CVE-2016-0215: Input Validation
Published Jan 16, 2018
·Updated
IBM DB2 9.7, 10.1 before FP6, and 10.5 before FP8 on AIX, Linux, HP, Solaris and Windows allow remote authenticated users to cause a denial of service (daemon crash) via a SELECT statement with a subquery containing the AVG OLAP function on an Oracle compatible database.
Affected Software
33 affected components
IBM DB2=9.7
IBM DB2=9.7
IBM DB2=9.7
IBM DB2=9.7
IBM Db2 System I=9.7
IBM Db2 System Z=9.7
IBM DB2=9.7
IBM DB2=9.7
IBM DB2=9.7
IBM DB2=10.1
IBM DB2=10.1
IBM DB2=10.1
IBM DB2=10.1
IBM Db2 System I=10.1
IBM Db2 System Z=10.1
IBM DB2=10.1
IBM DB2=10.1
IBM DB2=10.1
IBM DB2=10.5
IBM DB2=10.5
IBM DB2=10.5
IBM DB2=10.5
IBM Db2 System I=10.5
IBM Db2 System Z=10.5
IBM DB2=10.5
IBM DB2=10.5
IBM DB2=10.5
HP HP-UX
IBM AIX
Linux Linux kernel
Microsoft Windows
Oracle Solaris
IBM DB2=9.8
Remediation
Patch Available
Event History
Jan 16, 2018
CVE Published
via MITRE·07:00 PM
Data Sourced
via MITRE·07:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2016-0215?
CVE-2016-0215 has a medium severity rating as it allows remote authenticated users to cause a denial of service.
2
How do I fix CVE-2016-0215?
To fix CVE-2016-0215, upgrade to IBM DB2 versions 9.7 FP6, 10.1 FP8, or newer.
3
Which versions of IBM DB2 are affected by CVE-2016-0215?
IBM DB2 versions 9.7, 10.1 before FP6, and 10.5 before FP8 are affected by CVE-2016-0215.
4
What types of attacks can CVE-2016-0215 facilitate?
CVE-2016-0215 can facilitate denial of service attacks against IBM DB2 databases.
5
Is CVE-2016-0215 present in IBM DB2 for i or z/OS?
Yes, CVE-2016-0215 affects IBM DB2 for i and z/OS versions that fall under the specified vulnerable versions.