DeutschIn der Originalsprache angezeigt — eine vollständige Übersetzung ist für eine zukünftige Version geplant.
IBM DB2: Mehrere Schwachstellen
Advisory ansehen veröffentlicht 2023-07-09
Ein lokaler Angreifer kann mehrere Schwachstellen in IBM DB2 ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode auszuführen, Sicherheitsvorkehrungen zu umgehen, Informationen offenzulegen oder einen Denial of Service Zustand herbeizuführen.
01
beschreibt (14)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2023-30443US | medium6.5 | — | ||
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to denial of service with a specially crafted query. | ||||
| CVE-2023-30449US | high7.5 | — | ||
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to denial of service with a specially crafted query. IBM X-Force ID: 253439. | ||||
| CVE-2023-30448US | high7.5 | — | ||
IBM DB2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to denial of service with a specially crafted query on certain tables. IBM X-F… | ||||
| CVE-2023-30447US | high7.5 | — | ||
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to denial of service with a specially crafted query on certain tables. IBM X-F… | ||||
| CVE-2023-30446US | high7.5 | — | ||
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to denial of service with a specially crafted query on certain tables. IBM X-F… | ||||
| CVE-2023-30445US | high7.5 | — | ||
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to denial of service with a specially crafted query on certain tables. IBM X-F… | ||||
| CVE-2023-30442US | high7.5 | — | ||
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.1 and 11.5 federated server is vulnerable to a denial of service as the server may crash when using a specially… | ||||
| CVE-2023-30431US | high7.8 | — | ||
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 db2set is vulnerable to a buffer overflow, caused by improper bounds checking. An attacker c… | ||||
| CVE-2023-29256US | medium6.5 | — | ||
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to an information disclosure due to improper privilege management when certain… | ||||
| CVE-2023-27869US | high8.8 | — | ||
IBM Db2 JDBC Driver for Db2 for Linux, UNIX and Windows 10.5, 11.1, and 11.5 could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unche… | ||||
| CVE-2023-27868US | high8.8 | — | ||
IBM Db2 JDBC Driver for Db2 for Linux, UNIX and Windows 10.5, 11.1, and 11.5 could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unche… | ||||
| CVE-2023-27867US | high8.8 | — | ||
IBM Db2 JDBC Driver for Db2 for Linux, UNIX and Windows 10.5, 11.1, and 11.5 could allow a remote authenticated attacker to execute arbitrary code via JNDI Injection. By sending a… | ||||
| CVE-2023-27558US | high7.8 | — | ||
IBM Db2 on Windows 10.5, 11.1, and 11.5 may be vulnerable to a privilege escalation caused by at least one installed service using an unquoted service path. A local attacker coul… | ||||
| CVE-2023-23487US | medium4.3 | — | ||
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.1 and 11.5 is vulnerable to insufficient audit logging. IBM X-Force ID: 245918. | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- WID-SEC-W-2023-1693 - CSAF Versionself
- WID-SEC-2023-1693 - Portal Versionself
- IBM Security Bulletin: 7010029 vom 2023-07-09external
- IBM Security Bulletin: 7010557 vom 2023-07-09external
- IBM Security Bulletin: 7010561 vom 2023-07-09external
- IBM Security Bulletin: 7010565 vom 2023-07-09external
- IBM Security Bulletin: 7010567 vom 2023-07-09external
- IBM Security Bulletin: 7010571 vom 2023-07-09external
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan