CVE-2003-1051 : Détail

Le modèle EPSS produit un score de probabilité compris entre 0 et 1 (0 et 100 %). Plus la note est élevée, plus la probabilité qu'une vulnérabilité soit exploitée est grande.

Le percentile est utilisé pour classer les CVE en fonction de leur score EPSS. Par exemple, une CVE dans le 95e percentile selon son score EPSS est plus susceptible d'être exploitée que 95 % des autres CVE. Ainsi, le percentile sert à comparer le score EPSS d'une CVE par rapport à d'autres CVE.

source: https://www.securityfocus.com/bid/8989/info Multiple command-line parameter format string vulnerabilities have been discovered in various IBM DB2 binaries. Specifically, format-based functions are implemented erroneously within the db2govd, db2start, and db2stop programs. These binaries are typically installed setuid. As a result, a malicious local user may be capable of gaining elevate privileges. [db2inst1@RiotStarter adm]$ ./db2govd validate garbage %x GOV1023N Unable to open configuration file "bfffed88". RC = "-2045837302". [db2inst1@RiotStarter adm]$ ./db2govd validate garbage %n%n%n Segmentation fault [db2inst1@RiotStarter adm]$ ./db2govd stop a %x db2govd: GOV1005N No governor for database "A" on node "bfffe188" is running, or it is already being stopped. [db2inst1@RiotStarter adm]$ ./db2govd stop a %n%n%n Segmentation fault [db2inst1@RiotStarter adm]$ ./db2govd stop %x b db2govd: GOV1005N No governor for database "BFFFD788" on node "b" is running, or it is already being stopped. [db2inst1@RiotStarter adm]$ ./db2govd stop %n%n%n b Segmentation fault

source: https://www.securityfocus.com/bid/8989/info Multiple command-line parameter format string vulnerabilities have been discovered in various IBM DB2 binaries. Specifically, format-based functions are implemented erroneously within the db2govd, db2start, and db2stop programs. These binaries are typically installed setuid. As a result, a malicious local user may be capable of gaining elevate privileges. [kf@RiotStarter adm]$ ./db2start %x SQL2032N The "bffff270" parameter is not valid. [kf@RiotStarter adm]$ ./db2start %n%n Segmentation fault [kf@RiotStarter adm]$ ./db2stop %x SQL2032N The "bffff6f0" parameter is not valid.

source: https://www.securityfocus.com/bid/8989/info Multiple command-line parameter format string vulnerabilities have been discovered in various IBM DB2 binaries. Specifically, format-based functions are implemented erroneously within the db2govd, db2start, and db2stop programs. These binaries are typically installed setuid. As a result, a malicious local user may be capable of gaining elevate privileges. [kf@RiotStarter adm]$ ./db2stop %n%n Segmentation fault