CVE-2014-8910: Medium severity ibm db2 universal database vulnerability
Published Jul 20, 2015
·Updated
IBM DB2 9.7 through FP10, 9.8 through FP5, 10.1 before FP5, and 10.5 through FP5 on Linux, UNIX, and Windows allows remote authenticated users to read arbitrary text files via a crafted XML/XSLT function in a SELECT statement.
Affected Software
20 affected components
IBM DB2=9.7
IBM DB2=9.7
IBM DB2=9.7
IBM DB2=9.7
IBM DB2=9.7
IBM DB2=9.8
IBM DB2=9.8
IBM DB2=9.8
IBM DB2=9.8
IBM DB2=9.8
IBM DB2=10.1
IBM DB2=10.1
IBM DB2=10.1
IBM DB2=10.1
IBM DB2=10.1
IBM DB2=10.5
IBM DB2=10.5
IBM DB2=10.5
IBM DB2=10.5
IBM DB2=10.5
Remediation
Patch Available
Event History
Jul 20, 2015
CVE Published
via MITRE·01:00 AM
Data Sourced
via MITRE·01:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2014-8910?
CVE-2014-8910 has a medium severity rating, allowing authenticated users to access arbitrary text files.
2
How do I fix CVE-2014-8910?
To fix CVE-2014-8910, apply the latest security patches provided by IBM for the affected versions of DB2.
3
Which versions of IBM DB2 are affected by CVE-2014-8910?
CVE-2014-8910 affects IBM DB2 versions 9.7 through FP10, 9.8 through FP5, 10.1 before FP5, and 10.5 through FP5.
4
What type of attack does CVE-2014-8910 enable?
CVE-2014-8910 allows remote authenticated users to conduct unauthorized file reading through crafted XML/XSLT functions.
5
Is CVE-2014-8910 specific to a particular operating system?
CVE-2014-8910 impacts IBM DB2 on Linux, UNIX, and Windows platforms.