Skip to content
OpenAdvisories
Medium WID-SEC-2023-1693 14 CVEs

IBM DB2: Mehrere Schwachstellen

Published Jul 9, 2023 · Updated Aug 11, 2024 · Revision 5 · de-DE

Vendor: IBM Product: Db2 Product: License Metric Tool Product: Security Identity Manager Platform: Linux Platform: Windows

Summary

Ein lokaler Angreifer kann mehrere Schwachstellen in IBM DB2 ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode auszuführen, Sicherheitsvorkehrungen zu umgehen, Informationen offenzulegen oder einen Denial of Service Zustand herbeizuführen.

Product

IBM DB2 ist ein relationales Datenbanksystem (RDBS) von IBM.

Vulnerabilities 14

  • High 8.4
    CVE-2023-27558

    IBM Db2 privilege escalation

    IBM Db2 on Windows 10.5, 11.1, and 11.5 may be vulnerable to a privilege escalation caused by at least one installed service using an unquoted service path. A local attacker could exploit this vulnerability to gain elevated privileges by inserting an executab…

    IBM Db2 for Windows Windows
  • High 8.4
    CVE-2023-30431

    IBM Db2 buffer overflow

    IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 db2set is vulnerable to a buffer overflow, caused by improper bounds checking. An attacker could overflow the buffer and execute arbitrary code. IBM X-Force ID: 252184.

    IBM DB2 for Linux, UNIX and Windows Linux Windows
  • High 7.5
    CVE-2023-30445

    IBM Db2 denial of service

    IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to denial of service with a specially crafted query on certain tables. IBM X-Force ID: 253357.

    IBM DB2 for Linux, UNIX and Windows Linux Windows
  • High 7.5
    CVE-2023-30449

    IBM Db2 denial of service

    IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to denial of service with a specially crafted query. IBM X-Force ID: 253439.

    IBM DB2 for Linux, UNIX and Windows Linux Windows
  • Medium 6.3
    CVE-2023-27867

    IBM Db2 code execution

    IBM Db2 JDBC Driver for Db2 for Linux, UNIX and Windows 10.5, 11.1, and 11.5 could allow a remote authenticated attacker to execute arbitrary code via JNDI Injection. By sending a specially crafted request using the property clientRerouteServerListJNDIName, a…

    IBM DB2 for Linux, UNIX and Windows Linux Windows
  • Medium 6.3
    CVE-2023-27868

    IBM Db2 code execution

    IBM Db2 JDBC Driver for Db2 for Linux, UNIX and Windows 10.5, 11.1, and 11.5 could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unchecked class instantiation when providing plugin classes. By sending a specially …

    IBM DB2 for Linux, UNIX and Windows Linux Windows
  • Medium 6.3
    CVE-2023-27869

    IBM Db2 code execution

    IBM Db2 JDBC Driver for Db2 for Linux, UNIX and Windows 10.5, 11.1, and 11.5 could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unchecked logger injection. By sending a specially crafted request using the named t…

    IBM DB2 for Linux, UNIX and Windows Linux Windows
  • Medium 5.9
    CVE-2023-30442

    IBM Db2 denial of service

    IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.1 and 11.5 federated server is vulnerable to a denial of service as the server may crash when using a specially crafted wrapper using certain options. IBM X-Force ID: 253202.

    IBM DB2 for Linux, UNIX and Windows Linux Windows
  • Medium 5.9
    CVE-2023-30446

    IBM Db2 denial of service

    IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to denial of service with a specially crafted query on certain tables. IBM X-Force ID: 253361 .

    IBM DB2 for Linux, UNIX and Windows Linux Windows
  • Medium 5.9
    CVE-2023-30447

    IBM Db2 denial of service

    IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to denial of service with a specially crafted query on certain tables. IBM X-Force ID: 253436.

    IBM DB2 for Linux, UNIX and Windows Linux Windows
  • Medium 5.9
    CVE-2023-30448

    IBM Db2 denial of service

    IBM DB2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to denial of service with a specially crafted query on certain tables. IBM X-Force ID: 253437.

    IBM DB2 for Linux, UNIX and Windows Linux Windows
  • Medium 5.3
    CVE-2023-29256

    IBM Db2 information disclosure

    IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to an information disclosure due to improper privilege management when certain federation features are used. IBM X-Force ID: 252046.

    IBM DB2 for Linux, UNIX and Windows Linux Windows
  • Medium 5.3
    CVE-2023-30443

    IBM Db2 denial of service

    IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to denial of service with a specially crafted query.

    IBM DB2 for Linux, UNIX and Windows Linux Windows
  • Medium 4.3
    CVE-2023-23487

    IBM Db2 audit logging

    IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.1 and 11.5 is vulnerable to insufficient audit logging. IBM X-Force ID: 245918.

    IBM DB2 for Linux, UNIX and Windows Linux Windows

Revision history

  1. #5

    Neue Updates von IBM aufgenommen

  2. #4

    Neue Updates von IBM aufgenommen

  3. #3

    Neue Updates von IBM aufgenommen

  4. #2

    Neue Updates von IBM aufgenommen

  5. #1

    Initiale Fassung

References