CVE-2008-1998: IBM DB2

High severity, CVSS 8.5. EPSS: 2.5% chance of exploitation in the next 30 days.

The NNSTAT (aka SYSPROC.NNSTAT) procedure in IBM DB2 8 before FP16, 9.1 before FP4a, and 9.5 before FP1 on Windows allows remote authenticated users to overwrite arbitrary files via the log file parameter.

Affected products

• IBM DB2: version 8.0 only; version 9.1 only; version 9.5 only

Published 2008-04-28. Last modified 2026-06-16.