IBM DB2 Multiple Local Buffer Overflow Vulnerabilities

Bugtraq ID:	107398
Class:	Boundary Condition Error
CVE:	CVE-2018-1922 CVE-2018-1923 CVE-2018-1978 CVE-2018-1980 CVE-2019-4015 CVE-2019-4016
Remote:	No
Local:	Yes
Published:	Mar 11 2019 12:00AM
Updated:	Mar 11 2019 12:00AM
Credit:	IBM
Vulnerable:	IBM DB2 11.1.3 IBM DB2 11.1.2 FP2 IBM DB2 11.1.2 IBM DB2 10.1 .4 IBM DB2 9.7.0.9 IBM DB2 9.7.0.8 IBM DB2 9.7.0.7 IBM DB2 9.7.0.6 IBM DB2 9.7.0.5 IBM DB2 9.7.0.4 IBM DB2 9.7.0.3 IBM DB2 9.7.0.2 IBM DB2 9.7.0.1 IBM DB2 9.7 Fp5 IBM DB2 9.7 Fp3a IBM DB2 9.7 Fp2 IBM DB2 9.7 FP11 IBM DB2 9.7 Fixpak 7 IBM DB2 9.7 Fixpak 6 IBM DB2 9.7 Fixpak 4 IBM DB2 9.7 Fixpack 4 IBM DB2 9.7 fixpack 3 IBM DB2 9.7 fixpack 2 IBM DB2 9.7 Fix Pack 7 IBM DB2 9.7 IBM DB2 11.1.4.4 IBM DB2 11.1.3.3 iFix002 IBM DB2 11.1.3.3 iFix001 IBM DB2 11.1.3 FP3 IBM DB2 11.1.2.2 FP2 IBM DB2 11.1.0.0 IBM DB2 11.1 FP4 IBM DB2 11.1 IBM DB2 10.5.0.7 IBM DB2 10.5.0.4 IBM DB2 10.5.0.3 IBM DB2 10.5.0.2 IBM DB2 10.5.0.1 IBM DB2 10.5 FP9 IBM DB2 10.5 FP8 IBM DB2 10.5 FP10 IBM DB2 10.5 IBM DB2 10.1.0.3 IBM DB2 10.1.0.2 IBM DB2 10.1.0.1 IBM DB2 10.1
Not Vulnerable:

IBM DB2 Multiple Local Buffer Overflow Vulnerabilities

IBM DB2 is prone to multiple local buffer-overflow vulnerabilities because it fails to perform adequate boundary checks on user-supplied data.

Attackers can exploit these issues to execute arbitrary code and elevate privileges, leading to a complete compromise of the device. Failed exploits will result in the denial-of-service condition.

All the fix pack levels of IBM Db2 9.7, 10.1, 10.5, and 11.1 are vulnerable.

IBM DB2 Multiple Local Buffer Overflow Vulnerabilities

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

IBM DB2 Multiple Local Buffer Overflow Vulnerabilities

Solution:
Updates are available. Please see the references or vendor advisory for more information.