Where
AND
AND
-Infinity
0
Severity
4.6
AV:L/AC:L/Au:N/C:P/I:P/A:P

IBM DB2 7.2 before FixPak 10a, and earlier versions including 7.1, allows local users to overwrite arbitrary files and gain privileges via a symlink attack on (1) db2job and (2) db2job2.

First published (updated )
Severity
6.5
AV:N/AC:L/Au:S/C:P/I:P/A:P

IBM DB2 Universal Database (UDB) 810 before ESE AIX 5765F4100 does not ensure that a user has execute privileges before permitting object creation based on routines, which allows remote authenticated users to gain privileges.

First published (updated )
Severity
6.8
AV:N/AC:L/Au:S/C:N/I:N/A:C

IBM DB2 Universal Database (UDB) 820 before 8.2 FP10 allows remote authenticated users to cause a denial of service (disk consumption) via a hash join (hsjn) that triggers an infinite loop in sqlrihsjnFlushBlocks.

First published (updated )
Severity
6.8
AV:N/AC:L/Au:S/C:N/I:N/A:C

IBM DB2 Universal Database (UDB) 820 before version 8 FixPak 10 (s050811) allows remote authenticated users to cause a denial of service (application crash) by using a table function for an instance of snapshottbreorg, which triggers a trap in sqlnrEStoEaction.

First published (updated )
Severity
4
AV:N/AC:L/Au:S/C:N/I:N/A:P

IBM DB2 Universal Database (UDB) 810 before version 8 FixPak 10 allows remote authenticated users to cause a denial of service (db2jd service crash) by "connecting from a downlevel client."

First published (updated )
Severity
6.8
AV:N/AC:L/Au:S/C:N/I:N/A:C

IBM DB2 Universal Database (UDB) 810 before 8.1 FP10 allows remote authenticated users to cause a denial of service (application crash) via (1) certain equality predicates that trigger self-removal, aka IY70808; and (2) a query with more than 32000 elements in the IN-list, aka LI70817.

First published (updated )
Severity
6.9
AV:L/AC:M/Au:N/C:C/I:C/A:C

Untrusted search path vulnerability in db2pd in IBM DB2 Universal Database (UDB) 8 before FixPak 16 and 9 before Fix Pack 4 allows local users to gain root privileges via a modified DB2INSTANCE environment variable that points to a malicious library. NOTE: this might be the same issue as CVE-2008-0697.

First published (updated )
Severity
4.6
AV:L/AC:L/Au:N/C:P/I:P/A:P

IBM DB2 Universal Database 7 before FixPak 12 creates certain DMS directories with insecure permissions (777), which allows local users to modify or delete certain DB2 files.

First published (updated )
Severity
6.8
Buffer Overflow
AV:N/AC:M/Au:N/C:P/I:P/A:P

Stack-based buffer overflow in JDBC Applet Server in IBM DB2 8.1 allows remote attackers to execute arbitrary by connecting and sending a long username, then disconnecting gracefully and reconnecting and sending a short username and an unexpected db2java.zip version, which causes a null terminator to be removed and leads to the overflow.

First published (updated )
Severity
5
Buffer Overflow
AV:N/AC:L/Au:N/C:N/I:N/A:P

Buffer overflow in the TCP/IP listener in IBM DB2 Universal Database (UDB) before 8.1 FixPak 12 allows remote attackers to cause a denial of service (application crash) via a long MGRLVLLS message inside of an EXCSAT message when establishing a connection.

First published (updated )
Severity
5.5
AV:N/AC:L/Au:S/C:N/I:P/A:P

IBM DB2 UDB 8 before Fixpak 15 does not properly check authorization, which allows remote authenticated users with a certain SELECT privilege to have an unknown impact via unspecified vectors. NOTE: this issue is probably related to CVE-2007-1089, but this is uncertain due to lack of details.

First published (updated )
Severity
6
AV:N/AC:M/Au:S/C:P/I:P/A:P

IBM DB2 UDB 8 before Fixpak 15 and 9.1 before Fixpak 3 does not properly revoke privileges on methods, which allows remote authenticated users to execute a method after revocation until the routine auth cache is flushed.

First published (updated )
Severity
5
Buffer Overflow
AV:N/AC:L/Au:N/C:N/I:N/A:P

Stack-based buffer overflow in the AUTHLISTGROUPSFORAUTHID function in IBM DB2 UDB 9.1 before Fixpak 3 allows attackers to cause a denial of service and possibly execute arbitrary code via a long argument.

First published (updated )
Severity
6.9
Buffer Overflow
AV:L/AC:M/Au:N/C:C/I:C/A:C

Stack-based buffer overflow in IBM DB2 UDB 8 before Fixpak 15 and 9.1 before Fixpak 3 allows attackers to execute arbitrary code via a long DASPROF and possibly other environment variables, which are copied into the buildDasPaths buffer.

First published (updated )
Severity
4.6
AV:L/AC:L/Au:N/C:P/I:P/A:P

IBM DB2 UDB 8 before Fixpak 15 and 9.1 before Fixpak 3 allows local users to create arbitrary directories and execute arbitrary code via a "crafted localized message file" that enables a format string attack, possibly involving the (1) OSSEMEMDBG or (2) TRCLOGFILE environment variable in db2licd (db2licm).

First published (updated )
Severity
6.9
Race Condition
AV:L/AC:M/Au:N/C:C/I:C/A:C

Multiple race conditions in IBM DB2 UDB 8 before Fixpak 15 and 9.1 before Fixpak 3 allow local users to gain root privileges via a symlink attack on certain files.

First published (updated )
Severity
6.9
AV:L/AC:M/Au:N/C:C/I:C/A:C

Multiple untrusted search path vulnerabilities in IBM DB2 UDB 8 before Fixpak 15 and 9.1 before Fixpak 3 allow local users to gain privileges via certain vectors related to (1) DB2 instance or FMP startup on Linux and Solaris; (2) exec of executables while running as root on non-Windows systems, as demonstrated by AIX; and unspecified vectors involving (3) db2licm and (4) db2pd.

First published (updated )
Severity
4
Buffer Overflow
AV:N/AC:L/Au:S/C:N/I:N/A:P

Multiple buffer overflows in the JAR file administration routines in the BSU JAVA subcomponent in IBM DB2 8 before FP16, 9.1 before FP4a, and 9.5 before FP1 allow remote authenticated users to cause a denial of service (instance crash) via a call to the (1) RECOVERJAR or (2) REMOVEJAR procedure with a crafted parameter, related to (a) sqlj.installjar and (b) sqlj.replacejar.

First published (updated )

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203