CVE-2018-1977

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

IBM DB2 for Linux, UNIX and Windows 11.1 (includes DB2 Connect Server) contains a denial of service vulnerability. A remote, authenticated DB2 user could exploit this vulnerability by issuing a specially-crafted SELECT statement with TRUNCATE function. IBM X-Force ID: 154032.

Metrics

CVSS 3.0 6.5/10CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
IBM	DB2 for Linux, UNIX and Windows	11.1

References

http://www.ibm.com/support/docview.wss?uid=ibm10788089Patch, Vendor Advisory
http://www.securityfocus.com/bid/106222Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/154032VDB Entry, Vendor Advisory
http://www.ibm.com/support/docview.wss?uid=ibm10788089Patch, Vendor Advisory
http://www.securityfocus.com/bid/106222Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/154032VDB Entry, Vendor Advisory

Timeline

Published: Dec 14, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-197706.1Cross Site Scripting exists in InfoVista VistaPortal SE Version 5.1 (build 51029). The page "Users.jsp" has reflected XSS via the ConnPoolNa CVE-2018-197716.1Cross Site Scripting exists in InfoVista VistaPortal SE Version 5.1 (build 51029). The page "EditCurrentPool.jsp" has reflected XSS via the CVE-2018-197726.1Cross Site Scripting exists in InfoVista VistaPortal SE Version 5.1 (build 51029). The page "EditCurrentPresentSpace.jsp" has reflected XSS CVE-2018-197736.1Cross Site Scripting exists in InfoVista VistaPortal SE Version 5.1 (build 51029). The page "EditCurrentUser.jsp" has reflected XSS via the CVE-2018-197746.1Cross Site Scripting exists in InfoVista VistaPortal SE Version 5.1 (build 51029). The page "PresentSpace.jsp" has reflected XSS via the Gro CVE-2018-197756.1Cross Site Scripting exists in InfoVista VistaPortal SE Version 5.1 (build 51029). The page "Variables.jsp" has reflected XSS via the ConnPo CVE-2018-197775.5In Artifex MuPDF 1.14.0, there is an infinite loop in the function svg_dev_end_tile in fitz/svg-device.c, as demonstrated by mutool.CVE-2018-19787.8IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 is vulnerable to a buffer overflow, which could CVE-2018-197826.1Multiple cross-site scripting (XSS) vulnerabilities in GET requests in FreshRSS 1.11.1 allow remote attackers to inject arbitrary web script CVE-2018-197839.8Kentix MultiSensor-LAN 5.63.00 devices and previous allow Authentication Bypass via an Alternate Path or Channel.CVE-2018-197847.5The str_rot_pass function in vendor/atholn1600/php-proxy/src/helpers.php in PHP-Proxy 5.1.0 uses weak cryptography, which makes it easier fo CVE-2018-197856.1PHP-Proxy through 5.1.0 has Cross-Site Scripting (XSS) via the URL field in index.php.