CVE-2005-4868

HighCVSS 7.1/10Last modified Jun 16, 2026

Description

Shared memory sections and events in IBM DB2 8.1 have default permissions of read and write for the Everyone group, which allows local users to gain unauthorized access, gain sensitive information, such as cleartext passwords, and cause a denial of service.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Weakness enumeration

CWE-732

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://marc.info/?l=bugtraq&m=110495402231836&w=2Mailing List
http://secunia.com/advisories/12733/Broken Link, Vendor Advisory
http://www-1.ibm.com/support/docview.wss?uid=swg21181228Broken Link
http://www.nextgenss.com/advisories/db205012005F.txtNot Applicable
http://www.securityfocus.com/bid/11402Broken Link, Patch, Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/17605Third Party Advisory, VDB Entry
http://marc.info/?l=bugtraq&m=110495402231836&w=2Mailing List
http://secunia.com/advisories/12733/Broken Link, Vendor Advisory
http://www-1.ibm.com/support/docview.wss?uid=swg21181228Broken Link
http://www.nextgenss.com/advisories/db205012005F.txtNot Applicable
http://www.securityfocus.com/bid/11402Broken Link, Patch, Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/17605Third Party Advisory, VDB Entry

Timeline

Published: Dec 31, 2005
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2005

CVE-2005-48692.1The (1) to_char and (2) to_date function in IBM DB2 8.1 allows local users to cause a denial of service (application crash) via an empty str CVE-2005-48704.3Stack-based buffer overflows in the (1) xmlvarcharfromfile, (2) xmlclobfromfile, (3) xmlfilefromvarchar, and (4) xmlfilefromclob function ca CVE-2005-48714.3Certain XML functions in IBM DB2 8.1 run with the privileges of DB2 instead of the logged-in user, which allows remote attackers to create o CVE-2005-48724.3Perl-Compatible Regular Expression (PCRE) library before 6.2 does not properly count the number of named capturing subpatterns, which allows CVE-2005-48737.5Multiple stack-based buffer overflows in the phpcups PHP module for CUPS 1.1.23rc1 might allow context-dependent attackers to execute arbitr CVE-2005-48744.3The XMLHttpRequest object in Mozilla 1.7.8 supports the HTTP TRACE method, which allows remote attackers to obtain (1) proxy authentication CVE-2005-48757.5TYPO3 3.8.0 and earlier allows remote attackers to obtain sensitive information via a direct request to misc/phpcheck/, which invokes the ph CVE-2005-48764.3Cross-site scripting (XSS) vulnerability in the login form (login.jsp) of the admin console in Openfire (formerly Wildfire) 2.2.2, and possi CVE-2005-48774.3Cross-site scripting (XSS) vulnerability in the login form (login.jsp) of the admin console in Openfire (formerly Wildfire) 2.3.0 Beta 2 all CVE-2005-48784.3Multiple cross-site scripting (XSS) vulnerabilities in (1) acid_qry_main.php in Analysis Console for Intrusion Databases (ACID) 0.9.6b20 and CVE-2005-48794.3Multiple cross-site scripting (XSS) vulnerabilities in jax_guestbook.php in Jax Guestbook 3.1 and 3.31 allow remote attackers to inject arbi CVE-2005-48805.0Jax Guestbook 3.1 and 3.31 stores sensitive information under the web root with insufficient access control, which allows remote attackers t