PT-2015-4117 · Ibm · Ibm Db2

Publicado 2015-07-20 · Atualizado 2017-09-22 · CVE-2014-8910

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions IBM DB2 versions 9.7 through 9.7 FP10 IBM DB2 versions 9.8 through 9.8 FP5 IBM DB2 versions 10.1 through 10.1 FP4 IBM DB2 versions 10.5 through 10.5 FP5

Description The issue allows remote authenticated users to read arbitrary text files via a crafted XML/XSLT function in a SELECT statement.

Recommendations For IBM DB2 version 9.7, update to at least FP11. For IBM DB2 version 9.8, update to at least FP6. For IBM DB2 version 10.1, update to at least FP5. For IBM DB2 version 10.5, update to at least FP6.

Correção

Special Elements Injection

Enumeração de Fraquezas

CWE-74

Identificadores relacionados

CVE-2014-8910

Produtos afetados

Ibm Db2

Referências · 8

• http://www-01.ibm.com/support/docview.wss?uid=swg21697988 · Aviso do Fabricante
• http://securitytracker.com/id/1032883 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2014-8910 · Nota de Segurança
• http://www-01.ibm.com/support/docview.wss?uid=swg1IT06354 · Aviso do Fabricante
• http://www-01.ibm.com/support/docview.wss?uid=swg1IT06356 · Aviso do Fabricante
• http://www-01.ibm.com/support/docview.wss?uid=swg1IT06353 · Aviso do Fabricante
• http://www-01.ibm.com/support/docview.wss?uid=swg1IT06355 · Aviso do Fabricante
• http://securityfocus.com/bid/75949 · Nota