Description
IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 binaries load shared libraries from an untrusted path potentially giving low privilege user full access to the DB2 instance account by loading a malicious shared library. IBM X-Force ID: 149640.
References (4)
Core 4
Core References
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/105962
VDB Entry, Vendor Advisory vdb-entry
x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/149640
Third Party Advisory, VDB Entry vdb-entry
x_refsource_sectrack
http://www.securitytracker.com/id/1042082
Vendor Advisory x_refsource_confirm
http://www.ibm.com/support/docview.wss?uid=ibm10733122
Scores
CVSS v3
8.4
EPSS
0.0044
EPSS Percentile
35.2%
Attack Vector
LOCAL
CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Details
CWE
CWE-426
Status
published
Products (4)
ibm/db2
9.7
ibm/db2
10.1
ibm/db2
10.5
ibm/db2
11.1
Published
Nov 09, 2018
Tracked Since
Feb 18, 2026