Vulnerability Details : CVE-2008-3854
Multiple stack-based buffer overflows in IBM DB2 9.1 before Fixpak 5 and 9.5 before Fixpak 1 allow remote attackers to cause a denial of service (system outage) via vectors related to (1) use of XQuery to issue statements; the (2) XMLQUERY, (3) XMLEXISTS, and (4) XMLTABLE statements; and the (5) sqlrlaka function.
Vulnerability category: OverflowDenial of service
Exploit prediction scoring system (EPSS) score for CVE-2008-3854
Probability of exploitation activity in the next 30 days: 13.91%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 95 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2008-3854
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
|---|---|---|---|---|---|
|
7.8
|
HIGH | AV:N/AC:L/Au:N/C:N/I:N/A:C |
10.0
|
6.9
|
NIST |
CWE ids for CVE-2008-3854
-
The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer.Assigned by: nvd@nist.gov (Primary)
References for CVE-2008-3854
-
http://www-1.ibm.com/support/docview.wss?uid=swg1IZ16346
Patch
-
http://www-1.ibm.com/support/docview.wss?uid=swg1IZ18434
Patch
-
http://www.vupen.com/english/advisories/2008/1769
Vendor Advisory
-
https://exchange.xforce.ibmcloud.com/vulnerabilities/42935
- http://www.securityfocus.com/bid/29601
-
http://www-1.ibm.com/support/docview.wss?uid=swg1IZ18431
- http://www-1.ibm.com/support/docview.wss?uid=swg21255607
-
https://exchange.xforce.ibmcloud.com/vulnerabilities/42930
-
http://www.securityfocus.com/archive/1/496406/100/0/threaded
Products affected by CVE-2008-3854
- cpe:2.3:a:ibm:db2_universal_database:9.1:*:hp_ux:*:*:*:*:*
- cpe:2.3:a:ibm:db2_universal_database:9.1:fp2:windows:*:*:*:*:*
- cpe:2.3:a:ibm:db2_universal_database:9.1:fp3:aix:*:*:*:*:*
- cpe:2.3:a:ibm:db2_universal_database:9.1:fp4:linux:*:*:*:*:*
- cpe:2.3:a:ibm:db2_universal_database:9.1:fp4:solaris:*:*:*:*:*
- cpe:2.3:a:ibm:db2_universal_database:9.1:fp4:windows:*:*:*:*:*
- cpe:2.3:a:ibm:db2_universal_database:9.1:*:aix:*:*:*:*:*
- cpe:2.3:a:ibm:db2_universal_database:9.1:*:linux:*:*:*:*:*
- cpe:2.3:a:ibm:db2_universal_database:9.1:fp2:linux:*:*:*:*:*
- cpe:2.3:a:ibm:db2_universal_database:9.1:fp2:solaris:*:*:*:*:*
- cpe:2.3:a:ibm:db2_universal_database:9.1:fp4:aix:*:*:*:*:*
- cpe:2.3:a:ibm:db2_universal_database:9.1:fp4:hp-ux:*:*:*:*:*
- cpe:2.3:a:ibm:db2_universal_database:9.5:*:aix:*:*:*:*:*
- cpe:2.3:a:ibm:db2_universal_database:9.5:*:solaris:*:*:*:*:*
- cpe:2.3:a:ibm:db2_universal_database:9.5:*:windows:*:*:*:*:*
- cpe:2.3:a:ibm:db2_universal_database:9.1:fp3:hp-ux:*:*:*:*:*
- cpe:2.3:a:ibm:db2_universal_database:9.1:fp3:linux:*:*:*:*:*
- cpe:2.3:a:ibm:db2_universal_database:9.1:*:solaris:*:*:*:*:*
- cpe:2.3:a:ibm:db2_universal_database:9.1:*:windows:*:*:*:*:*
- cpe:2.3:a:ibm:db2_universal_database:9.1:fp2:aix:*:*:*:*:*
- cpe:2.3:a:ibm:db2_universal_database:9.1:fp2:hp-ux:*:*:*:*:*
- cpe:2.3:a:ibm:db2_universal_database:9.1:fp3:solaris:*:*:*:*:*
- cpe:2.3:a:ibm:db2_universal_database:9.1:fp3:windows:*:*:*:*:*
- cpe:2.3:a:ibm:db2_universal_database:9.5:*:hp-ux:*:*:*:*:*
- cpe:2.3:a:ibm:db2_universal_database:9.5:*:linux:*:*:*:*:*
- cpe:2.3:a:ibm:db2_universal_database:9.1:fp4a:solaris:*:*:*:*:*
- cpe:2.3:a:ibm:db2_universal_database:9.1:fp4a:windows:*:*:*:*:*
- cpe:2.3:a:ibm:db2_universal_database:9.1:fp4a:aix:*:*:*:*:*
- cpe:2.3:a:ibm:db2_universal_database:9.1:fp4a:hp-ux:*:*:*:*:*
- cpe:2.3:a:ibm:db2_universal_database:9.1:fp4a:linux:*:*:*:*:*