Security Bulletin: Vulnerability in IBM Java Runtime affect DB2 Recovery Expert for Linux, Unix and Windows(IBM SDK, Java Technology Edition Quarterly CPU - Jan 2020)

Summary DB2 Recovery Expert for Linux, UNIX and Windows has addressed the following vulnerabilities:CVE-2020-2654 deferred from Oracle Jan 2020 CPU. These issues were disclosed as part of the IBM Java SDK updates in Jan 2020. Vulnerability Details CVEID: CVE-2020-2654 DESCRIPTION: An unspecified...

Security Bulletin: Vulnerability in IBM Java Runtime affect DB2 Recovery Expert for Linux, Unix and Windows(IBM SDK, Java Technology Edition Quarterly CPU - Jan 2020)

Summary DB2 Recovery Expert for Linux, UNIX and Windows has addressed the following vulnerabilities:IBM SDK, Java Technology Edition Quarterly CPU - Jan 2020 - Includes Oracle Jan 2020 CPU minus CVE-2020-2585, CVE-2020-2654, and CVE-2020-2590. These issues were disclosed as part of the IBM Java S...

Security Bulletin: Db2 Query Management Facility is vulnerable to IBM SDK, Java Technology Edition Quarterly CPU & Oracle Jan 2020 (CVE-2019-4732)

Summary IBM SDK, Java Technology Edition Quarterly CPU - Jan 2020 - Includes Oracle Jan 2020 CPU minus CVE-2020-2601, CVE-2020-2654, and CVE-2020-2590 Vulnerability Details All applicable Java SE CVEs published by Oracle as part of their January 2020 Critical Patch Update, except for CVE-2020-260...

Security Bulletin: Multiple Db2 vulnerabilities affect the IBM Spectrum Protect Server (CVE-2019-4057, CVE-2019-4101, CVE-2019-4154, CVE-2019-4386, CVE-2019-4322)

Summary The IBM Spectrum Protect formerly Tivoli Storage Manager Server is affected by multiple IBM Db2 vulnerabilities such as buffer overflow and denial of service. UPDATED: 3/31/2020 to add 7.1 fix. Vulnerability Details CVEID: CVE-2019-4057 DESCRIPTION: IBM DB2 for Linux, UNIX and Windows...

Security Bulletin: A security vulnerability has been identified in IBM DB2 shipped with IBM Maximo Asset Management (CVE-2020-4200)

Summary IBM DB2 is shipped as a component of IBM Maximo Asset Management. Information about the security vulnerability affecting IBM DB2 has been published in a security bulletin. Vulnerability Details Refer to the security bulletinss listed in the Remediation/Fixes section Affected Products and...

Security Bulletin: Security vulnerabilities have been identified in IBM DB2 shipped with IBM License Metric Tool v9.

Summary IBM DB2 is shipped with IBM License Metric Tool. Information about a security vulnerabilities affecting IBM DB2 has been published in a separated security bulletins. Vulnerability Details Refer to the security bulletinss listed in the Remediation/Fixes section Affected Products and Versio...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK and IBM Java Runtime affect IBM® Db2®. (January 2020 CPU)

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Version 7.0.10.55 and earlier, 7.1.4.55 and earlier, 8.0.6.0 and earlier used by IBM® Db2®. These issues were disclosed as part of the IBM Java SDK updates in Jan 2020. Vulnerability Details CVEID: CVE-2020-2593...

Security Bulletin: IBM® Db2® is vulnerable to privilege escalation (CVE-2019-4587)

Summary Db2 could allow a local authenticated attacker to gain elevated privileges on the system, caused by an unquoted search path in sshdworker.exe. By inserting arbitrary file in the path, an attacker could exploit this vulnerability to execute arbitrary code with SYSTEM privileges...

Security Bulletin: Multiple buffer overflow vulnerabilities exist in IBM® Db2® leading to privilege escalation (CVE-2019-4584)

Summary Multiple buffer overflow vulnerabilities exist in IBM® Db2® leading to privilege escalation from an authenticated local user to root. Vulnerability Details CVEID: CVE-2019-4584 DESCRIPTION: IBM DB2 for Linux, UNIX and Windows includes DB2 Connect Server is vulnerable to a buffer overflow,...

Security Bulletin: IBM® Db2® is vulnerable to information disclosure (CVE-2019-4524)

Summary Db2 contains an information disclosure vulnerability, exposing remote storage credentials to privileged users, after running LOAD or UPDATE ALERT CFG through the ADMINCMD stored procedure. Vulnerability Details CVEID: CVE-2019-4524 DESCRIPTION: IBM DB2 for Linux, UNIX and Windows includes...

Security Bulletin: Multiple buffer overflow vulnerabilities exist in IBM® Db2® leading to privilege escalation (CVE-2019-4322).

Summary Multiple buffer overflow vulnerabilities exist in IBM® Db2® leading to privilege escalation from an authenticated local user to either root or instance owner. Vulnerability Details CVEID: CVE-2019-4322 DESCRIPTION: IBM DB2 for Linux, UNIX and Windows includes DB2 Connect Server is...

Security Bulletin: IBM® Db2® is vulnerable to buffer overflow leading to potential arbitrary code execution as root (CVE-2019-4154).

Summary Db2 is vulnerable to a buffer overflow, which could allow an authenticated local attacker to execute arbitrary code on the system as root. Vulnerability Details CVEID: CVE-2019-4154 DESCRIPTION: IBM DB2 for Linux, UNIX and Windows includes DB2 Connect Server is vulnerable to a buffer...

Security Bulletin: IBM® Db2® does not explicitly forbid a weaker than expected 3DES cipher when configured to use SSL (CVE-2019-4102).

Summary TLS 1.2 allows the use of 3DES, which has some known weaknesses, among other supported ciphers. Db2 does not forbid the use of 3DES when configured to use TLS 1.2 protocol. Although Db2 does not choose the cipher out of all available ciphers, the weaker ciphers should be explicitly...

Security Bulletin: Under specialized conditions, IBM® Db2® is vulnerable to denial of service (CVE-2019-4101).

Summary Db2 is vulnerable to a denial of service. Users that have both EXECUTE on PDGETDIAGHIST and access to the diagnostic directory on the DB2 server can cause the instance to crash. Vulnerability Details CVEID: CVE-2019-4101 DESCRIPTION: DB2 for Linux, UNIX and Windows includes DB2 Connect...

Security Bulletin: IBM® Db2® is vulnerable to privilege escalation to root via malicious use of fenced user (CVE-2019-4057).

Summary When a DB2 instance is created a "fenced" user is specified to run external stored procedures/user defined functions. Db2 could allow malicious user with access to the Db2 instance owner account to leverage a fenced execution process to execute arbitrary code as root. This vulnerability...

Security Bulletin: IBM® Db2® is vulnerable to a buffer overflow which could allow a local malicious user to execute arbitrary code (CVE-2019-4014).

Summary Db2 is vulnerable to a buffer overflow which could allow a local malicious user to execute arbitrary code as root. Vulnerability Details CVEID: CVE-2019-4014 DESCRIPTION: IBM DB2 for Linux, UNIX and Windows includes DB2 Connect Server is vulnerable to a buffer overflow, which could allow ...

Security Bulletin: IBM® Db2® is vulnerable to privilege escalation via loading libraries from an untrusted path (CVE-2019-4094).

Summary Db2 binaries load shared libraries from an untrusted path, potentially giving low privileged local user root access. Vulnerability Details CVEID: CVE-2019-4094 DESCRIPTION: IBM DB2 for Linux, UNIX and Windows includes DB2 Connect Server binaries load shared libraries from an untrusted pat...

Security Bulletin: Multiple buffer overflow vulnerabilities exist in IBM® Db2® leading to privilege escalation (CVE-2018-1922, CVE-2018-1923, CVE-2018-1978, CVE-2018-1980, CVE-2019-4015, CVE-2019-4016).

Summary Multiple buffer overflow vulnerabilities exist in IBM® Db2® leading to privilege escalation from an authenticated local user to either root or instance owner. Vulnerability Details CVEID: CVE-2018-1922 DESCRIPTION: IBM DB2 for Linux, UNIX and Windows includes DB2 Connect Server is affecte...

Security Bulletin: IBM® Db2® is vulnerable to privilege escalation via loading libraries from an untrusted path (CVE-2018-1802).

Summary Db2 binaries load shared libraries from an untrusted path, potentially giving low privileged user root access. Vulnerability Details CVEID: CVE-2018-1802 DESCRIPTION: IBM DB2 for Linux, UNIX and Windows includes DB2 Connect Server binaries load shared libraries from an untrusted path...

Security Bulletin: IBM® Db2® is vulnerable to a buffer overflow leading to privilege escalation (CVE-2018-1897).

Summary Db2 is vulnerable to a buffer overflow leading to privilege escalation. Vulnerability Details CVEID: CVE-2018-1897 DESCRIPTION: IBM Db2 db2pdcfg is vulnerable to a stack based buffer overflow, caused by improper bounds checking which could allow an attacker to execute arbitrary code CVSS...