CVE-2023-35012: IBM Db2 code execution
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5 with a Federated configuration is vulnerable to a stack-based buffer overflow, caused by improper bounds checking. A local user with SYSADM privileges could overflow the buffer and execute arbitrary code on the system. IBM X-Force ID: 257763.
Other sources
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) with a Federated configuration is vulnerable to a stack-based buffer overflow, caused by improper bounds checking. A local user with SYSADM privileges could overflow the buffer and execute arbitrary code on the system.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) with Federated configurationto a version that resolves this vulnerability.Fixed in 11.5
Event History
Frequently Asked Questions
What is CVE-2023-35012?
CVE-2023-35012 is a vulnerability in IBM Db2 for Linux, UNIX, and Windows 11.5 with a Federated configuration that allows a local user with SYSADM privileges to overflow a buffer and execute arbitrary code on the system.
How does CVE-2023-35012 affect IBM Db2?
CVE-2023-35012 affects IBM Db2 for Linux, UNIX, and Windows 11.5 with a Federated configuration.
What is the severity of CVE-2023-35012?
CVE-2023-35012 has a severity rating of 6.7, which is considered medium.
How can the CVE-2023-35012 vulnerability be exploited?
The CVE-2023-35012 vulnerability can be exploited by a local user with SYSADM privileges to overflow a buffer and execute arbitrary code on the system.
How can I fix the CVE-2023-35012 vulnerability?
To fix the CVE-2023-35012 vulnerability, update IBM Db2 for Linux, UNIX, and Windows to version 11.5.7 with special build level s2211170548 or 11.5.8 with special build level s2211250928 or later.