CVE-2019-4057

MEDIUM

IBM DB2 9.7, 10.1, 10.5, 11.1 - Authenticated Privilege Escalation via Fenced Execution Process

Title source: llm
STIX 2.1

Description

IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 could allow malicious user with access to the DB2 instance account to leverage a fenced execution process to execute arbitrary code as root. IBM X-Force ID: 156567.

References (2)

Core 2
Core References
Vendor Advisory x_refsource_confirm
https://www.ibm.com/support/docview.wss?uid=ibm10880735
VDB Entry, Vendor Advisory vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/156567

Scores

CVSS v3 6.7
EPSS 0.0046
EPSS Percentile 37.1%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Details

Status published
Products (35)
ibm/db2 9.7.0.0
ibm/db2 9.7.0.1
ibm/db2 9.7.0.2
ibm/db2 9.7.0.3
ibm/db2 9.7.0.4
ibm/db2 9.7.0.5
ibm/db2 9.7.0.6
ibm/db2 9.7.0.7
ibm/db2 9.7.0.8
ibm/db2 9.7.0.9
... and 25 more
Published Jul 01, 2019
Tracked Since Feb 18, 2026