Design/Logic Flaw

When using IBM Spectrum Protect Plus 10.1.0, 10.1.2, and 10.1.3 to protect Oracle, DB2 or MongoDB databases, a redirected restore operation specifying a target path may allow execution of arbitrary code on the system. IBM X-Force ID: 161667,...

CVE-2019-4386

IBM DB2 for Linux, UNIX and Windows includes DB2 Connect Server 11.1 could allow an authenticated user to execute a function that would cause the server to crash. IBM X-Force ID: 162714...

CVE-2019-4322

IBM DB2 for Linux, UNIX and Windows includes DB2 Connect Server 9.7, 10.1, 10.5, and 11.1 is vulnerable to a buffer overflow, which could allow an authenticated local attacker to execute arbitrary code on the system as root. IBM X-Force ID: 161202...

CVE-2019-4357

When using IBM Spectrum Protect Plus 10.1.0, 10.1.2, and 10.1.3 to protect Oracle, DB2 or MongoDB databases, a redirected restore operation specifying a target path may allow execution of arbitrary code on the system. IBM X-Force ID: 161667,...

CVE-2019-4386

CVE-2019-4386 affects IBM DB2 for Linux, UNIX and Windows (incl. DB2 Connect Server). Affected versions include Db2 11.1 (and related 10.x/9.x lines per bulletins) where an authenticated user can execute a function that crashes the server. The issue is documented across IBM bulletins linked in th...

CVE-2019-4357

IBM Spectrum Protect Plus vulnerable in 10.1.0–10.1.3 when protecting Oracle/DB2/MongoDB: a redirected restore operation with a target path may allow arbitrary code execution on the host. Affected components are the restore workflow and its path handling; user privileges required are HIGH with lo...

CVE-2019-4322

CVE-2019-4322 affects IBM DB2 for Linux/Unix/Windows (DB2 Connect Server) across multiple releases (9.7, 10.1, 10.5, 11.1). Root cause is a buffer overflow that could let an authenticated local user execute code as root. IBM bulletin ABDD1145 and related pages indicate fixes are available: Db2 fo...

CVE-2019-4101

CVE-2019-4101 affects IBM DB2 for Linux, UNIX and Windows (incl. DB2 Connect Server) on DB2 v10.1, v10.5 and v11.1. The issue is a denial of service caused by a condition where a user with EXECUTE on PD_GET_DIAG_HIST and access to the diagnostic directory can crash the instance. The vulnerability...

CVE-2019-4057

IBM DB2 for Linux, UNIX and Windows includes DB2 Connect Server 9.7, 10.1, 10.5, and 11.1 could allow malicious user with access to the DB2 instance account to leverage a fenced execution process to execute arbitrary code as root. IBM X-Force ID: 156567...

CVE-2019-4102

IBM DB2 for Linux, UNIX and Windows includes DB2 Connect Server 9.7, 10.1, 10.5, and 11.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 158092...

CVE-2019-4101

IBM DB2 for Linux, UNIX and Windows includes DB2 Connect Server 10.1, 10.5, and 11.1 is vulnerable to a denial of service. Users that have both EXECUTE on PDGETDIAGHIST and access to the diagnostic directory on the DB2 server can cause the instance to crash. IBM X-Force ID: 158091...

CVE-2019-4057

CVE-2019-4057 affects IBM DB2 for Linux/UNIX/Windows (including DB2 Connect Server) on versions 9.7, 10.1, 10.5, and 11.1. A local attacker with access to the DB2 instance account can leverage a fenced execution process to execute arbitrary code as root. Multiple IBM security bulletins document t...

CVE-2019-4102

CVE-2019-4102 affects IBM DB2 for Linux/UNIX/Windows (including DB2 Connect Server) across multiple releases (9.7, 10.1, 10.5, 11.0/11.1). Root cause: use of weaker-than-expected cryptographic algorithms, enabling an attacker to decrypt highly sensitive information. Impact: potential confidential...

CVE-2019-4154

CVE-2019-4154 is a buffer overflow in IBM DB2 for Linux, UNIX and Windows (including DB2 Connect Server) that could allow an authenticated local attacker to execute arbitrary code as root. Affected DB2 versions include 9.7, 10.1, 10.5, and 11.1 (Windows not affected per IBM bulletin). Remediation...

CVE-2019-4154

IBM DB2 for Linux, UNIX and Windows includes DB2 Connect Server 9.7, 10.1, 10.5, and 11.1 is vulnerable to a buffer overflow, which could allow an authenticated local attacker to execute arbitrary code on the system as root. IBM X-Force ID: 158519...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK and IBM Java Runtime affect IBM® Db2®.

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Version 7.0.10.35 and earlier, 7.1.4.35 and earlier, 8.0.5.27 and earlier used by IBM® Db2®. These issues were disclosed as part of the IBM Java SDK updates in January 2019. Vulnerability Details If you run your own Java...

PT-2019-16934 · Ibm · Ibm Db2

Name of the Vulnerable Software and Affected Versions: IBM DB2 for Linux, UNIX and Windows includes DB2 Connect Server versions 9.7, 10.1, 10.5, and 11.1 Description: The issue is a buffer overflow that could allow an authenticated local attacker to execute arbitrary code on the system as root...

Security Bulletin: Multiple Db2 vulnerabilities affect the IBM Spectrum Protect Server (CVE-2018-1685, CVE-2018-1710, CVE-2018-1711, CVE-2018-1780, CVE-2018-1781, CVE-2018-1799, CVE-2018-1802, CVE-2018-1834, CVE-2018-1857, CVE-2018-1897)

Summary The IBM Spectrum Protect formerly Tivoli Storage Manager Server is affected by multiple IBM Db2 vulnerabilities. These Db2 vulnerabilities could allow a local user to gain elevated privileges, read any file on the system, or execute arbitrary code on the system. UPDATED 6/28/2019: Added 7...

Security Bulletin: Multiple Db2 vulnerabilities affect the IBM Spectrum Protect Server

Summary The IBM Spectrum Protect formerly Tivoli Storage Manager Server is affected by multiple IBM Db2 vulnerabilities that could allow local users to overwrite files owned by the Db2 instance owner, execution of arbitrary code on the system, or an elevation of privileges. UPDATED 1/16/2019:...

Security Bulletin: Db2 vulnerability affects the IBM Spectrum Protect Server (CVE-2018-1448)

Summary The IBM Spectrum Protect formerly Tivoli Storage Manager Server is affected by an IBM Db2 vulnerability that could allow a local user to overwrite arbitrary files owned by the Db2 instance owner. UPDATED 1/16/2019: Changed "First Fixing VRM Level" in Remediation/Fixes table for 8.1 from...