CVE-2019-4154

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2019-4154
IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 is vulnerable to a buffer overflow, which could allow an authenticated local attacker to execute arbitrary code on the system as root. IBM X-Force ID: 158519.

7.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

7.2 /10

CVSS v2.0 : HIGH

V2 Legend

Vector : AV:L/AC:L/Au:N/C:C/I:C/A:C

Exploitability : 3.9 / Impact : 10.0

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References
Link Resource
http://www.securityfocus.com/bid/109024 Broken Link Third Party Advisory VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/158519 VDB Entry Vendor Advisory
https://www.ibm.com/support/docview.wss?uid=ibm10880737 Patch Vendor Advisory
Configurations

Configuration 1 (hide)

AND
OR cpe:2.3:a:ibm:db2:9.7.0.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:db2:9.7.0.1:*:*:*:*:*:*:*
cpe:2.3:a:ibm:db2:9.7.0.2:*:*:*:*:*:*:*
cpe:2.3:a:ibm:db2:9.7.0.3:*:*:*:*:*:*:*
cpe:2.3:a:ibm:db2:9.7.0.4:*:*:*:*:*:*:*
cpe:2.3:a:ibm:db2:9.7.0.5:*:*:*:*:*:*:*
cpe:2.3:a:ibm:db2:9.7.0.6:*:*:*:*:*:*:*
cpe:2.3:a:ibm:db2:9.7.0.7:*:*:*:*:*:*:*
cpe:2.3:a:ibm:db2:9.7.0.8:*:*:*:*:*:*:*
cpe:2.3:a:ibm:db2:9.7.0.9:*:*:*:*:*:*:*
cpe:2.3:a:ibm:db2:9.7.0.10:*:*:*:*:*:*:*
cpe:2.3:a:ibm:db2:9.7.0.11:*:*:*:*:*:*:*
cpe:2.3:a:ibm:db2:10.1.0.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:db2:10.1.0.1:*:*:*:*:*:*:*
cpe:2.3:a:ibm:db2:10.1.0.2:*:*:*:*:*:*:*
cpe:2.3:a:ibm:db2:10.1.0.3:*:*:*:*:*:*:*
cpe:2.3:a:ibm:db2:10.1.0.4:*:*:*:*:*:*:*
cpe:2.3:a:ibm:db2:10.1.0.5:*:*:*:*:*:*:*
cpe:2.3:a:ibm:db2:10.1.0.6:*:*:*:*:*:*:*
cpe:2.3:a:ibm:db2:10.5.0.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:db2:10.5.0.1:*:*:*:*:*:*:*
cpe:2.3:a:ibm:db2:10.5.0.2:*:*:*:*:*:*:*
cpe:2.3:a:ibm:db2:10.5.0.3:*:*:*:*:*:*:*
cpe:2.3:a:ibm:db2:10.5.0.4:*:*:*:*:*:*:*
cpe:2.3:a:ibm:db2:10.5.0.5:*:*:*:*:*:*:*
cpe:2.3:a:ibm:db2:10.5.0.6:*:*:*:*:*:*:*
cpe:2.3:a:ibm:db2:10.5.0.7:*:*:*:*:*:*:*
cpe:2.3:a:ibm:db2:10.5.0.8:*:*:*:*:*:*:*
cpe:2.3:a:ibm:db2:10.5.0.9:*:*:*:*:*:*:*
cpe:2.3:a:ibm:db2:10.5.0.10:*:*:*:*:*:*:*
cpe:2.3:a:ibm:db2:11.1.0.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:db2:11.1.1.1:*:*:*:*:*:*:*
cpe:2.3:a:ibm:db2:11.1.2.2:*:*:*:*:*:*:*
cpe:2.3:a:ibm:db2:11.1.3.3:*:*:*:*:*:*:*
cpe:2.3:a:ibm:db2:11.1.4.4:*:*:*:*:*:*:*
OR cpe:2.3:o:hp:hp-ux:-:*:*:*:*:*:*:*
cpe:2.3:o:ibm:aix:-:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*
cpe:2.3:o:oracle:solaris:-:*:*:*:*:*:-:*
History

03 Mar 2023, 20:50

Type Values Removed Values Added
CPE cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* cpe:2.3:o:ibm:aix:-:*:*:*:*:*:*:*
cpe:2.3:o:oracle:solaris:-:*:*:*:*:*:-:*
cpe:2.3:o:hp:hp-ux:-:*:*:*:*:*:*:*
References (CONFIRM) https://www.ibm.com/support/docview.wss?uid=ibm10880737 - Vendor Advisory (CONFIRM) https://www.ibm.com/support/docview.wss?uid=ibm10880737 - Patch, Vendor Advisory
References (BID) http://www.securityfocus.com/bid/109024 - (BID) http://www.securityfocus.com/bid/109024 - Broken Link, Third Party Advisory, VDB Entry
Information

Published : 2019-07-01 15:15

Updated : 2024-02-04 20:20

NVD link : CVE-2019-4154

Mitre link : CVE-2019-4154

CVE.ORG link : CVE-2019-4154

JSON object : View

Products Affected

ibm

  • aix
  • db2

linux

  • linux_kernel

oracle

  • solaris

hp

  • hp-ux
CWE
CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer