Design/Logic Flaw

Db2 for Linux, UNIX and Windows includes Db2 Connect Server is vulnerable to a denial of service as the server terminates abnormally when executing a specially crafted SELECT statement. IBM X-Force ID: 200659...

Race condition

IBM Db2 for Linux, UNIX and Windows includes Db2 Connect Server 11.5 could allow a local user to access and change the configuration of Db2 due to a race condition of a symbolic link,. IBM X-Force ID: 190909...

Input validation

IBM Db2 for Linux, UNIX and Windows includes Db2 Connect Server 11.5 could allow an authenticated user to overwrite arbirary files due to improper group permissions. IBM X-Force ID: 191945...

Code injection

IBM Db2 for Linux, UNIX and Windows includes Db2 Connect Server 9.7, 10.1, 10.5, 11.1, and 11.5, under specific circumstance of a table being dropped while being accessed in another session, could allow an authenticated user to cause a denial of srevice IBM X-Force ID: 203031...

CVE-2021-29777

IBM Db2 for Linux, UNIX and Windows includes Db2 Connect Server 9.7, 10.1, 10.5, 11.1, and 11.5, under specific circumstance of a table being dropped while being accessed in another session, could allow an authenticated user to cause a denial of srevice IBM X-Force ID: 203031...

CVE-2021-29777

IBM Db2 LUW (includes Db2 Connect Server) 9.7, 10.1, 10.5, 11.1, 11.5 is affected by CVE-2021-29777 among related CVEs. Under very specific conditions — when a table is dropped while it is being accessed in another session — an authenticated user could cause a denial of service. Related entries (...

CVE-2021-29703

CVE-2021-29703 affects IBM Db2 LUW (Linux/UNIX/Windows) and Db2 Connect Server. The issue allows a denial of service because the server can terminate abnormally when executing a specially crafted SELECT statement. IBM security bulletins document the vulnerability and provide fixes; remediation is...

CVE-2021-29703

Db2 for Linux, UNIX and Windows includes Db2 Connect Server is vulnerable to a denial of service as the server terminates abnormally when executing a specially crafted SELECT statement. IBM X-Force ID: 200659...

CVE-2021-20579

IBM Db2 for Linux, UNIX and Windows includes Db2 Connect Server 9.7, 10.1, 10.5, 11.1, and 11.5 could allow a user who can create a view or inline SQL function to obtain sensitive information when AUTOREVAL is set to DEFFEREDFORCE. IBM X-Force ID: 199283...

CVE-2021-20579

CVE-2021-20579 affects IBM Db2 for Linux, UNIX and Windows (Db2 LUW) and Db2 Connect Server, across versions 9.7, 10.1, 10.5, 11.1, and 11.5. The vulnerability arises when a user who can create a view or inline SQL function can expose sensitive information if AUTO_REVAL is set to DEFFERED_FORCE. ...

CVE-2020-4945

IBM Db2 for Linux, UNIX and Windows includes Db2 Connect Server 11.5 could allow an authenticated user to overwrite arbirary files due to improper group permissions. IBM X-Force ID: 191945...

CVE-2020-4945

CVE-2020-4945 affects IBM Db2 LUW (11.5, includes Db2 Connect Server) and IBM Cloud Pak System Software, where an authenticated user could overwrite arbitrary files due to improper group permissions. The root cause is file-permission misconfigurations that grant the attacker enough access to repl...

CVE-2020-4885

IBM Db2 for Linux, UNIX and Windows includes Db2 Connect Server 11.5 could allow a local user to access and change the configuration of Db2 due to a race condition of a symbolic link,. IBM X-Force ID: 190909...

CVE-2020-4885

CVE-2020-4885 affects IBM Db2 LUW 11.5 (and Db2 Connect Server). Root cause is a race condition involving a symbolic link that lets a local user access and change Db2 configuration. The connected IBM bulletins describe remediation through upgrade paths to fixed DB2 versions (e.g., DB2 v11.5.7 / C...

Security Bulletin: Security vulnerabilities have been identified in IBM DB2 shipped with IBM License Metric Tool v9.

Summary IBM DB2 is shipped with IBM License Metric Tool. Information about a security vulnerabilities affecting IBM DB2 has been published in a separated security bulletins. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and Version...

Vulnerabilities fixed in IBM DB2

Vulnerabilities have been fixed in IBM DB2. The vulnerabilities allow a malicious person to perform attacks that lead to the following categories of damage: Denial-of-Service DoS Circumvention of security measure Accessing sensitive data IBM has released updates to fix the vulnerabilities. More...

Security Bulletin: IBM® Db2® 'Check for Updates' process is vulnerable to DLL hijacking (CVE-2019-4588)

Summary When a Db2 administrator executes the check for updates application from the start menu or from the command line, the Flexnet agent binary agent.exe may be vulnerable to DLL hijacking. Vulnerability Details CVEID: CVE-2019-4588 DESCRIPTION: IBM DB2 for Linux, UNIX and Windows includes DB2...

Security Bulletin: Multiple vulnerabilities in dependent libraries affect IBM® Db2® leading to denial of service or privilege escalation.

Summary Multiple vulnerabilities in dependent libraries affect IBM® Db2® leading to denial of service or privilege escalation. Vulnerability Details CVEID: CVE-2014-3577 DESCRIPTION: Apache HttpComponents could allow a remote attacker to conduct spoofing attacks, caused by the failure to verify...

CVE-2020-4945

IBM Db2 for Linux, UNIX and Windows includes Db2 Connect Server 11.5 could allow an authenticated user to overwrite arbirary files due to improper group permissions. IBM X-Force ID: 191945...

CVE-2020-4885

IBM Db2 for Linux, UNIX and Windows includes Db2 Connect Server 11.5 could allow a local user to access and change the configuration of Db2 due to a race condition of a symbolic link,. IBM X-Force ID: 190909...