CVE-2016-5995: High severity ibm db2 universal database vulnerability
Published Oct 1, 2016
·Updated
Untrusted search path vulnerability in IBM DB2 9.7 through FP11, 10.1 through FP5, 10.5 before FP8, and 11.1 GA on Linux, AIX, and HP-UX allows local users to gain privileges via a Trojan horse library that is accessed by a setuid or setgid program.
Affected Software
246 affected components
IBM DB2=9.7
IBM DB2=9.7
IBM DB2=9.7
IBM DB2=9.7
IBM DB2=9.7
IBM DB2=9.7
IBM DB2=9.7.0.1
IBM DB2=9.7.0.1
IBM DB2=9.7.0.1
IBM DB2=9.7.0.1
IBM DB2=9.7.0.1
IBM DB2=9.7.0.1
IBM DB2=9.7.0.2
IBM DB2=9.7.0.2
IBM DB2=9.7.0.2
IBM DB2=9.7.0.2
IBM DB2=9.7.0.2
IBM DB2=9.7.0.2
IBM DB2=9.7.0.3
IBM DB2=9.7.0.3
IBM DB2=9.7.0.3
IBM DB2=9.7.0.3
IBM DB2=9.7.0.3
IBM DB2=9.7.0.3
IBM DB2=9.7.0.4
IBM DB2=9.7.0.4
IBM DB2=9.7.0.4
IBM DB2=9.7.0.4
IBM DB2=9.7.0.4
IBM DB2=9.7.0.4
IBM DB2=9.7.0.5
IBM DB2=9.7.0.5
IBM DB2=9.7.0.5
IBM DB2=9.7.0.5
IBM DB2=9.7.0.5
IBM DB2=9.7.0.5
IBM DB2=9.7.0.6
IBM DB2=9.7.0.6
IBM DB2=9.7.0.6
IBM DB2=9.7.0.6
IBM DB2=9.7.0.6
IBM DB2=9.7.0.6
IBM DB2=9.7.0.7
IBM DB2=9.7.0.7
IBM DB2=9.7.0.7
IBM DB2=9.7.0.7
IBM DB2=9.7.0.7
IBM DB2=9.7.0.7
IBM DB2=9.7.0.8
IBM DB2=9.7.0.8
IBM DB2=9.7.0.8
IBM DB2=9.7.0.8
IBM DB2=9.7.0.8
IBM DB2=9.7.0.8
IBM DB2=9.7.0.9
IBM DB2=9.7.0.9
IBM DB2=9.7.0.9
IBM DB2=9.7.0.9
IBM DB2=9.7.0.9
IBM DB2=9.7.0.9
IBM DB2=9.7.0.10
IBM DB2=9.7.0.10
IBM DB2=9.7.0.10
IBM DB2=9.7.0.10
IBM DB2=9.7.0.10
IBM DB2=9.7.0.10
IBM DB2=9.7.0.11
IBM DB2=9.7.0.11
IBM DB2=9.7.0.11
IBM DB2=9.7.0.11
IBM DB2=9.7.0.11
IBM DB2=9.7.0.11
IBM DB2=10.1
IBM DB2=10.1
IBM DB2=10.1
IBM DB2=10.1
IBM DB2=10.1
IBM DB2=10.1
IBM DB2=10.1.0.1
IBM DB2=10.1.0.1
IBM DB2=10.1.0.1
IBM DB2=10.1.0.1
IBM DB2=10.1.0.1
IBM DB2=10.1.0.1
IBM DB2=10.1.0.2
IBM DB2=10.1.0.2
IBM DB2=10.1.0.2
IBM DB2=10.1.0.2
IBM DB2=10.1.0.2
IBM DB2=10.1.0.2
IBM DB2=10.1.0.3
IBM DB2=10.1.0.3
IBM DB2=10.1.0.3
IBM DB2=10.1.0.3
IBM DB2=10.1.0.3
IBM DB2=10.1.0.3
IBM DB2=10.1.0.4
IBM DB2=10.1.0.4
IBM DB2=10.1.0.4
IBM DB2=10.1.0.4
IBM DB2=10.1.0.4
IBM DB2=10.1.0.4
IBM DB2=10.1.0.5
IBM DB2=10.1.0.5
IBM DB2=10.1.0.5
IBM DB2=10.1.0.5
IBM DB2=10.1.0.5
IBM DB2=10.1.0.5
IBM DB2=10.5
IBM DB2=10.5
IBM DB2=10.5
IBM DB2=10.5
IBM DB2=10.5
IBM DB2=10.5
IBM DB2=10.5.0.1
IBM DB2=10.5.0.1
IBM DB2=10.5.0.1
IBM DB2=10.5.0.1
IBM DB2=10.5.0.1
IBM DB2=10.5.0.1
IBM DB2=10.5.0.2
IBM DB2=10.5.0.2
IBM DB2=10.5.0.2
IBM DB2=10.5.0.2
IBM DB2=10.5.0.2
IBM DB2=10.5.0.2
IBM DB2=10.5.0.3
IBM DB2=10.5.0.3
IBM DB2=10.5.0.3
IBM DB2=10.5.0.3
IBM DB2=10.5.0.3
IBM DB2=10.5.0.3
IBM DB2=10.5.0.4
IBM DB2=10.5.0.4
IBM DB2=10.5.0.4
IBM DB2=10.5.0.4
IBM DB2=10.5.0.4
IBM DB2=10.5.0.4
IBM DB2=10.5.0.5
IBM DB2=10.5.0.5
IBM DB2=10.5.0.5
IBM DB2=10.5.0.5
IBM DB2=10.5.0.5
IBM DB2=10.5.0.5
IBM DB2=10.5.0.6
IBM DB2=10.5.0.6
IBM DB2=10.5.0.6
IBM DB2=10.5.0.6
IBM DB2=10.5.0.6
IBM DB2=10.5.0.6
IBM DB2=10.5.0.7
IBM DB2=10.5.0.7
IBM DB2=10.5.0.7
IBM DB2=10.5.0.7
IBM DB2=10.5.0.7
IBM DB2=10.5.0.7
IBM DB2=11.1.0.0
IBM DB2=11.1.0.0
IBM DB2=11.1.0.0
IBM DB2=11.1.0.0
IBM DB2=11.1.0.0
IBM DB2=11.1.0.0
IBM DB2 Connect=9.7
IBM DB2 Connect=9.7
IBM DB2 Connect=9.7
IBM DB2 Connect=9.7.0.1
IBM DB2 Connect=9.7.0.1
IBM DB2 Connect=9.7.0.1
IBM DB2 Connect=9.7.0.2
IBM DB2 Connect=9.7.0.2
IBM DB2 Connect=9.7.0.2
IBM DB2 Connect=9.7.0.3
IBM DB2 Connect=9.7.0.3
IBM DB2 Connect=9.7.0.3
IBM DB2 Connect=9.7.0.4
IBM DB2 Connect=9.7.0.4
IBM DB2 Connect=9.7.0.4
IBM DB2 Connect=9.7.0.5
IBM DB2 Connect=9.7.0.5
IBM DB2 Connect=9.7.0.5
IBM DB2 Connect=9.7.0.6
IBM DB2 Connect=9.7.0.6
IBM DB2 Connect=9.7.0.6
IBM DB2 Connect=9.7.0.7
IBM DB2 Connect=9.7.0.7
IBM DB2 Connect=9.7.0.7
IBM DB2 Connect=9.7.0.8
IBM DB2 Connect=9.7.0.8
IBM DB2 Connect=9.7.0.8
IBM DB2 Connect=9.7.0.9
IBM DB2 Connect=9.7.0.9
IBM DB2 Connect=9.7.0.9
IBM DB2 Connect=9.7.0.10
IBM DB2 Connect=9.7.0.10
IBM DB2 Connect=9.7.0.10
IBM DB2 Connect=9.7.0.11
IBM DB2 Connect=9.7.0.11
IBM DB2 Connect=9.7.0.11
IBM DB2 Connect=10.1
IBM DB2 Connect=10.1
IBM DB2 Connect=10.1
IBM DB2 Connect=10.1.0.1
IBM DB2 Connect=10.1.0.1
IBM DB2 Connect=10.1.0.1
IBM DB2 Connect=10.1.0.2
IBM DB2 Connect=10.1.0.2
IBM DB2 Connect=10.1.0.2
IBM DB2 Connect=10.1.0.3
IBM DB2 Connect=10.1.0.3
IBM DB2 Connect=10.1.0.3
IBM DB2 Connect=10.1.0.4
IBM DB2 Connect=10.1.0.4
IBM DB2 Connect=10.1.0.4
IBM DB2 Connect=10.1.0.5
IBM DB2 Connect=10.1.0.5
IBM DB2 Connect=10.1.0.5
IBM DB2 Connect=10.5
IBM DB2 Connect=10.5
IBM DB2 Connect=10.5
IBM DB2 Connect=10.5.0.1
IBM DB2 Connect=10.5.0.1
IBM DB2 Connect=10.5.0.1
IBM DB2 Connect=10.5.0.2
IBM DB2 Connect=10.5.0.2
IBM DB2 Connect=10.5.0.2
IBM DB2 Connect=10.5.0.3
IBM DB2 Connect=10.5.0.3
IBM DB2 Connect=10.5.0.3
IBM DB2 Connect=10.5.0.4
IBM DB2 Connect=10.5.0.4
IBM DB2 Connect=10.5.0.4
IBM DB2 Connect=10.5.0.5
IBM DB2 Connect=10.5.0.5
IBM DB2 Connect=10.5.0.5
IBM DB2 Connect=10.5.0.6
IBM DB2 Connect=10.5.0.6
IBM DB2 Connect=10.5.0.6
IBM DB2 Connect=10.5.0.7
IBM DB2 Connect=10.5.0.7
IBM DB2 Connect=10.5.0.7
IBM DB2 Connect=11.1.0.0
IBM DB2 Connect=11.1.0.0
IBM DB2 Connect=11.1.0.0
HP HP-UX
IBM AIX
Linux Linux kernel
Remediation
Patch Available
Event History
Oct 1, 2016
CVE Published
via MITRE·01:00 AM
Data Sourced
via MITRE·01:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2016-5995?
CVE-2016-5995 is classified as a medium severity vulnerability, allowing local users to gain privileges.
2
How do I fix CVE-2016-5995?
To fix CVE-2016-5995, update IBM DB2 to the latest version or apply the security patches provided by IBM.
3
Which versions of IBM DB2 are affected by CVE-2016-5995?
CVE-2016-5995 affects IBM DB2 versions 9.7 through FP11, 10.1 through FP5, 10.5 before FP8, and 11.1 GA on Linux, AIX, and HP-UX.
4
What type of vulnerability is CVE-2016-5995?
CVE-2016-5995 is an untrusted search path vulnerability that can be exploited through Trojan horse libraries.
5
Who can exploit CVE-2016-5995?
CVE-2016-5995 can be exploited by local users who have access to setuid or setgid programs.