Third-party bugs squashed in IBM database software

By

Apache Log4j rears its head.

IBM has patched its 'Db2 Web Query for i' software against a number of vulnerabilities inherited from other packages.

Third-party bugs squashed in IBM database software

Db2 Web Query for i uses the vulnerable Apache Log4j for generating logs and diagnostic traces, IBM’s advisory stated, and needed patching.

Another component, Apache Commons Compress, also carried a vulnerability: CVE-2021-36090, which was discovered last July and IBM describes as a denial of service bug created by an out-of-memory error when large amounts of memory are allocated.

Services using Compress’ zip package can be attacked using a crafted ZIP archive.

The other vulnerable package the database software uses is Tibco WebFOCUS, which is impacted by a cross-site scripting vulnerability, CVE-2021-35493.

An attacker can use a crafted URL to execute scripts in the victim’s browser, “within the security context of the hosting Web site, once the URL is clicked.

"An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials,” IBM said.

Got a news tip for our journalists? Share it with us anonymously here.
Copyright © iTnews.com.au . All rights reserved.
Tags:

Most Read Articles

Attackers weaponise Linux file names as malware vectors

Attackers weaponise Linux file names as malware vectors

"Widespread data theft" hits Salesforce customers via third party

"Widespread data theft" hits Salesforce customers via third party

Home Affairs adds SecOps to new cyber risk overhaul

Home Affairs adds SecOps to new cyber risk overhaul

Exetel fined $694k over system 'vulnerability' for mobile number porting

Exetel fined $694k over system 'vulnerability' for mobile number porting

Log In

  |  Forgot your password?