Medium WID-SEC-2022-0457 7 CVEs

IBM DB2: Mehrere Schwachstellen

Published Jun 23, 2022 · Updated Feb 28, 2023 · Revision 3 · de-DE

Vendor: IBM Product: Db2 Product: DB2 V10.1 Product: DB2 V10.5 Product: DB2 V11.1 Product: DB2 V11.5 Product: DB2 V9.7 Product: Tivoli Key Lifecycle Manager Platform: Linux Platform: Windows

Summary

Ein lokaler Angreifer kann mehrere Schwachstellen in IBM DB2 ausnutzen, um beliebigen Programmcode auszuführen oder einen Denial of Service Zustand herbeizuführen.

Product

IBM DB2 ist ein relationales Datenbanksystem (RDBS) von IBM.

Vulnerabilities 7

Critical 9.8

CVE-2022-25235 Public exploit

xmltok_impl.c in Expat (aka libexpat) before 2.4.5 lacks certain validation of encoding, such as checks for whether a U…

thunderbird firefox insighttoolkit4 expat Debian Ubuntu Azure Linux Alpine

Feb 16, 2022
Critical 9.8

CVE-2022-25236 Public exploit EPSS 35%

xmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert namespace-separator characters into namespac…

thunderbird firefox insighttoolkit4 expat Debian Ubuntu Azure Linux Alpine

Feb 16, 2022
Critical 9.8

CVE-2022-25315 Public exploit

In Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNames.

thunderbird firefox insighttoolkit4 expat Debian Ubuntu Azure Linux Alpine

Feb 18, 2022
High 7.5

CVE-2022-25314 Public exploit

In Expat (aka libexpat) before 2.4.5, there is an integer overflow in copyString.

thunderbird firefox insighttoolkit4 expat Debian Ubuntu Azure Linux Alpine

Feb 18, 2022
Medium 6.5

CVE-2022-22389

IBM Db2 for Linux, UNIX and Windows 9.7, 10.1, 10.5, 11.1, and 11.5 is vulnerable to a denial of service as the server …

IBM DB2 for Linux, UNIX and Windows Linux Windows

Jun 24, 2022
Medium 6.5

CVE-2022-25313 Public exploit

In Expat (aka libexpat) before 2.4.5, an attacker can trigger stack exhaustion in build_model via a large nesting depth…

thunderbird firefox insighttoolkit4 expat Debian Ubuntu Azure Linux Alpine

Feb 18, 2022
Medium 6.2

CVE-2022-22390

IBM Db2 for Linux, UNIX and Windows 9.7, 10.1, 10.5, 11.1, and 11.5 may be vulnerable to an information disclosure caus…

IBM DB2 for Linux, UNIX and Windows Linux Windows

Jun 24, 2022

Revision history

2023-02-28 #3
Neue Updates von IBM aufgenommen
2022-11-28 #2
Neue Updates von HCL aufgenommen
2022-06-23 #1
Initiale Fassung

References

IBM Security Bulletin 6959019 vom 2023-03-01
https://www.ibm.com/support/pages/node/6959019
IBM Security Bulletin: 6597637 vom 2022-06-23
https://www.ibm.com/support/pages/node/6597637
IBM Security Bulletin: 6597637 vom 2022-06-23
https://www.ibm.com/support/pages/node/6598047
IBM Security Bulletin: 6597637 vom 2022-06-23
https://www.ibm.com/support/pages/node/6597993
HCL Article KB0101680 vom 2022-11-29
https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0101680