CVEvulnerability
CVE-2014-8910
4.0 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2015-07-20
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 4.0 MEDIUM — AV:N/AC:L/Au:S/C:P/I:N/A:N
- Weaknesses
- CWE-74
Description
IBM DB2 9.7 through FP10, 9.8 through FP5, 10.1 before FP5, and 10.5 through FP5 on Linux, UNIX, and Windows allows remote authenticated users to read arbitrary text files via a crafted XML/XSLT function in a SELECT statement.
Affected configurations
• ibm db2 9.7
• ibm db2 9.8
• ibm db2 10.1
• ibm db2 10.5
Related
Weakness · CWE (1)
- CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component weakness
References
- http://www-01.ibm.com/support/docview.wss?uid=swg1IT06353 www-01.ibm.com
- http://www-01.ibm.com/support/docview.wss?uid=swg1IT06354 Vendor Advisory
- http://www-01.ibm.com/support/docview.wss?uid=swg1IT06355 www-01.ibm.com
- http://www-01.ibm.com/support/docview.wss?uid=swg1IT06356 www-01.ibm.com
- http://www-01.ibm.com/support/docview.wss?uid=swg21697988 Patch, Vendor Advisory
- http://www.securityfocus.com/bid/75949 www.securityfocus.com
- http://www.securitytracker.com/id/1032883 www.securitytracker.com
- http://www-01.ibm.com/support/docview.wss?uid=swg1IT06353 www-01.ibm.com
- http://www-01.ibm.com/support/docview.wss?uid=swg1IT06354 Vendor Advisory
- http://www-01.ibm.com/support/docview.wss?uid=swg1IT06355 www-01.ibm.com
- http://www-01.ibm.com/support/docview.wss?uid=swg1IT06356 www-01.ibm.com
- http://www-01.ibm.com/support/docview.wss?uid=swg21697988 Patch, Vendor Advisory
- http://www.securityfocus.com/bid/75949 www.securityfocus.com
- http://www.securitytracker.com/id/1032883 www.securitytracker.com