CVE-2023-35012
MediumCVSS 6.7Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
IBM Db2 for Linux, UNIX and Windows version 11.5 with a Federated configuration is vulnerable to a stack-based buffer overflow, caused by improper bounds checking. A local user with SYSADM privileges could overflow the buffer and execute arbitrary code on the system.
Risk Assessment
This vulnerability poses a serious risk to organizations as it allows local users with the appropriate privileges to execute unauthorized code, potentially leading to data loss or system takeover.
Recommendation
It is recommended to update to the latest version of IBM Db2 that includes security patches and to restrict access to SYSADM accounts to trusted users.
Other vulnerabilities in IBM Db2 for Linux, UNIX and Windows 11.5
See all- CVE-2017-1452High
IBM DB2 for Linux, UNIX and Windows versions 9.7, 10.1, 10.5, and 11.1 (including DB2 Connect Server) could allow a local user to obtain elevated privileges and overwrite DB2 files.
- CVE-2017-1451High
IBM DB2 for Linux, UNIX and Windows versions 9.7, 10.1, 10.5, and 11.1 may allow a local user with DB2 instance owner privileges to gain root access.
- CVE-2017-1297High
IBM DB2 for Linux, UNIX and Windows versions 9.2, 10.1, 10.5, and 11.1 is vulnerable to a stack-based buffer overflow, caused by improper bounds checking which could allow a local attacker to execute arbitrary code.
- CVE-2017-1105High
IBM DB2 for Linux, UNIX and Windows versions 9.2, 10.1, 10.5, and 11.1 is vulnerable to a buffer overflow that could allow a local user to overwrite DB2 files or cause a denial of service.
Original NVD description (English source)
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5 with a Federated configuration is vulnerable to a stack-based buffer overflow, caused by improper bounds checking. A local user with SYSADM privileges could overflow the buffer and execute arbitrary code on the system. IBM X-Force ID: 257763.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS