CVE-2014-8910

IBM DB2 9.7-9.7 FP10, 9.8-9.8 FP5, 10.1 < FP5, 10.5-10.5 FP5 - Authenticated Arbitrary File Read via XML/XSLT Function

Title source: llm
STIX 2.1

Description

IBM DB2 9.7 through FP10, 9.8 through FP5, 10.1 before FP5, and 10.5 through FP5 on Linux, UNIX, and Windows allows remote authenticated users to read arbitrary text files via a crafted XML/XSLT function in a SELECT statement.

References (7)

Core 7
Core References
Various Sources vendor-advisory x_refsource_aixapar
http://www-01.ibm.com/support/docview.wss?uid=swg1IT06355
Patch, Vendor Advisory x_refsource_confirm
http://www-01.ibm.com/support/docview.wss?uid=swg21697988
Various Sources vendor-advisory x_refsource_aixapar
http://www-01.ibm.com/support/docview.wss?uid=swg1IT06353
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/75949
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id/1032883
Vendor Advisory vendor-advisory x_refsource_aixapar
http://www-01.ibm.com/support/docview.wss?uid=swg1IT06354
Various Sources vendor-advisory x_refsource_aixapar
http://www-01.ibm.com/support/docview.wss?uid=swg1IT06356

Scores

EPSS 0.0186
EPSS Percentile 76.5%

Details

CWE
CWE-74
Status published
Products (4)
ibm/db2 9.7 (5 CPE variants)
ibm/db2 9.8 (5 CPE variants)
ibm/db2 10.1 (5 CPE variants)
ibm/db2 10.5 (5 CPE variants)
Published Jul 20, 2015
Tracked Since Feb 18, 2026