CVE-2018-1488

IBM DB2 for Linux, UNIX and Windows includes DB2 Connect Server 10.5 and 11.1 is vulnerable to a buffer overflow, which could allow an authenticated local attacker to execute arbitrary code on the system as root. IBM X-Force ID: 140973...

CVE-2018-1451

IBM DB2 for Linux, UNIX and Windows includes DB2 Connect Server 9.7, 10.1, 10.5, and 11.1 contains a vulnerability that could allow a local user to overwrite arbitrary files owned by the DB2 instance owner. IBM X-Force ID: 140046...

CVE-2018-1515

CVE-2018-1515 affects IBM DB2 for Linux, UNIX and Windows (DB2 Connect Server) 10.5 and 11.1. Under specific or unusual conditions, the local db2convert tool could overflow a buffer, enabling privilege escalation to the DB2 instance owner. Root cause: buffer overflow in db2convert. Affected versi...

CVE-2018-1459

CVE-2018-1459 affects IBM Db2 for Linux, UNIX and Windows (including DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1. The vulnerability is a stack-based buffer overflow caused by improper bounds checking, which could allow an attacker to execute arbitrary code locally. The NVD entry lists a CVSSv3 ...

CVE-2018-1459

IBM DB2 for Linux, UNIX and Windows includes DB2 Connect Server 9.7, 10.1, 10.5, and 11.1 is vulnerable to stack based buffer overflow, caused by improper bounds checking which could lead an attacker to execute arbitrary code. IBM X-Force ID: 140210...

CVE-2018-1450

IBM DB2 for Linux, UNIX and Windows includes DB2 Connect Server 9.7, 10.1, 10.5, and 11.1 contains a vulnerability that could allow a local user to overwrite arbitrary files owned by the DB2 instance owner. IBM X-Force ID: 140045...

CVE-2018-1450

CVE-2018-1450 affects IBM Db2 on Linux, UNIX and Windows (including DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1. The issue allows a local unprivileged user to overwrite arbitrary files owned by the Db2 instance owner, typically via a symlink attack. Root cause: file overwrite vulnerability in D...

CVE-2018-1565

CVE-2018-1565 affects IBM DB2 for Linux, UNIX and Windows (DB2 Connect Server) 9.7, 10.1, 10.5, 11.1. Description: a local user overflow of a buffer could lead to privilege escalation to the DB2 instance owner. Impact per documents: local, unauthenticated user privileges exploited via buffer over...

CVE-2018-1544

CVE-2018-1544 affects IBM Db2 for Linux, UNIX and Windows (including DB2 Connect Server) versions 9.7, 10.1, 10.5, and 11.1. The vulnerability is a local buffer overflow in certain Db2 tools (notably db2exmig/db2exfmt) that can lead to privilege escalation of the DB2 instance owner. Several conne...

CVE-2018-1544

IBM DB2 for Linux, UNIX and Windows includes DB2 Connect Server 9.7, 10.1, 10.5, and 11.1 could allow a local user to overflow a buffer which may result in a privilege escalation to the DB2 instance owner. IBM X-Force ID: 142648...

CVE-2018-1565

IBM DB2 for Linux, UNIX and Windows includes DB2 Connect Server 9.7, 10.1, 10.5, and 11.1 could allow a local user to overflow a buffer which may result in a privilege escalation to the DB2 instance owner. IBM X-Force ID: 143022...

CVE-2018-1515

IBM DB2 for Linux, UNIX and Windows includes DB2 Connect Server 10.5 and 11.1, under specific or unusual conditions, could allow a local user to overflow a buffer which may result in a privilege escalation to the DB2 instance owner. IBM X-Force ID: 141624...

CVE-2018-1452

CVE-2018-1452 affects IBM DB2 for Linux/UNIX/Windows (including DB2 Connect Server) across multiple versions (9.7, 10.1, 10.5, 11.1). A local user could overwrite arbitrary files owned by the DB2 instance owner. IBM security bulletins cite fixes: DB2 v11.1–11.1.3.3 (iFix001); v10.5–FP9; v10.1–FP6...

CVE-2018-1449

CVE-2018-1449 affects IBM DB2 for Linux, UNIX and Windows (incl. DB2 Connect Server) versions 9.7, 10.1, 10.5, 11.1; vulnerability allows a local user to overwrite arbitrary files owned by the DB2 instance owner. Connected IBM bulletins show multiple DB2-related CVEs with same class of file-overw...

IBM DB2 Buffer Overflow Vulnerability (CNVD-2018-10802)

IBM DB2 is a relational database management system developed by IBM in the United States, and its main operating environments are UNIX including IBM's own AIX, Linux, IBM i formerly known as OS/400, z/OS, and Windows server versions. A buffer overflow vulnerability exists in db2convert in IBM DB2...

IBM DB2 Shared Memory Insecure Permissions Vulnerability

Summary An exploitable shared memory permissions vulnerability exists in the functionality of IBM DB2 10.5.0.7. An attacker can access the shared memory without any specific permissions to trigger this vulnerability. Tested Versions IBM DB2 10.5.0.7 Product URLs...

IBM DB2 GSKit Privilege Acquisition Vulnerability

IBM DB2 is a set of relational database management system of American IBM Company. The system is implemented in UNIX, Linux, IBM i, z/OS, and Windows server versions.GSKit is one of a set of security management tools for IBM products. A security vulnerability exists in GSKit in IBM DB2. An attack...

IBM DB2 9.7 < FP11 Special Build 37314 / 10.1 < FP6 Special Build 37313 / 10.5 < FP10 / 11.1.3 < FP3 JDBC Driver Unsafe Deserialization Local Privilege Escalation (Windows)

According to its version, the installation of IBM DB2 on the remote Windows host is either 9.7 prior to Fix Pack 11 Special Build 37314, 10.1 prior to Fix Pack 6 Special Build 37313, 10.5 prior to Fix Pack 10 , or 11.1.3 prior to Fix Pack 3. It is, therefore, affected by a local privilege...

IBM DB2 9.7 < FP11 Special Build 37314 / 10.1 < FP6 Special Build 37313 / 10.5 < FP10 Special Build 37311 / 11.1.3 < FP3 JDBC Driver Unsafe Deserialization Local Privilege Escalation (UNIX)

According to its version, the installation of IBM DB2 running on the remote host is either 9.7 prior to Fix Pack 11 Special Build 37314, 10.1 prior to Fix Pack 6 Special Build 37313, 10.5 prior to Fix Pack 10 Special Build 37311, or 11.1.3 prior to Fix Pack 3. It is, therefore, affected by a loca...

Code injection

IBM GSKit IBM DB2 for Linux, UNIX and Windows 9.7, 10.1, 10.5, and 11.1 duplicates the PRNG state across fork system calls when multiple ICC instances are loaded which could result in duplicate Session IDs and a risk of duplicate key material. IBM X-Force ID: 139071...