Description
IBM DB2 9.5 before FP7 and 9.7 before FP4 on Linux, UNIX, and Windows does not properly enforce privilege requirements for table access, which allows remote authenticated users to modify SYSSTAT.TABLES statistics columns via an UPDATE statement. NOTE: some of these details are obtained from third party information.
References (9)
Core 9
Core References
Various Sources x_refsource_confirm
http://www-01.ibm.com/support/docview.wss?crawler=1&uid=swg1IC72119
Various Sources x_refsource_confirm
http://www-01.ibm.com/support/docview.wss?crawler=1&uid=swg1IC71413
Various Sources vendor-advisory
x_refsource_aixapar
http://www-01.ibm.com/support/docview.wss?uid=swg1IC71413
Various Sources vendor-advisory
x_refsource_aixapar
http://www-01.ibm.com/support/docview.wss?uid=swg1IC72119
Vendor Advisory vdb-entry
x_refsource_vupen
http://www.vupen.com/english/advisories/2011/1083
Third Party Advisory, VDB Entry vdb-entry
x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/66979
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/47525
Third Party Advisory, VDB Entry vdb-entry
signature
x_refsource_oval
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14122
Vendor Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/44229
Scores
EPSS
0.0197
EPSS Percentile
78.3%
Details
CWE
CWE-264
Status
published
Products (4)
ibm/db2
9.5 (11 CPE variants)
ibm/db2
9.7 (3 CPE variants)
ibm/db2
< 9.5
ibm/db2
< 9.7
Published
May 03, 2011
Tracked Since
Feb 18, 2026