Security Bulletin: Security vulnerability in IBM InfoSphere Guardium S-TAP for DB2 on z/OS (CVE-2013-0490)

Abstract An unspecified vulnerability in IBM InfoSphere Guardium S-TAP for DB2 on z/OS v8.1 could allow local attackers to execute arbitrary commands via unknown vectors. Content VULNERABILITY DETAILS: CVE ID: CVE-2013-0490 CVSS: CVSS Base Score: 7.2 CVSS Temporal Score: See...

Security Bulletin: Multiple vulnerabilities in IBM DB2 Performance Expert and IBM InfoSphere Optim Performance Manager due to vulnerabilities in IBM Java Runtime Environment (CVE-2012-1720, CVE-2012-5081).

Abstract DB2® Performance Expert and InfoSphere® Optim™ Performance Manager use the IBM® Java™ Runtime Environment JRE and might be affected by vulnerabilities in the IBM JRE. Content VULNERABILITY DETAILS: CVE ID: CVE-2012-1720 DESCRIPTION: An unspecified vulnerability in the JRE component allow...

Security Bulletin: Multiple GSKit Vulnerabilities in IBM DB2 (CVE-2012-2190, CVE-2012-2191, CVE-2012-2203).

Abstract GSKit is an IBM product that is used by IBM DB2 for SSL support. The GSKit that is shipped with DB2 contains multiple security vulnerabilities. By default, DB2 does not use SSL for client-server communication and therefore, this vulnerability affects DB2 only if SSL is enabled. Content...

Security Bulletin: DB2 Escalation of Privilege Vulnerability (CVE-2011-4061)

Abstract The IBM Tivoli Monitoring Agent shipped with IBM DB2 V9.5 and V9.7 products contains an escalation of privilege vulnerability. Content VULNERABILITY DETAILS CVE ID: CVE-2011-4061 DESCRIPTION: The IBM DB2 products listed below bundle IBM Tivoli Monitoring Agent ITMA, provided for users of...

Security Bulletin: Potential Oracle Outside In Technology Vulnerabilities Exposed in DB2 9.7.0.4 Accessories Suite (CVE-2011-2264, CVE-2011-0794, and CVE-2011-0808)

Abstract Oracle Outside In Technology contains exploitable vulnerabilities in the CorelDRAW CVE-2011-2264 file parser, the File ID SDK CVE-2011-0794, and file filters CVE-2011-0808. Each of these vulnerabilities may allow a remote, unauthenticated user to execute arbitrary code on a vulnerable...

Security Bulletin: IBM DB2 Security Vulnerability in SQLJ.DB2_INSTALL_JAR (CVE-2012-2194).

Abstract Vulnerability in IBM DB2 could allow an authenticated user, without proper authorization, to overwrite JAR files. Content VULNERABILITY DETAILS CVE ID: CVE-2012-2194 DESCRIPTION: The IBM DB2 products listed below contain a security vulnerability that could allow an authenticated user,...

Security Bulletin: XML File Disclosure Vulnerability in IBM DB2 GET_WRAP_CFG_C and GET_WRAP_CFG_C2 (CVE-2012-2196).

Abstract Vulnerability in IBM DB2 could allow an authenticated user, without proper authorization, to read XML files. Content VULNERABILITY DETAILS CVE ID: CVE-2012-2196 DESCRIPTION: The IBM DB2 products listed below contain a security vulnerability that could allow an authenticated user, without...

Security Bulletin: Buffer Overflow Vulnerability in IBM DB2 Java Stored Procedure Infrastructure (CVE-2012-2197).

Abstract Vulnerability in IBM DB2 could allow an authenticated user to cause a stack-based buffer overflow and possibly attain remote code execution. Content VULNERABILITY DETAILS CVE ID: CVE-2012-2197 DESCRIPTION: The IBM DB2 products listed below contain a security vulnerability that could allo...

Security Bulletin: Multiple security vulnerabilities have been identified in IBM DB2 supported by IBM Security Verify Governance

Summary IBM DB2 is supported as an external component of IBM Security Verify Governance . Information about five security vulnerabilities affecting IBM DB2 has been published in five security bulletins. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section...

Security Bulletin: An Unspecified Vulnerability in Java runtime affects Predictive Maintenance and Quality and Predictive Maintenance Insights (CVE-2021-35603)

Summary IBM Predictive Maintenance and Quality and Predictive Maintenance Insights On-Premises is bundled with IBM SPSS, IBM Cognos, IBM DB2 and IBM Websphere Application Server Liberty. Some of the component products are vulnerable to unspecified vulnerability in Java runtime CVE-2021-35603. Thi...

Security Bulletin: Multiple security vulnerabilities may affect IBM DB2 shipped with Predictive Maintenance and Quality and Predictive Maintenance Insights On-Premises (CVE-2021-38931,CVE-2021-20373)

Summary IBM DB2 is shipped with IBM Predictive Maintenance and Quality and Predictive Maintenance Insights On-Premises. Information about security vulnerabilities affecting DB2 has been published in multiple security bulletins as below. Interim fix is provided by DB2 for each of the fix pack...

Security Bulletin: Security vulnerabilities have been identified in IBM® DB2® shipped with Asset and Service Management (CVE-2014-0907)

Summary IBM DB2 is shipped as a component of Maximo Asset Management, Maximo Asset Management Essentials, Maximo Industry Solutions including Maximo for Government, Maximo for Nuclear Power, Maximo for Transportation, Maximo for Life Sciences, Maximo for Oil and Gas and Maximo for Utilities, Tivo...

Security Bulletin: Security vulnerabilities have been identified in IBM® DB2® shipped with Asset and Service Management (CVE-2013-6747, CVE-2014-0963)

Summary IBM DB2 is shipped as a component of Maximo Asset Management, Maximo Asset Management Essentials, Maximo Industry Solutions including Maximo for Government, Maximo for Nuclear Power, Maximo for Transportation, Maximo for Life Sciences, Maximo for Oil and Gas and Maximo for Utilities, Tivo...

Security Bulletin: Vulnerabilities in IBM Db2, Golang Go, and Logback may affect the IBM Spectrum Protect Server (CVE-2022-30631, CVE-2022-30633, CVE-2022-1705, CVE-2022-22389, CVE-2022-22390, CVE-2021-42550, CVE-2022-30629)

Summary The IBM Spectrum Protect Server may be affected by vulnerabilities in IBM Db2, Golang Go, and Logback such as denial of service, HTTP request smuggling, obtaining sensitive information, and execution of arbitrary code. Vulnerability Details CVEID:CVE-2022-30631 DESCRIPTION: Golang Go is...

CVE-2022-35637

IBM Db2 for Linux, UNIX and Windows 9.7, 10.1, 10.5, 11.1, and 11.5 is vulnerable to a denial of service after entering a malformed SQL statement into the Db2expln tool. IBM X-Force ID: 230823...

CVE-2022-22483

IBM Db2 for Linux, UNIX and Windows 9.7, 10.1, 10.5, 11.1, and 11.5 is vulnerable to an information disclosure in some scenarios due to unauthorized access caused by improper privilege management when CREATE OR REPLACE command is used. IBM X-Force ID: 225979...

CVE-2022-35637

IBM Db2 for Linux, UNIX and Windows 9.7, 10.1, 10.5, 11.1, and 11.5 is vulnerable to a denial of service after entering a malformed SQL statement into the Db2expln tool. IBM X-Force ID: 230823...

Information disclosure

IBM Db2 for Linux, UNIX and Windows 9.7, 10.1, 10.5, 11.1, and 11.5 is vulnerable to an information disclosure in some scenarios due to unauthorized access caused by improper privilege management when CREATE OR REPLACE command is used. IBM X-Force ID: 225979...

Design/Logic Flaw

IBM Db2 for Linux, UNIX and Windows 9.7, 10.1, 10.5, 11.1, and 11.5 is vulnerable to a denial of service after entering a malformed SQL statement into the Db2expln tool. IBM X-Force ID: 230823...

CVE-2022-35637

IBM Db2 for Linux, UNIX and Windows 9.7, 10.1, 10.5, 11.1, and 11.5 is vulnerable to a denial of service after entering a malformed SQL statement into the Db2expln tool. IBM X-Force ID: 230823...