CVE Vulnerabilities

CVE-2014-8910

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Published: Jul 20, 2015 | Modified: Sep 22, 2017
CVSS 3.x
N/A
Source:
NVD
CVSS 2.x
4 MEDIUM
AV:N/AC:L/Au:S/C:P/I:N/A:N
RedHat/V2
RedHat/V3
Ubuntu
LOW

IBM DB2 9.7 through FP10, 9.8 through FP5, 10.1 before FP5, and 10.5 through FP5 on Linux, UNIX, and Windows allows remote authenticated users to read arbitrary text files via a crafted XML/XSLT function in a SELECT statement.

Weakness

The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

Affected Software

Name Vendor Start Version End Version
Db2 Ibm 9.7 (including) 9.7 (including)
Db2 Ibm 9.8 (including) 9.8 (including)
Db2 Ibm 10.1 (including) 10.1 (including)
Db2 Ibm 10.5 (including) 10.5 (including)
Db2exc Ubuntu precise *
Db2exc-amd64 Ubuntu precise *

Potential Mitigations

References