CVE-2023-35012
MediumCVSS 6.7Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
IBM Db2 for Linux, UNIX and Windows version 11.5 with a Federated configuration is vulnerable to a stack-based buffer overflow, caused by improper bounds checking. A local user with SYSADM privileges could overflow the buffer and execute arbitrary code on the system.
Risk Assessment
This vulnerability poses a serious risk to organizations as it allows local users with the appropriate privileges to execute unauthorized code, potentially leading to data loss or system takeover.
Recommendation
It is recommended to update to the latest version of IBM Db2 that includes security patches and to restrict access to SYSADM accounts to trusted users.
Original NVD description (English source)
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5 with a Federated configuration is vulnerable to a stack-based buffer overflow, caused by improper bounds checking. A local user with SYSADM privileges could overflow the buffer and execute arbitrary code on the system. IBM X-Force ID: 257763.