CVE-2009-4334 — IBM DB2 vulnerability

CWE-2645 documents5 sources
Severity
4.6MEDIUMNVD
EPSS
0.0%
top 84.92%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
IBM DB2
Timeline
PublishedDec 16
Latest updateMay 3

Description

The Self Tuning Memory Manager (STMM) component in IBM DB2 9.1 before FP8, 9.5 before FP5, and 9.7 before FP1 uses 0666 permissions for the STMM log file, which allows local users to cause a denial of service or have unspecified other impact by writing to this file.

CVSS vector

AV:L/AC:L/C:P/I:P/A:PExploitability: 3.9 | Impact: 6.4

Affected Packages1 packages

▶NVDibm/db29.1, 9.5, 9.7+2

Patches

Patch: www-01.ibm.com ↗Patch: www-01.ibm.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-mg8c-vwh9-hjc4: The Self Tuning Memory Manager (STMM) component in IBM DB2 9↗2022-05-03
▶
CVEList
CVE-2009-4334: The Self Tuning Memory Manager (STMM) component in IBM DB2 9↗2009-12-16
▶

📋Vendor Advisories

1
Red Hat
gzip: Missing input sanitation by decompressing dynamic Huffman code blocks↗2010-01-20
▶

💬Community

1
Bugzilla
CVE-2009-2624 gzip: Missing input sanitation by decompressing dynamic Huffman code blocks↗2009-07-30
▶
CVE-2009-4334 — IBM DB2 vulnerability | cvebase