Skip to content
OpenAdvisories
Medium WID-SEC-2024-1360 11 CVEs

IBM DB2: Mehrere Schwachstellen

Published Jun 11, 2024 · Updated Jan 25, 2026 · Revision 7 · de-DE

Vendor: Atlassian Vendor: Dell Vendor: HCL Software Vendor: IBM Product: Commerce Product: Confluence Product: Data Protection Advisor Product: Db2 Product: License Metric Tool Product: Tivoli Business Service Manager Product: Tivoli Key Lifecycle Manager Platform: Windows

Summary

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in IBM DB2 ausnutzen, um einen Denial of Service Angriff durchzuführen, beliebigen Code auszuführen und vertrauliche Informationen offenzulegen.

Product

IBM DB2 ist ein relationales Datenbanksystem (RDBS) von IBM.

Vulnerabilities 11

  • High 8.8
    CVE-2023-45853

    pyminizip affected by zlib's integer overflow/heap based buffer overflow vulnerability due to vulnerable dependency

    MiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_64 via a long filename, comment, or extra field. NOTE: MiniZip is not a supported part of the zlib product. NOTE: pyminizip through 0.2.6 is a…

    qt6-qtwebengine qt5-qtwebengine rust cloud-hypervisor Debian Ubuntu Azure Linux Alpine Wolfi PyPI
  • High 8.1
    CVE-2024-25710

    Apache Commons Compress: Denial of service caused by an infinite loop for a corrupted DUMP file

    Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Commons Compress.This issue affects Apache Commons Compress: from 1.3 through 1.25.0. Users are recommended to upgrade to version 1.26.0 which fixes the issue.

    Apache Software Foundation Apache Commons Compress druid trino Debian Ubuntu Azure Linux Wolfi Maven
  • High 7.5
    CVE-2024-28757 Public exploit

    libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of external parsers (created vi…

    insighttoolkit4 expat swish-e matanza Debian Ubuntu Azure Linux Alpine Wolfi
  • High 7.3
    CVE-2024-29131

    Apache Commons Configuration: StackOverflowError adding property in AbstractListDelimiterHandler.flattenIterator()

    Out-of-bounds Write vulnerability in Apache Commons Configuration.This issue affects Apache Commons Configuration: from 2.0 before 2.10.1. Users are recommended to upgrade to version 2.10.1, which fixes the issue.

    Apache Software Foundation Apache Commons Configuration druid trino Debian Ubuntu Wolfi Maven
  • Medium 6.5
    CVE-2024-31881

    IBM Db2 denial of service

    IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to a denial of service as the server may crash when using a specially crafted query on certain columnar tables by an authenticated user. IBM X-Force ID: 28761…

    IBM DB2 for Linux, UNIX and Windows Linux Windows
  • Medium 5.5
    CVE-2024-26308 Public exploit

    Apache Commons Compress: OutOfMemoryError unpacking broken Pack200 file

    Allocation of Resources Without Limits or Throttling vulnerability in Apache Commons Compress.This issue affects Apache Commons Compress: from 1.21 before 1.26. Users are recommended to upgrade to version 1.26, which fixes the issue.

    Apache Software Foundation Apache Commons Compress druid trino Debian Ubuntu Wolfi Maven
  • Medium 5.4
    CVE-2024-29133

    Apache Commons Configuration: StackOverflowError calling ListDelimiterHandler.flatten(Object, int) with a cyclical object tree

    Out-of-bounds Write vulnerability in Apache Commons Configuration.This issue affects Apache Commons Configuration: from 2.0 before 2.10.1. Users are recommended to upgrade to version 2.10.1, which fixes the issue.

    Apache Software Foundation Apache Commons Configuration druid trino Debian Ubuntu Wolfi Maven
  • Medium 5.3
    CVE-2023-29267

    IBM Db2 denial of service

    IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5is vulnerable to a denial of service, under specific configurations, as the server may crash when using a specially crafted SQL statement by an authenticated user. IBM X-For…

    IBM DB2 for Linux, UNIX and Windows Linux Windows
  • Medium 5.3
    CVE-2024-28762

    IBM Db2 denial of service

    IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to denial of service with a specially crafted query under certain conditions. IBM X-Force ID: 285246.

    IBM DB2 for Linux, UNIX and Windows Linux Windows
  • Medium 5.3
    CVE-2024-29025

    Netty HttpPostRequestDecoder can OOM

    Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. The `HttpPostRequestDecoder` can be tricked to accumulate data. While the decoder can store items on the dis…

    netty netty druid netty Debian Ubuntu Wolfi Maven
  • Medium 5.3
    CVE-2024-31880

    IBM Db2 denial of service

    IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to a denial of service, under specific configurations, as the server may crash when using a specially crafted SQL statement by an authenticated user.

    IBM DB2 for Linux, UNIX and Windows Linux Windows

Revision history

  1. #7

    Neue Updates von Dell und IBM aufgenommen

  2. #6

    Neue Updates von HCL aufgenommen

  3. #5

    Neue Updates von IBM und IBM-APAR aufgenommen

  4. #4

    Neue Updates von IBM aufgenommen

  5. #3

    Neue Updates von IBM aufgenommen

  6. #2

    Neue Updates aufgenommen

  7. #1

    Initiale Fassung

References