CVE-2017-1297 IBM DB2 for Linux, UNIX and Windows 9.2, 10.1, 10.5, and 11.1 (includes DB2 Connect Server) is vulnerable to a stack-based buffer overflow, caused by improper bounds checking which could allow a local...
HighCVSS 7.3
EPSS 1.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
IBM DB2 for Linux, UNIX and Windows 9.2, 10.1, 10.5, and 11.1 (includes DB2 Connect Server) is vulnerable to a stack-based buffer overflow, caused by improper bounds checking which could allow a local attacker to execute arbitrary code. IBM X-Force ID: 125159.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ibm data server client | All versions | No fix listed |
| ibm data server driver for odbc and cli | All versions | No fix listed |
| ibm data server driver package | All versions | No fix listed |
| ibm data server runtime client | All versions | No fix listed |
| ibm db2 | = 9.7 | No fix listed |
| ibm db2 | = 10.1 | No fix listed |
| ibm db2 | = 10.5 | No fix listed |
| ibm db2 | = 11.1 | No fix listed |
| ibm db2 connect | = 9.7 | No fix listed |
| ibm db2 connect | = 10.1 | No fix listed |
| ibm db2 connect | = 10.5 | No fix listed |
| ibm db2 connect | = 11.1.0.0 | No fix listed |
| ibm Db2 for Linux, UNIX and Windows | = 10.5 | No fix listed |
| ibm Db2 for Linux, UNIX and Windows | = 10.1 | No fix listed |
| ibm Db2 for Linux, UNIX and Windows | = 9.7 | No fix listed |
| ibm Db2 for Linux, UNIX and Windows | = 11.1 | No fix listed |
References
- www.ibm.com patch vendor-advisory
- 99271 third-party-advisory vdb-entry
- 1038772 vdb-entry
- exchange.xforce.ibmcloud.com vendor-advisory
- 42260 exploit