulnerabilities in Apache Log4j affects some features of IBM® Db2® (CVE-2021-45046, CVE-2021-45105)

Summary Apache Log4j open source library used by IBM® Db2® is affected by multiple vulnerabilities that could allow a remote attacker to execute arbitrary code on the system or cause a denial of service. This library is used by the Db2 Federation feature. The fix for the vulnerability is to updat...

Security Bulletin: Vulnerability in Apache Log4j affects some features of IBM® Db2® (CVE-2021-44228)

Summary Apache Log4j open source library used by IBM® Db2® is affected by a vulnerability that could allow a remote attacker to execute arbitrary code on the system. This library is used by the Db2 Federation feature. The fix for the vulnerability is to update the log4j library. Please see...

Security Bulletin: A vulnerability in Apache Log4j affects some features of IBM® Db2® (CVE-2021-44832)

Summary The Apache Log4j open source library used by IBM® Db2® is affected by a vulnerability that could allow a remote attacker to execute arbitrary code on the system. This library is used by the Db2 Federation feature. The fix for the vulnerability is to update the log4j library to version...

Security Bulletin: Multiple vulnerabilities affect IBM Db2 On Openshift, IBM Db2® on Cloud Pak for Data and Db2 Warehouse® on Cloud Pak for Data

Summary IBM has released the below fix for IBM Db2® On Openshift, IBM Db2® on Cloud Pak for Data and Db2 Warehouse® on Cloud Pak for Data in response to multiple vulnerabilities found in multiple components. Vulnerability Details CVEID:CVE-2020-15187 DESCRIPTION: Helm could allow a remote...

IBM DB2 DB Compliance Checks

Binary data ibmdb2dbcompliancecheck.nbin...

Security Bulletin: Multiple vulnerabilities have been identified in DB2 that affect the IBM Performance Management product

Summary DB2 contains several vulnerabilities which can affect the IBM Performance Management product. Some of the information about security vulnerabilities affecting DB2 has been published in security bulletins CVE-2022-25315, CVE-2021-38931, CVE-2021-29678, CVE-2021-20373, CVE-2021-39002,...

Security Bulletin: Security vulnerabilities in IBM Db2 used by IBM Security Verify Governance, Identity Manager software component

Summary Vulnerabilities exists which affects IBM Db2, which in turn is used by IBM Security Verify Governance, Identity Manager software component. Information about the security vulnerabilities affecting IBM Db2 has been published in a security bulletin. Vulnerability Details Refer to the securi...

Security Bulletin: Multiple Vulnerabilities in IBM® Java SDK affect IBM Predictive Maintenance and Quality and Predictive Maintenance Insights On-Premises (CVE-2022-21496, 2022-21299)

Summary IBM Predictive Maintenance and Quality and Predictive Maintenance Insights On-Premises is bundled with IBM SPSS, IBM Cognos, IBM DB2 and IBM Websphere Application Server. IBM Websphere Application Server is vulnerable to Multiple Vulnerabilities in IBM® Java SDK CVE-2022-21496, 2022-21299...

Security Bulletin: Security vulnerabilities have been identified in IBM DB2 shipped with IBM License Metric Tool v9.

Summary IBM DB2 is shipped with IBM License Metric Tool. Information about security vulnerabilities affecting IBM DB2 has been published in separate security bulletins. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and Versions...

Security Bulletin: Multiple security vulnerabilities have been identified in IBM DB2, which is supported by IBM Security Verify Governance

Summary IBM DB2 is supported as an external component of IBM Security Verify Governance . Information about multiple security vulnerabilities affecting IBM DB2 has been published in three security bulletins. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes...

Security Bulletin: Open Redirect and Cross-Site Scripting Vulnerabilities in the locally installable IBM DB2 Information Center (CVE-2012-2159, CVE-2012-2161, CVE-2013-0467)

Abstract The IBM DB2 Information Center package gives you local access to DB2 documentation on a local or intranet system. Some scripts in the help system, used by DB2 Information Center, are vulnerable to open redirect, or cross-site scripting attacks. This security bulletin only applies to the...

Security Bulletin: Buffer Overflow Vulnerability in IBM DB2 SQL/PSM Stored Procedure Infrastructure (CVE-2012-4826).

Abstract Vulnerability in IBM DB2 could allow an authenticated user to cause a stack-based buffer overflow and possibly attain remote code execution. Content VULNERABILITY DETAILS CVE ID: CVE-2012-4826 DESCRIPTION: The IBM DB2 products listed below contain a security vulnerability that could allo...

Security Bulletin: IBM DB2 Java API Documentation Frame Injection Vulnerability (CVE-2013-1571)

Abstract Java API Documentation contains a frame injection vulnerability. Content VULNERABILITY DETAILS: CVEID: CVE-2013-1571 DESCRIPTION: HTML documentation generated by the Javadoc tool contains a security vulnerability. The vulnerability allows an attacker to craft a malicious link to the...

Security Bulletin: IBM DB2 is impacted by a vulnerability in the IBM GSKit library (CVE-2013-0169).

Abstract GSKit is used by IBM DB2 for SSL support. The version of GSKit iused by DB2 is vulnerable to the “Lucky Thirteen” security vulnerability. By default, DB2 does not use SSL for client-server communication and therefore DB2 is vulnerable only if SSL is enabled. Content VULNERABILITY DETAILS...

Security Bulletin: IBM PureData System for Operational Analytics A1791 and IBM Smart Analytics System 7600, 7700, and 7710 are affected by a privilege escalation vulnerability in the DB2 Audit Facility (CVE-2013-3475)

Abstract The IBM PureData System for Operational Analytics A1791, IBM Smart Analytics System 7600, IBM Smart Analytics System 7700, and IBM Smart Analytics System 7710 are shipped with DB2 9.7 or DB2 10.1. These versions of DB2 contain a security vulnerability in the DB2 Audit Facility which allo...

Security bulletin: Open redirect and cross-site scripting vulnerabilities in DB2 QMF for Workstation and DB2 QMF for WebSphere help systems (CVE-2012-2159, CVE-2012-2161)

Abstract IBM DB2 QMF for Workstation and IBM DB2 QMF for WebSphere make use of the IBM Eclipse Help System IEHS, which has the security vulnerabilities described in this bulletin. Content VULNERABILITY DETAILS: A brief description of each vulnerability is provided below. IBM does not intend to...