Buffer overflow

IBM DB2 for Linux, UNIX and Windows includes DB2 Connect Server 9.7, 10.1, 10.5, 11.1, and 11.5 is vulnerable to a buffer overflow, caused by improper bounds checking which could allow a local attacker to execute arbitrary code on the system with root privileges. IBM X-Force ID: 174960...

CVE-2020-4230

IBM DB2 for Linux, UNIX and Windows includes DB2 Connect Server 11.1 and 11.5 is vulnerable to an escalation of privilege when an authenticated local attacker with special permissions executes specially crafted Db2 commands. IBM X-Force ID: 175212...

CVE-2020-4230

CVE-2020-4230 affects IBM DB2 for Linux/UNIX/Windows (DB2 Connect Server) 11.1 and 11.5. An authenticated local attacker with special permissions can escalate privileges by executing specially crafted Db2 commands. IBM bulletins provide fixes via release-specific fix packs (e.g., DB2 11.1 FP6 and...

CVE-2020-4204

IBM DB2 for Linux, UNIX and Windows includes DB2 Connect Server 9.7, 10.1, 10.5, 11.1, and 11.5 is vulnerable to a buffer overflow, caused by improper bounds checking which could allow a local attacker to execute arbitrary code on the system with root privileges. IBM X-Force ID: 174960...

CVE-2020-4200

CVE-2020-4200 affects IBM DB2 for Linux, UNIX and Windows (incl. DB2 Connect Server) on 10.5, 11.1, and 11.5. An authenticated attacker could send specially crafted commands to cause a denial of service. IBM and related bulletins indicate remediation via applying the appropriate DB2 fix pack or s...

CVE-2020-4204

CVE-2020-4204 affects IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) across multiple releases (9.7, 10.1, 10.5, 11.1, 11.5). Description confirms a buffer overflow caused by improper bounds checking that could allow a local, authenticated attacker to execute arbitrary code with...

CVE-2020-4200

IBM DB2 for Linux, UNIX and Windows includes DB2 Connect Server 10.5, 11.1, and 11.5 could allow an authenticated attacker to send specially crafted commands to cause a denial of service. IBM X-Force ID: 174914...

CVE-2020-4161

IBM DB2 for Linux, UNIX and Windows includes DB2 Connect Server 11.5 could allow an authenticated attacker to cause a denial of service due to incorrect handling of certain commands. IBM X-Force ID: 174341...

CVE-2020-4161

CVE-2020-4161 affects IBM DB2 for Linux, UNIX and Windows (including DB2 Connect Server) version 11.5. An authenticated attacker could cause a denial of service due to incorrect handling of certain commands. Remediation: upgrade to IBM Db2 Warehouse DB2 11.5.x at or above 11.5.5.1 (or apply the c...

CVE-2020-4135

CVE-2020-4135 affects IBM DB2 on Linux/UNIX/Windows (including DB2 Connect Server) across 9.7, 10.1, 10.5, 11.1, 11.5. An unauthenticated attacker could send specially crafted packets to cause denial of service via excessive memory usage. Public materials confirm impact as a network-accessible Do...

CVE-2020-4135

IBM DB2 for Linux, UNIX and Windows includes DB2 Connect Server 9.7, 10.1, 10.5, 11.1, and 11.5 could allow an unauthenticated user to send specially crafted packets to cause a denial of service from excessive memory usage...

Vulnerabilities fixed in Db2

IBM has fixed several vulnerabilities in Db2. A unauthenticated malicious person could potentially cause a denial-of-service cause. IBM has made updates available to fix the vulnerabilities fixes in DB2. For more information about the vulnerabilities and how to fixing them, see: CVE-2020-4135:...

Security Bulletin: A security vulnerability has been identified in multiple products that ship with IBM Predictive Customer Intelligence (CVE-2014-3566)

Summary IBM Cognos Business Intelligence, IBM Infosphere Integration Bus, IBM WebSphere MQ, IBM DB2 Enterprise Server, IBM HTTP Server and IBM SPSS Modeler are shipped as components of IBM Predictive Customer Intelligence. Information about security vulnerabilities affecting IBM Cognos Business...

Security Bulletin: IBM® Db2® LUW on AIX and Linux Affected by a Vulnerability in IBM® Spectrum Scale (CVE-2019-4558)

Summary Db2 LUW is affected by a vulnerability in IBM® Spectrum Scale Version 5.0.x and 4.2.x that is used by Db2® pureScale™ Feature on AIX and Linux. IBM Spectrum Scale is previously known as General Parallel File System GPFS. Vulnerability Details CVEID: CVE-2019-4558 DESCRIPTION: A security...

Security Bulletin: IBM® Db2® LUW on AIX and Linux Affected by a Vulnerability in IBM® Spectrum Scale (CVE-2018-1783).

Summary Db2 LUW is affected by a vulnerability in IBM® Spectrum Scale Version 4.1.x and 4.2.x that is used by Db2® pureScale™ Feature on AIX and Linux. IBM Spectrum Scale is previously known as General Parallel File System GPFS. Vulnerability Details CVEID: CVE-2018-1783 DESCRIPTION: IBM GPFS IBM...

Security Bulletin: IBM Db2 High Performance Unload is affected by 3RD PARTY - - Unquoted Service Path vulnerability

Summary IBM Db2 High Performance Unload has addressed the following vulnerability:Unquoted Service Path Vulnerability Details CVEID: CVE-2019-4606 DESCRIPTION: IBM DB2 High Performance Unload could allow a local attacker to execute arbitrary code on the system, caused by an untrusted search path...

Security Bulletin: A security vulnerability has been identified in IBM DB2 shipped with IBM Maximo Asset Management (CVE-2019-4523)

Summary IBM DB2 is shipped as a component of IBM Maximo Asset Management. Information about the security vulnerability affecting IBM DB2 has been published in a security bulletin. Vulnerability Details Refer to the security bulletinss listed in the Remediation/Fixes section Affected Products and...

Security Bulletin: Vulnerability in IBM Java Runtime affect DB2 Recovery Expert for Linux, Unix and Windows(IBM SDK, Java Technology Edition Quarterly CPU - Jul 2019 - Includes Oracle Jul 2019 CPU) )

Summary DB2 Recovery Expert for Linux, UNIX and Windows has addressed the following vulnerabilities:CVE-2019-4473,CVE-2019-11771. These issues were disclosed as part of the IBM Java SDK updates in July. 2019. Vulnerability Details CVEID: CVE-2019-4473 DESCRIPTION: Multiple binaries in IBM SDK, Ja...

Security Bulletin: IBM Data Server Driver for JDBC and SQLJ is affected by a 3RD PARTY Unsafe deserialization

Summary Unsafe deserialization in DB2 JDBC driver Vulnerability Details CVEID: CVE-2017-1677 DESCRIPTION: IBM Data Server Driver for JDBC and SQLJ IBM DB2 for Linux, UNIX and Windows 9.7, 10.1, 10.5, and 11.1 deserializes the contents of /tmp/connlicj.bin which leads to object injection and...

Security Bulletin: IBM Db2 Mirror for i is affected by CVE-2019-4536

Summary IBM Db2 Mirror for i configurations may be subject to this security vulnerability. A PTF for IBM i 7.4 and remediation steps are available. Vulnerability Details CVEID: CVE-2019-4536 DESCRIPTION: IBM i 7.4 users who have done a Restore User Profile RSTUSRPRF on a system which has been...