8.4

CVE-2018-1487

IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5 and 11.1 binaries load shared libraries from an untrusted path potentially giving low privilege users full access to the DB2 instance account by loading a malicious shared library. IBM X-Force ID: 140972.

Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Ibm ≫ Db2 Version9.7
   Linux ≫ Linux Kernel
Ibm ≫ Db2 Version10.1
   Linux ≫ Linux Kernel
Ibm ≫ Db2 Version10.5
   Linux ≫ Linux Kernel
Ibm ≫ Db2 Version11.1
   Linux ≫ Linux Kernel
Ibm ≫ Db2 Version9.7
   Microsoft ≫ Windows Version-
Ibm ≫ Db2 Version10.1
   Microsoft ≫ Windows Version-
Ibm ≫ Db2 Version10.5
   Microsoft ≫ Windows Version-
Ibm ≫ Db2 Version11.1
   Microsoft ≫ Windows Version-
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.08% 0.236
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 7.8 1.8 5.9
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov 4.6 3.9 6.4
AV:L/AC:L/Au:N/C:P/I:P/A:P
psirt@us.ibm.com 8.4 2.5 5.9
CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-426 Untrusted Search Path

The product searches for critical resources using an externally-supplied search path that can point to resources that are not under the product's direct control.

http://www.securitytracker.com/id/1041231
Third Party Advisory
VDB Entry