CVE-2009-4438

MediumCVSS 6.5/10Last modified Jun 16, 2026

Description

The Query Compiler, Rewrite, and Optimizer component in IBM DB2 9.1 before FP8, 9.5 before FP5, and 9.7 before FP1 does not enforce privilege requirements for access to a (1) sequence or (2) global-variable object, which allows remote authenticated users to make use of data via unspecified vectors.

Metrics

CVSS 2.0 6.5/10AV:N/AC:L/Au:S/C:P/I:P/A:P

Weakness enumeration

CWE-264

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://secunia.com/advisories/37759Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg1IC62543Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg1IC62583Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg1IC64852Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21293566Patch
http://www-01.ibm.com/support/docview.wss?uid=swg21412902Vendor Advisory
http://www.securityfocus.com/bid/37332
http://www.vupen.com/english/advisories/2009/3520Patch, Vendor Advisory
http://secunia.com/advisories/37759Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg1IC62543Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg1IC62583Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg1IC64852Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21293566Patch
http://www-01.ibm.com/support/docview.wss?uid=swg21412902Vendor Advisory
http://www.securityfocus.com/bid/37332
http://www.vupen.com/english/advisories/2009/3520Patch, Vendor Advisory

Timeline

Published: Dec 28, 2009
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2009

CVE-2009-44394.0Unspecified vulnerability in the Query Compiler, Rewrite, and Optimizer component in IBM DB2 9.5 before FP5 allows remote authenticated user CVE-2009-44406.8Directory Proxy Server (DPS) in Sun Java System Directory Server Enterprise Edition 6.0 through 6.3.1 does not properly handle multiple clie CVE-2009-44415.0Directory Proxy Server (DPS) in Sun Java System Directory Server Enterprise Edition 6.0 through 6.3.1 does not enable the SO_KEEPALIVE socke CVE-2009-44425.0Directory Proxy Server (DPS) in Sun Java System Directory Server Enterprise Edition 6.0 through 6.3.1 does not properly implement the max-cl CVE-2009-44434.3Unspecified vulnerability in the psearch (aka persistent search) functionality in Directory Proxy Server (DPS) in Sun Java System Directory CVE-2009-44446.0Microsoft Internet Information Services (IIS) 5.x and 6.x uses only the portion of a filename before a ; (semicolon) character to determine CVE-2009-44456.0Microsoft Internet Information Services (IIS), when used in conjunction with unspecified third-party upload applications, allows remote atta CVE-2009-44464.3Cross-site scripting (XSS) vulnerability in admin.php in phpInstantGallery 1.1 allows remote attackers to inject arbitrary web script or HTM CVE-2009-44477.5Jax Guestbook 3.5.0 allows remote attackers to bypass authentication and modify administrator settings via a direct request to admin/guestbo CVE-2009-44485.0inc/functions_time.php in MyBB (aka MyBulletinBoard) 1.4.10, and possibly earlier versions, allows remote attackers to cause a denial of ser CVE-2009-44496.5Directory traversal vulnerability in MyBB (aka MyBulletinBoard) 1.4.10, and possibly earlier versions, when changing the user avatar from th CVE-2009-44504.3Multiple cross-site scripting (XSS) vulnerabilities in map.php in LiveZilla 3.1.8.3 allow remote attackers to inject arbitrary web script or