Security Bulletin: IBM® DB2® LUW contains a denial of service vulnerability in which a malformated DRDA message may cause the DB2 server to terminate abnormally (CVE-2016-0211)

Summary IBM DB2 LUW contains a denial of service vulnerability. A remote, authenticated DB2 user could exploit this vulnerability by issuing a specially-crafted DRDA message and cause DB2 server to terminate abnormally. Vulnerability Details CVEID: CVE-2016-0211 DESCRIPTION: IBM DB2 LUW contains ...

Security Bulletin: Vulnerabilities in the GSKit component of IBM® DB2® LUW (CVE-2016-0201, CVE-2015-7420 & CVE-2015-7421)

Summary Vulnerabilities have been addressed in the GSKit component of IBM DB2 LUW. Vulnerability Details CVEID: CVE-2016-0201 DESCRIPTION: IBM GSKit could allow a remote attacker to obtain sensitive information, caused by a MD5 collision. An attacker could exploit this vulnerability to obtain...

Security Bulletin: Multiple vulnerabilities in IBM Java affect IBM SPSS Modeler (CVE-2016-0466, CVE-2015-7575, CVE-2016-0475)

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Version 6 Service Refresh 16 Fix Pack 15, IBM SDK, Java Technology Edition, Version 7 Service Refresh 9 Fix Pack 20, IBM SDK, Java Technology Edition, Version 7R1 Service Refresh 3 Fix Pack 20 that are used by IBM SP...

Security Bulletin: Vulnerability in IBM Java SDK affects IBM® DB2® LUW (CVE-2015-7575)

Summary There is a vulnerability in IBM® SDK Java™ Technology Edition, Version 6.0 and 7.0 that is used by DB2 LUW. This vulnerability, commonly referred to as “SLOTH”, was disclosed as part of the IBM Java SDK updates in January 2016. Vulnerability Details CVEID: CVE-2015-7575 DESCRIPTION: The T...

Security Bulletin: A security vulnerability has been identified in IBM Java SDK shipped with IBM DB2 Recovery Expert for Linux, UNIX, and Windows (CVE-2015-4872)

Summary IBM Java SDK is shipped as a component of IBM DB2 Recovery Expert for Linux, UNIX, and Windows . Information about a security vulnerability affecting IBM Java SDK has been published in a security bulletin. Vulnerability Details CVEID: CVE-2015-4872 DESCRIPTION: An unspecified vulnerabilit...

Security Bulletin: Local escalation of privilege vulnerability in IBM® DB2® LUW (CVE-2015-1947)

Summary A vulnerability in IBM DB2 for Linux, Unix and Windows could allow a local user to gain elevated privilege. Vulnerability Details CVEID: CVE-2015-1947 DESCRIPTION: IBM DB2 is vulnerable to a privilege escalation due to improper build of binaries CVSS Base Score: 7.2 CVSS Temporal Score: S...

Security Bulletin: User sessions running with root GID in IBM SPSS Modeler (CVE-2014-3038)

Summary IBM SPSS Modeler running on Unix platforms contains a vulnerability that could allow a local attacker to gain access to files that normally would only be available to privileged users. The server authenticates a user and spawns a new process that runs in the context of the authenticated...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM DB2 QMF for Workstation (CVE-2015-2613, CVE-2015-2601, CVE-2015-2625)

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Technology Edition, Versions 6 and 8 that are used by IBM DB2 QMF for Workstation. These issues were disclosed as part of the IBM Java SDK updates in July 2015. Vulnerability Details CVEID: CVE-2015-2613 DESCRIPTION: An...

Security Bulletin: Vulnerability in IBM Java SDK affects IBM® DB2® LUW on HP-UX and Solaris (CVE-2015-0383)

Summary There is vulnerability in IBM® SDK Java™ Technology Edition, Version 6.0 SR14, 7.0 SR5 and 7.0 SR6 that is used by DB2 LUW on HP-UX and Solaris. These issues was disclosed as part of the IBM Java SDK updates in January 2015. Vulnerability Details CVEID: CVE-2015-0383 DESCRIPTION: An...

Security Bulletin: IBM® DB2® LUW contains a bypass security vulnerability in its Data Movement feature (CVE-2015-1922)

Summary IBM DB2 LUW contains a bypass security vulnerability in its Data Movement feature. Vulnerability Details CVEID: CVE-2015-1922 DESCRIPTION: IBM DB2 contains a bypass security vulnerability. DB2 Data Movement feature does not perform sufficient privilege checking which allows a user with...

Security Bulletin: IBM® DB2® LUW contains a denial of service vulnerability in scalar functions that may result in arbitrary code execution as the DB2 instance owner (CVE-2015-1935)

Summary IBM® DB2 LUW contains a denial of service vulnerability in scalar functions. A remote, authenticated user can exploit this vulnerability to run arbitrary code with the authority of the DB2 instance owner, or cause a denial of service. Vulnerability Details CVEID: CVE-2015-1935 DESCRIPTION...

Security Bulletin: Multiple vulnerabilities in GPFS affects IBM® DB2® LUW on AIX and Linux (CVE-2015-0197, CVE-2015-0198, CVE-2015-0199)

Summary There are multiple vulnerabilities in IBM® General Parallel File System, Versions V3.4 and V3.5 that are used by DB2® pureScale™ Feature on AIX and Linux. Vulnerability Details CVEID: CVE-2015-0197 DESCRIPTION: IBM General Parallel File System could allow a local attacker which only has a...

Security Bulletin: IBM InfoSphere Information Server is vulnerable to root privilege escalation (CVE-2015-1900)

Summary IBM InfoSphere Information Server could allow a local user to execute code with root privileges on the engine tier. Vulnerability Details CVEID: CVE-2015-1900 DESCRIPTION: IBM InfoSphere DataStage could allow a local user to bypass security and replace executables with malicious files tha...

Security Bulletin: Vulnerability in RC4 stream cipher affects IBM DB2 QMF for Workstation (CVE-2015-2808)

Summary The RC4 “Bar Mitzvah” Attack for SSL/TLS affects DB2 QMF for Workstation. The RC4 algorithm, as used in the TLS protocol and SSL protocol, could allow a remote attacker to obtain sensitive information. An attacker could exploit this vulnerability to remotely expose account credentials...

Security Bulletin: Vulnerabilities in GSKit affect IBM® DB2® (CVE-2015-0138, CVE-2015-0159 and CVE-2014-6221)

Summary GSKit is an IBM component that is used by IBM DB2. The GSKit that is shipped with IBM DB2 contains multiple security vulnerabilities including the “FREAK: Factoring Attack on RSA-EXPORT keys" TLS/SSL client and server vulnerability. IBM DB2 has addressed the applicable CVEs. Vulnerability...

Security Bulletin: IBM® DB2® contains a file disclosure vulnerability in the database automated maintenance feature (CVE-2015-1883)

Summary IBM DB2 contains a file disclosure vulnerability in the database automated maintenance feature. A remote, authenticated DB2 user with elevated privilege could exploit this vulnerability by manipulating an automated maintenance policy stored procedure to view any files owned by the DB2...

Security Bulletin: IBM® DB2® contains a file disclosure vulnerability using a SELECT statement with XML/XSLT function (CVE-2014-8910)

Summary IBM DB2 contains a file disclosure vulnerability. A remote, authenticated DB2 user could exploit this vulnerability by executing a specially-crafted SELECT statement with XML/XSLT function to read arbitrary text files owned by the DB2 instance owner. On Windows, the attacker is able to re...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect InfoSphere Streams (CVE-2014-6457, CVE-2014-3566, CVE-2014-3065)

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Version 6 Service Refresh 16 Fix Pack 1 and Version 7R1 Service Refresh 1 Fix Pack 1 that is used by InfoSphere Streams. This also includes a fix for the Padding Oracle On Downgraded Legacy Encryption POODLE SSLv3...

Security Bulletin: TLS padding vulnerability affects IBM Data Server Client packages (CVE-2014-8730)

Summary Transport Layer Security TLS padding vulnerability via a POODLE Padding Oracle On Downgraded Legacy Encryption like attack affects IBM Data Server Client packages. Vulnerability Details CVE-ID: CVE-2014-8730 DESCRIPTION: Product could allow a remote attacker to obtain sensitive informatio...

Security Bulletin: TLS padding vulnerability affects IBM® DB2® LUW (CVE-2014-8730)

Summary Transport Layer Security TLS padding vulnerability via a POODLE Padding Oracle On Downgraded Legacy Encryption like attack affects IBM® DB2® LUW. Vulnerability Details CVE-ID: CVE-2014-8730 DESCRIPTION: Product could allow a remote attacker to obtain sensitive information, caused by the...