CVE-2009-1239
IBM DB2 < 9.1 - Exposure of Sensitive Information via Query Predicate Order
Title source: llmDescription
IBM DB2 9.1 before FP7 returns incorrect query results in certain situations related to the order of application of an INNER JOIN predicate and an OUTER JOIN predicate, which might allow attackers to obtain sensitive information via a crafted query.
References (4)
Core 4
Core References
Third Party Advisory, VDB Entry vdb-entry
x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/49864
Patch vendor-advisory
x_refsource_aixapar
http://www-01.ibm.com/support/docview.wss?uid=swg1JR31886
Patch, Vendor Advisory x_refsource_confirm
http://www-01.ibm.com/support/docview.wss?uid=swg21381257
Vendor Advisory vdb-entry
x_refsource_vupen
http://www.vupen.com/english/advisories/2009/0912
Scores
EPSS
0.0104
EPSS Percentile
60.1%
Details
CWE
CWE-200
Status
published
Products (2)
ibm/db2
9.1 (16 CPE variants)
ibm/db2
< 9.1
Published
Apr 03, 2009
Tracked Since
Feb 18, 2026