{"api_version":"1","generated_at":"2026-07-23T09:39:51+00:00","cve":"CVE-2014-0907","urls":{"html":"https://cve.report/CVE-2014-0907","api":"https://cve.report/api/cve/CVE-2014-0907.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2014-0907","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2014-0907"},"summary":{"title":"CVE-2014-0907","description":"Multiple untrusted search path vulnerabilities in unspecified (1) setuid and (2) setgid programs in IBM DB2 9.5, 9.7 before FP9a, 9.8, 10.1 before FP3a, and 10.5 before FP3a on Linux and UNIX allow local users to gain root privileges via a Trojan horse library.","state":"PUBLISHED","assigner":"ibm","published_at":"2014-05-30 23:55:02","updated_at":"2026-05-06 22:30:45"},"problem_types":["NVD-CWE-Other","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"7.2","severity":"","vector":"AV:L/AC:L/Au:N/C:C/I:C/A:C","data":{"version":"2.0","vectorString":"AV:L/AC:L/Au:N/C:C/I:C/A:C","baseScore":7.2,"accessVector":"LOCAL","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"}}],"references":[{"url":"http://www.ibm.com/support/docview.wss?uid=swg21672100","name":"http://www.ibm.com/support/docview.wss?uid=swg21672100","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"Security Bulletin: Local escalation of privilege vulnerability in IBM® DB2® (CVE-2014-0907).","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://secunia.com/advisories/59463","name":"http://secunia.com/advisories/59463","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Security Advisory SA59463 - IBM Data Server Client Privilege Escalation Vulnerability - Secunia","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://secunia.com/advisories/59451","name":"http://secunia.com/advisories/59451","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Security Advisory SA59451 - IBM Tivoli Composite Application Manager for Transactions OpenSSL Security Issue and Vulnerabilities - Secunia","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.ibm.com/support/docview.wss?uid=swg1IT00686","name":"http://www.ibm.com/support/docview.wss?uid=swg1IT00686","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IT00686: SECURITY: ELEVATED PRIVILEGES WITH DB2 EXECUTABLES (CVE-2014-0907)","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://seclists.org/fulldisclosure/2014/Jun/7","name":"http://seclists.org/fulldisclosure/2014/Jun/7","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Full Disclosure: CVE-2014-0907 - SetUID/SetGID Programs Allow Privilege Escalation Via Insecure RPATH In IBM DB2","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-0907/","name":"https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-0907/","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"CVE-2014-0907 - Portcullis","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www-01.ibm.com/support/docview.wss?uid=swg1IT00686","name":"http://www-01.ibm.com/support/docview.wss?uid=swg1IT00686","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IT00686: SECURITY: ELEVATED PRIVILEGES WITH DB2 EXECUTABLES (CVE-2014-0907)","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://secunia.com/advisories/60482","name":"http://secunia.com/advisories/60482","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Security Advisory SA60482 - IBM Tivoli Storage Manager Client Security Bypass and Privilege Escalation Vulnerabilities - Secunia","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www-304.ibm.com/support/docview.wss?uid=swg21676135","name":"http://www-304.ibm.com/support/docview.wss?uid=swg21676135","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Security Bulletin: IBM Tivoli Composite Application Manager for Transactions is affected by a Local escalation of privilege vulnerability (CVE-2014-0907)","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www-01.ibm.com/support/docview.wss?uid=swg1IT00685","name":"http://www-01.ibm.com/support/docview.wss?uid=swg1IT00685","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www-01.ibm.com/support/docview.wss?uid=swg21680454","name":"http://www-01.ibm.com/support/docview.wss?uid=swg21680454","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Security Bulletin: TSM client SetUID elevation of privilege (CVE-2014-0907)","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securitytracker.com/id/1030671","name":"http://www.securitytracker.com/id/1030671","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IBM Tivoli Composite Application Manager for Transactions Unsafe Library Loading Lets Local Users Gain Elevated Privileges - SecurityTracker","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.ibm.com/support/docview.wss?uid=swg21610582#4","name":"http://www.ibm.com/support/docview.wss?uid=swg21610582#4","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"Security Vulnerabilities, HIPER and Special Attention APARs fixed in DB2 for Linux, UNIX, and Windows Version 10.1","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://packetstormsecurity.com/files/126940/IBM-DB2-Privilege-Escalation.html","name":"http://packetstormsecurity.com/files/126940/IBM-DB2-Privilege-Escalation.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IBM DB2 Privilege Escalation ≈ Packet Storm","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www-01.ibm.com/support/docview.wss?uid=swg1IT00684","name":"http://www-01.ibm.com/support/docview.wss?uid=swg1IT00684","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IT00684: SECURITY: ELEVATED PRIVILEGES WITH DB2 EXECUTABLES (CVE-2014-0907)","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/67617","name":"http://www.securityfocus.com/bid/67617","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Multiple IBM DB2 Products CVE-2014-0907 Local Privilege Escalation Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"http://www-01.ibm.com/support/docview.wss?uid=isg400001843","name":"http://www-01.ibm.com/support/docview.wss?uid=isg400001843","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IBM Tivoli Composite Application Manager for Transactions Internet Service Monitoring 7.3.0.1 Interim Fix 29 README Tivoli Composite Application Manager for Transactions 7.3.0.1 7.3.0.1-TIV-CAMIS-IF0029 Readme - United States","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www-01.ibm.com/support/docview.wss?uid=swg1IT00687","name":"http://www-01.ibm.com/support/docview.wss?uid=swg1IT00687","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IT00687: SECURITY: ELEVATED PRIVILEGES WITH DB2 EXECUTABLES (CVE-2014-0907)","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/91869","name":"https://exchange.xforce.ibmcloud.com/vulnerabilities/91869","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www-01.ibm.com/support/docview.wss?uid=isg400001841","name":"http://www-01.ibm.com/support/docview.wss?uid=isg400001841","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IBM Tivoli Composite Application Manager for Transactions Internet Service Monitoring 7.4 Interim Fix 13 README Tivoli Composite Application Manager for Transactions 7.4.0.0 7.4.0.0-TIV-CAMIS-IF0013 Readme - United States","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www-01.ibm.com/support/docview.wss?uid=swg1IT00627","name":"http://www-01.ibm.com/support/docview.wss?uid=swg1IT00627","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securitytracker.com/id/1030670","name":"http://www.securitytracker.com/id/1030670","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IBM DB2 Unsafe Library Loading Lets Local Users Gain Elevated Privileges - SecurityTracker","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-0907","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-0907","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2014","cve_id":"907","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ibm","cpe5":"db2","cpe6":"10.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"907","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ibm","cpe5":"db2","cpe6":"10.1.0.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"907","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ibm","cpe5":"db2","cpe6":"10.1.0.2","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"907","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ibm","cpe5":"db2","cpe6":"10.1.0.3","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"907","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ibm","cpe5":"db2","cpe6":"10.5","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"907","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ibm","cpe5":"db2","cpe6":"10.5.0.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"907","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ibm","cpe5":"db2","cpe6":"10.5.0.2","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"907","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ibm","cpe5":"db2","cpe6":"9.5","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"907","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ibm","cpe5":"db2","cpe6":"9.7","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"907","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ibm","cpe5":"db2","cpe6":"9.7.0.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"907","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ibm","cpe5":"db2","cpe6":"9.7.0.2","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"907","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ibm","cpe5":"db2","cpe6":"9.7.0.3","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"907","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ibm","cpe5":"db2","cpe6":"9.7.0.4","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"907","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ibm","cpe5":"db2","cpe6":"9.7.0.5","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"907","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ibm","cpe5":"db2","cpe6":"9.7.0.6","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"907","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ibm","cpe5":"db2","cpe6":"9.7.0.7","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"907","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ibm","cpe5":"db2","cpe6":"9.7.0.8","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"907","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ibm","cpe5":"db2","cpe6":"9.7.0.9","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-06T09:27:20.138Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"20140603 CVE-2014-0907 - SetUID/SetGID Programs Allow Privilege Escalation Via Insecure RPATH In IBM DB2","tags":["mailing-list","x_refsource_FULLDISC","x_transferred"],"url":"http://seclists.org/fulldisclosure/2014/Jun/7"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://www-304.ibm.com/support/docview.wss?uid=swg21676135"},{"name":"IT00686","tags":["vendor-advisory","x_refsource_AIXAPAR","x_transferred"],"url":"http://www-01.ibm.com/support/docview.wss?uid=swg1IT00686"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://www.ibm.com/support/docview.wss?uid=swg1IT00686"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://www.ibm.com/support/docview.wss?uid=swg21672100"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://www-01.ibm.com/support/docview.wss?uid=isg400001843"},{"name":"59463","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/59463"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://www-01.ibm.com/support/docview.wss?uid=isg400001841"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://www.ibm.com/support/docview.wss?uid=swg21610582#4"},{"name":"1030670","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"],"url":"http://www.securitytracker.com/id/1030670"},{"name":"67617","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/67617"},{"name":"IT00685","tags":["vendor-advisory","x_refsource_AIXAPAR","x_transferred"],"url":"http://www-01.ibm.com/support/docview.wss?uid=swg1IT00685"},{"tags":["x_refsource_MISC","x_transferred"],"url":"https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-0907/"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://www-01.ibm.com/support/docview.wss?uid=swg21680454"},{"name":"1030671","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"],"url":"http://www.securitytracker.com/id/1030671"},{"name":"ibm-cve20140907-priv-escalation(91869)","tags":["vdb-entry","x_refsource_XF","x_transferred"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/91869"},{"name":"60482","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/60482"},{"name":"59451","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/59451"},{"name":"IT00687","tags":["vendor-advisory","x_refsource_AIXAPAR","x_transferred"],"url":"http://www-01.ibm.com/support/docview.wss?uid=swg1IT00687"},{"tags":["x_refsource_MISC","x_transferred"],"url":"http://packetstormsecurity.com/files/126940/IBM-DB2-Privilege-Escalation.html"},{"name":"IT00684","tags":["vendor-advisory","x_refsource_AIXAPAR","x_transferred"],"url":"http://www-01.ibm.com/support/docview.wss?uid=swg1IT00684"},{"name":"IT00627","tags":["vendor-advisory","x_refsource_AIXAPAR","x_transferred"],"url":"http://www-01.ibm.com/support/docview.wss?uid=swg1IT00627"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2014-05-26T00:00:00.000Z","descriptions":[{"lang":"en","value":"Multiple untrusted search path vulnerabilities in unspecified (1) setuid and (2) setgid programs in IBM DB2 9.5, 9.7 before FP9a, 9.8, 10.1 before FP3a, and 10.5 before FP3a on Linux and UNIX allow local users to gain root privileges via a Trojan horse library."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2017-08-28T12:57:01.000Z","orgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","shortName":"ibm"},"references":[{"name":"20140603 CVE-2014-0907 - SetUID/SetGID Programs Allow Privilege Escalation Via Insecure RPATH In IBM DB2","tags":["mailing-list","x_refsource_FULLDISC"],"url":"http://seclists.org/fulldisclosure/2014/Jun/7"},{"tags":["x_refsource_CONFIRM"],"url":"http://www-304.ibm.com/support/docview.wss?uid=swg21676135"},{"name":"IT00686","tags":["vendor-advisory","x_refsource_AIXAPAR"],"url":"http://www-01.ibm.com/support/docview.wss?uid=swg1IT00686"},{"tags":["x_refsource_CONFIRM"],"url":"http://www.ibm.com/support/docview.wss?uid=swg1IT00686"},{"tags":["x_refsource_CONFIRM"],"url":"http://www.ibm.com/support/docview.wss?uid=swg21672100"},{"tags":["x_refsource_CONFIRM"],"url":"http://www-01.ibm.com/support/docview.wss?uid=isg400001843"},{"name":"59463","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/59463"},{"tags":["x_refsource_CONFIRM"],"url":"http://www-01.ibm.com/support/docview.wss?uid=isg400001841"},{"tags":["x_refsource_CONFIRM"],"url":"http://www.ibm.com/support/docview.wss?uid=swg21610582#4"},{"name":"1030670","tags":["vdb-entry","x_refsource_SECTRACK"],"url":"http://www.securitytracker.com/id/1030670"},{"name":"67617","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/67617"},{"name":"IT00685","tags":["vendor-advisory","x_refsource_AIXAPAR"],"url":"http://www-01.ibm.com/support/docview.wss?uid=swg1IT00685"},{"tags":["x_refsource_MISC"],"url":"https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-0907/"},{"tags":["x_refsource_CONFIRM"],"url":"http://www-01.ibm.com/support/docview.wss?uid=swg21680454"},{"name":"1030671","tags":["vdb-entry","x_refsource_SECTRACK"],"url":"http://www.securitytracker.com/id/1030671"},{"name":"ibm-cve20140907-priv-escalation(91869)","tags":["vdb-entry","x_refsource_XF"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/91869"},{"name":"60482","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/60482"},{"name":"59451","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/59451"},{"name":"IT00687","tags":["vendor-advisory","x_refsource_AIXAPAR"],"url":"http://www-01.ibm.com/support/docview.wss?uid=swg1IT00687"},{"tags":["x_refsource_MISC"],"url":"http://packetstormsecurity.com/files/126940/IBM-DB2-Privilege-Escalation.html"},{"name":"IT00684","tags":["vendor-advisory","x_refsource_AIXAPAR"],"url":"http://www-01.ibm.com/support/docview.wss?uid=swg1IT00684"},{"name":"IT00627","tags":["vendor-advisory","x_refsource_AIXAPAR"],"url":"http://www-01.ibm.com/support/docview.wss?uid=swg1IT00627"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"psirt@us.ibm.com","ID":"CVE-2014-0907","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Multiple untrusted search path vulnerabilities in unspecified (1) setuid and (2) setgid programs in IBM DB2 9.5, 9.7 before FP9a, 9.8, 10.1 before FP3a, and 10.5 before FP3a on Linux and UNIX allow local users to gain root privileges via a Trojan horse library."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"20140603 CVE-2014-0907 - SetUID/SetGID Programs Allow Privilege Escalation Via Insecure RPATH In IBM DB2","refsource":"FULLDISC","url":"http://seclists.org/fulldisclosure/2014/Jun/7"},{"name":"http://www-304.ibm.com/support/docview.wss?uid=swg21676135","refsource":"CONFIRM","url":"http://www-304.ibm.com/support/docview.wss?uid=swg21676135"},{"name":"IT00686","refsource":"AIXAPAR","url":"http://www-01.ibm.com/support/docview.wss?uid=swg1IT00686"},{"name":"http://www.ibm.com/support/docview.wss?uid=swg1IT00686","refsource":"CONFIRM","url":"http://www.ibm.com/support/docview.wss?uid=swg1IT00686"},{"name":"http://www.ibm.com/support/docview.wss?uid=swg21672100","refsource":"CONFIRM","url":"http://www.ibm.com/support/docview.wss?uid=swg21672100"},{"name":"http://www-01.ibm.com/support/docview.wss?uid=isg400001843","refsource":"CONFIRM","url":"http://www-01.ibm.com/support/docview.wss?uid=isg400001843"},{"name":"59463","refsource":"SECUNIA","url":"http://secunia.com/advisories/59463"},{"name":"http://www-01.ibm.com/support/docview.wss?uid=isg400001841","refsource":"CONFIRM","url":"http://www-01.ibm.com/support/docview.wss?uid=isg400001841"},{"name":"http://www.ibm.com/support/docview.wss?uid=swg21610582#4","refsource":"CONFIRM","url":"http://www.ibm.com/support/docview.wss?uid=swg21610582#4"},{"name":"1030670","refsource":"SECTRACK","url":"http://www.securitytracker.com/id/1030670"},{"name":"67617","refsource":"BID","url":"http://www.securityfocus.com/bid/67617"},{"name":"IT00685","refsource":"AIXAPAR","url":"http://www-01.ibm.com/support/docview.wss?uid=swg1IT00685"},{"name":"https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-0907/","refsource":"MISC","url":"https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-0907/"},{"name":"http://www-01.ibm.com/support/docview.wss?uid=swg21680454","refsource":"CONFIRM","url":"http://www-01.ibm.com/support/docview.wss?uid=swg21680454"},{"name":"1030671","refsource":"SECTRACK","url":"http://www.securitytracker.com/id/1030671"},{"name":"ibm-cve20140907-priv-escalation(91869)","refsource":"XF","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/91869"},{"name":"60482","refsource":"SECUNIA","url":"http://secunia.com/advisories/60482"},{"name":"59451","refsource":"SECUNIA","url":"http://secunia.com/advisories/59451"},{"name":"IT00687","refsource":"AIXAPAR","url":"http://www-01.ibm.com/support/docview.wss?uid=swg1IT00687"},{"name":"http://packetstormsecurity.com/files/126940/IBM-DB2-Privilege-Escalation.html","refsource":"MISC","url":"http://packetstormsecurity.com/files/126940/IBM-DB2-Privilege-Escalation.html"},{"name":"IT00684","refsource":"AIXAPAR","url":"http://www-01.ibm.com/support/docview.wss?uid=swg1IT00684"},{"name":"IT00627","refsource":"AIXAPAR","url":"http://www-01.ibm.com/support/docview.wss?uid=swg1IT00627"}]}}}},"cveMetadata":{"assignerOrgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","assignerShortName":"ibm","cveId":"CVE-2014-0907","datePublished":"2014-05-30T23:00:00.000Z","dateReserved":"2014-01-06T00:00:00.000Z","dateUpdated":"2024-08-06T09:27:20.138Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2014-05-30 23:55:02","lastModifiedDate":"2026-05-06 22:30:45","problem_types":["NVD-CWE-Other","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:L/AC:L/Au:N/C:C/I:C/A:C","baseScore":7.2,"accessVector":"LOCAL","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"},"baseSeverity":"HIGH","exploitabilityScore":3.9,"impactScore":10,"acInsufInfo":false,"obtainAllPrivilege":true,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:db2:9.5:*:*:*:*:*:*:*","matchCriteriaId":"11ABF7CC-2FA5-4F2D-901A-2D0EF5B8E717"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:db2:9.7:*:*:*:*:*:*:*","matchCriteriaId":"CE1C4DE6-EB32-4A31-9FAA-D8DA31D8CF05"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:db2:9.7.0.1:*:*:*:*:*:*:*","matchCriteriaId":"A8A8E221-7045-4BAD-9B29-ABBC5216559D"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:db2:9.7.0.2:*:*:*:*:*:*:*","matchCriteriaId":"56C39DC1-AD23-4F26-9727-EC0FBDF84BEE"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:db2:9.7.0.3:*:*:*:*:*:*:*","matchCriteriaId":"2513D42C-E558-4CC7-88D3-BB44F1B40157"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:db2:9.7.0.4:*:*:*:*:*:*:*","matchCriteriaId":"6F441BE8-AEC0-44F0-875E-03C65A45CF68"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:db2:9.7.0.5:*:*:*:*:*:*:*","matchCriteriaId":"036E9715-CFAA-4F2A-B432-181EDCA3D812"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:db2:9.7.0.6:*:*:*:*:*:*:*","matchCriteriaId":"9A55FBA0-4DFC-493D-91EF-EB56C241F9CE"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:db2:9.7.0.7:*:*:*:*:*:*:*","matchCriteriaId":"B539123F-B8AC-4051-9458-A780C68E9667"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:db2:9.7.0.8:*:*:*:*:*:*:*","matchCriteriaId":"D3958E50-1F97-4C06-AF22-C635FB2557A0"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:db2:9.7.0.9:*:*:*:*:*:*:*","matchCriteriaId":"57AC4D14-805A-42F6-9348-D13C9A48136F"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:db2:10.1:*:*:*:*:*:*:*","matchCriteriaId":"2952EB24-A015-4EC7-85E3-88588D0AB15B"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:db2:10.1.0.1:*:*:*:*:*:*:*","matchCriteriaId":"E5FA4086-9B5D-4352-B717-3F826DE17D4B"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:db2:10.1.0.2:*:*:*:*:*:*:*","matchCriteriaId":"AD79FF24-6C10-437B-86AF-E211B8C6FDC5"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:db2:10.1.0.3:*:*:*:*:*:*:*","matchCriteriaId":"7ABB145C-44EE-47F5-9439-DE6433F8008E"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:db2:10.5:*:*:*:*:*:*:*","matchCriteriaId":"6E232F83-BE4C-4B3E-A5B1-53F9D95F0368"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:db2:10.5.0.1:*:*:*:*:*:*:*","matchCriteriaId":"4B27E1F7-888C-40EE-85FF-B5DC099828C3"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:db2:10.5.0.2:*:*:*:*:*:*:*","matchCriteriaId":"57DCF076-B475-41E6-B1ED-44FBC99238C2"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2014","CveId":"907","Ordinal":"1","Title":"CVE-2014-0907","CVE":"CVE-2014-0907","Year":"2014"},"notes":[{"CveYear":"2014","CveId":"907","Ordinal":"1","NoteData":"Multiple untrusted search path vulnerabilities in unspecified (1) setuid and (2) setgid programs in IBM DB2 9.5, 9.7 before FP9a, 9.8, 10.1 before FP3a, and 10.5 before FP3a on Linux and UNIX allow local users to gain root privileges via a Trojan horse library.","Type":"Description","Title":"CVE-2014-0907"},{"CveYear":"2014","CveId":"907","Ordinal":"2","NoteData":"2014-05-30","Type":"Other","Title":"Published"},{"CveYear":"2014","CveId":"907","Ordinal":"3","NoteData":"2017-08-28","Type":"Other","Title":"Modified"}]}}}