Description
IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5 and 11.1 binaries load shared libraries from an untrusted path potentially giving low privilege users full access to the DB2 instance account by loading a malicious shared library. IBM X-Force ID: 140972.
References (3)
Core 3
Core References
Third Party Advisory, VDB Entry vdb-entry
x_refsource_sectrack
http://www.securitytracker.com/id/1041231
Third Party Advisory, VDB Entry vdb-entry
x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/140972
Vendor Advisory x_refsource_confirm
http://www.ibm.com/support/docview.wss?uid=swg22016505
Scores
CVSS v3
8.4
EPSS
0.0044
EPSS Percentile
34.9%
Attack Vector
LOCAL
CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Details
CWE
CWE-426
Status
published
Products (4)
ibm/db2
9.7
ibm/db2
10.1
ibm/db2
10.5
ibm/db2
11.1
Published
Jul 10, 2018
Tracked Since
Feb 18, 2026