CVE-2014-3095

Severity: low (CVSS 3.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2014-09-04 · updated 2026-06-17
Weakness: CWE-20

Description

The SQL engine in IBM DB2 9.5 through FP10, 9.7 through FP9a, 9.8 through FP5, 10.1 through FP4, and 10.5 before FP4 on Linux, UNIX, and Windows allows remote authenticated users to cause a denial of service (daemon crash) via a crafted UNION clause in a subquery of a SELECT statement.

Affected products

IBM Db2 for Linux, UNIX and Windows: 9.5, 9.5.0.1, 9.5.0.2, 9.5.0.2-a, 9.5.0.3, 9.5.0.3-a (+35)

References

http://secunia.com/advisories/58725
http://secunia.com/advisories/60845
http://www-01.ibm.com/support/docview.wss?uid=swg1IT02433
http://www-01.ibm.com/support/docview.wss?uid=swg1IT02643
http://www-01.ibm.com/support/docview.wss?uid=swg1IT02644
http://www-01.ibm.com/support/docview.wss?uid=swg1IT02645
http://www-01.ibm.com/support/docview.wss?uid=swg1IT02646
http://www-01.ibm.com/support/docview.wss?uid=swg21681623
http://www-01.ibm.com/support/docview.wss?uid=swg21683297
http://www.securityfocus.com/bid/69546
https://exchange.xforce.ibmcloud.com/vulnerabilities/94263
http://secunia.com/advisories/58725

Get alerted when CVE-2014-3095 or the next vulnerability affects your stack