Memory corruption

Memory leak in the Relational Data Services component in IBM DB2 UDB 9.5 before FP6a, when the connection concentrator is enabled, allows remote authenticated users to cause a denial of service heap memory consumption by using a different code page than the database server...

Memory corruption

Memory leak in the Relational Data Services component in IBM DB2 UDB 9.5 before FP6a allows remote authenticated users to cause a denial of service heap memory consumption by executing a 1 user-defined function UDF or 2 stored procedure while using a different code page than the database server...

Design/Logic Flaw

The Install component in IBM DB2 UDB 9.5 before FP6a on Linux, UNIX, and Windows enforces an unintended limit on password length, which makes it easier for attackers to obtain access via a brute-force attack...

Code injection

The "Query Compiler, Rewrite, Optimizer" component in IBM DB2 UDB 9.5 before FP6a allows remote authenticated users to cause a denial of service CPU consumption via a crafted query involving certain UNION ALL views, leading to an indefinitely large amount of compilation time...

Design/Logic Flaw

The audit facility in the Security component in IBM DB2 UDB 9.5 before FP6a uses instance-level audit settings to capture connection aka CONNECT and AUTHENTICATION events in certain circumstances in which database-level audit settings were intended, which might make it easier for remote attackers...

CVE-2010-3739

The CVE-2010-3739 issue affects IBM DB2 UDB 9.5 prior to Fix Pack 6a, where the audit facility in the Security component uses instance-level audit settings to capture CONNECT/AUTHENTICATION events in cases where database-level settings were intended. This could allow remote attackers to connect w...

CVE-2010-3732

The DRDA Services component in IBM DB2 UDB 9.5 before FP6a allows remote authenticated users to cause a denial of service database server ABEND by using the client CLI on Linux, UNIX, or Windows for executing a prepared statement with a large number of parameter markers...

CVE-2010-3734

The Install component in IBM DB2 UDB 9.5 before FP6a on Linux, UNIX, and Windows enforces an unintended limit on password length, which makes it easier for attackers to obtain access via a brute-force attack...

CVE-2010-3735

CVE-2010-3735 affects IBM DB2 UDB 9.5 before FP6a. The vulnerability lies in the Query Compiler, Rewrite, Optimizer component, where remote authenticated users can cause a denial of service by sending a crafted query involving certain UNION ALL views, resulting in an indefinitely large amount of ...

CVE-2010-3740

IBM DB2 UDB 9.5 before FP6a: The Net Search Extender (NSE) Text Search component mishandles an alphanumeric Fuzzy search, allowing remote authenticated users to cause memory consumption and a potential system hang via db2ext.textSearch. The issue is addressed in Fix Pack 6a (FP6a). If exploiting ...

CVE-2010-3737

IBM DB2 UDB 9.5 suffers a memory leak in the Relational Data Services (RDS) component that can be exploited by remote authenticated users to cause a heap DoS by running a UDF or a stored procedure when the client uses a different code page. Affected versions are 9.5 before Fix Pack 6a. Remediatio...

CVE-2010-3738

The Security component in IBM DB2 UDB 9.5 before FP6a logs AUDIT events by using a USERID and an AUTHID value corresponding to the instance owner, instead of a USERID and an AUTHID value corresponding to the logged-in user account, which makes it easier for remote authenticated users to execute...

CVE-2010-3732

CVE-2010-3732 affects IBM DB2 UDB 9.5 prior to FP6a, specifically the DRDA Services component. The issue allows remote authenticated users to trigger a denial of service (database server ABEND) by issuing a prepared statement with a large number of parameter markers via the client CLI on Linux, U...

CVE-2010-3736

CVE-2010-3736 affects IBM DB2 UDB 9.5 before FP6a. The vulnerability is a memory leak in the Relational Data Services component when the connection concentrator is enabled, allowing remote authenticated users to cause a denial of service via heap memory consumption by using a different code page ...

CVE-2010-3737

Memory leak in the Relational Data Services component in IBM DB2 UDB 9.5 before FP6a allows remote authenticated users to cause a denial of service heap memory consumption by executing a 1 user-defined function UDF or 2 stored procedure while using a different code page than the database server...

CVE-2010-3733

The Engine Utilities component in IBM DB2 UDB 9.5 before FP6a uses world-writable permissions for the sqllib/cfg/db2sprf file, which might allow local users to gain privileges by modifying this file...

CVE-2010-3740

The Net Search Extender NSE implementation in the Text Search component in IBM DB2 UDB 9.5 before FP6a does not properly handle an alphanumeric Fuzzy search, which allows remote authenticated users to cause a denial of service memory consumption and system hang via the db2ext.textSearch function...

CVE-2010-3739

The audit facility in the Security component in IBM DB2 UDB 9.5 before FP6a uses instance-level audit settings to capture connection aka CONNECT and AUTHENTICATION events in certain circumstances in which database-level audit settings were intended, which might make it easier for remote attackers...

CVE-2010-3736

Memory leak in the Relational Data Services component in IBM DB2 UDB 9.5 before FP6a, when the connection concentrator is enabled, allows remote authenticated users to cause a denial of service heap memory consumption by using a different code page than the database server...

CVE-2010-3733

The CVE-2010-3733 entry concerns IBM DB2 UDB 9.5 before FP6a. The Engine Utilities component uses world-writable permissions on sqllib/cfg/db2sprf, enabling local users to modify the file to gain privileges. Public references in the initial documents confirm this file-level permission issue; othe...