Summary
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in IBM DB2 REST ausnutzen, um beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen oder einen Denial-of-Service-Zustand zu verursachen.
Product
IBM DB2 ist ein relationales Datenbanksystem (RDBS) von IBM.
Vulnerabilities 14
-
Critical 9.8
SM2 Decryption Buffer Overflow
In order to decrypt SM2 encrypted data an application is expected to call the API function EVP_PKEY_decrypt(). Typically an application will call this function twice. The first time, on entry, the "out" parameter can be NULL and, on exit, the "outlen" paramet…
-
Critical 9.8
The c_rehash script allows command injection
The c_rehash script does not properly sanitise shell metacharacters to prevent command injection. This script is distributed by some operating systems in a manner where it is automatically executed. On such operating systems, an attacker could execute arbitra…
-
Critical 9.8CVE-2022-2068 EPSS 96%
The c_rehash script allows command injection
In addition to the c_rehash shell command injection identified in CVE-2022-1292, further circumstances where the c_rehash script does not properly sanitise shell metacharacters to prevent command injection were found by code review. When the CVE-2022-1292 was…
-
Critical 9.1
The wordexp function in the GNU C Library (aka glibc) through 2.33 may crash or read arbitrary memory in parse_param (i…
-
High 7.8
A flaw was found in glibc. An off-by-one buffer overflow and underflow in getcwd() may lead to memory corruption when t…
-
High 7.5
Infinite loop in BN_mod_sqrt() reachable when parsing certificates
The BN_mod_sqrt() function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli. Internally this function is used when parsing certificates that contain elliptic curve public keys in compressed form or e…
-
High 7.5CVE-2022-2097 Public exploit
AES OCB fails to encrypt some bytes
AES OCB mode for 32-bit x86 platforms using the AES-NI assembly optimised implementation will not encrypt the entirety of the data under some circumstances. This could reveal sixteen bytes of data that was preexisting in the memory that wasn't written. In the…
-
High 7.4
Read buffer overruns processing ASN.1 strings
ASN.1 strings are represented internally within OpenSSL as an ASN1_STRING structure which contains a buffer holding the string data and a field holding the buffer length. This contrasts with normal C strings which are repesented as a buffer for the string dat…
-
High 7.0
A use-after-free vulnerability introduced in glibc upstream version 2.14 was found in the way the tilde expansion was c…
-
Medium 5.9
Prefix Truncation Attack against ChaCha20-Poly1305 and Encrypt-then-MAC aka Terrapin
The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from the extension negotiation message), and a client and server…
-
Medium 5.1
An out-of-bounds write vulnerability was found in glibc before 2.31 when handling signal trampolines on PowerPC. Specif…
-
Unscored —
On the x86-64 architecture, the GNU C Library (aka glibc) before 2.31 fails to ignore the LD_PREFER_MAP_32BIT_EXEC envi…
-
Unscored —
The GNU C Library (aka glibc or libc6) before 2.32 could overflow an on-stack buffer during range reduction if an input…
-
Unscored —
BN_mod_exp may produce incorrect results on MIPS
There is a carry propagation bug in the MIPS32 and MIPS64 squaring procedure. Many EC algorithms are affected, including some of the TLS 1.3 default curves. Impact was not analyzed in detail, because the pre-requisites for attack are considered unlikely and i…
Revision history
-
#2
Neue Updates von Dell aufgenommen
-
#1
Initiale Fassung
References
-
IBM Security Bulletin - 7154484 vom 2024-05-20
https://www.ibm.com/support/pages/node/7154484
-
Deell Security Update
https://www.dell.com/support/kbdoc/en-us/000281732/dsa-2025-075-security-update-for-dell-data-protection-advisor-for-multiple-component-vulnerabilities