IBM DB2 Universal Database vulnerabilities

66 CVEs affecting IBM DB2 Universal Database, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2010-3739, published 2010-10-05.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2009-0172, published 2009-01-16. Medium severity, CVSS 5.0. EPSS: 8.5% chance of exploitation in the next 30 days. Unspecified vulnerability in IBM DB2 8 before FP17a, 9.1 before FP6a, and 9.5 before FP3a allows remote attackers to cause a denial of service (infinite loop) via a crafted CONNECT data stream.
CVE-2005-4865, published 2005-12-31. High severity, CVSS 10.0. EPSS: 5.8% chance of exploitation in the next 30 days. Stack-based buffer overflow in call in IBM DB2 7.x and 8.1 allows remote attackers to execute arbitrary code via a long libname.
CVE-2008-3853, published 2008-08-28. High severity, CVSS 9.3. EPSS: 5.8% chance of exploitation in the next 30 days. Buffer overflow in the DAS server program in the Core DAS function component in IBM DB2 9.1 before FP4a and 9.5 before FP1 allows remote attackers to execute arbitrary code or cause a denial of…
CVE-2005-4867, published 2005-12-31. High severity, CVSS 9.3. EPSS: 5% chance of exploitation in the next 30 days. Stack-based buffer overflow in the SATENCRYPT function in IBM DB2 8.1, when Satellite Administration (SATADMIN) is enabled, allows remote attackers to execute arbitrary code via a long parameter.
CVE-2008-3854, published 2008-08-28. High severity, CVSS 7.8. EPSS: 3.7% chance of exploitation in the next 30 days. Multiple stack-based buffer overflows in IBM DB2 9.1 before Fixpak 5 and 9.5 before Fixpak 1 allow remote attackers to cause a denial of service (system outage) via vectors related to (1) use of…
CVE-2007-4423, published 2007-08-18. Medium severity, CVSS 5.0. EPSS: 3.5% chance of exploitation in the next 30 days. Stack-based buffer overflow in the AUTH_LIST_GROUPS_FOR_AUTHID function in IBM DB2 UDB 9.1 before Fixpak 3 allows attackers to cause a denial of service and possibly execute arbitrary code via a long…
CVE-2008-3852, published 2008-08-28. Medium severity, CVSS 6.5. EPSS: 3.4% chance of exploitation in the next 30 days. Unspecified vulnerability in the CLR stored procedure deployment from IBM Database Add-Ins for Visual Studio in the Visual Studio Net component in IBM DB2 9.1 before Fixpak 5 and 9.5 before Fixpak 2…
CVE-2009-0173, published 2009-01-16. Medium severity, CVSS 5.0. EPSS: 3% chance of exploitation in the next 30 days. Unspecified vulnerability in the server in IBM DB2 8 before FP17a, 9.1 before FP6a, and 9.5 before FP3a allows remote authenticated users to cause a denial of service (trap) via a crafted data stream.
CVE-2001-0051, published 2001-02-16. High severity, CVSS 7.5. EPSS: 2.8% chance of exploitation in the next 30 days. IBM DB2 Universal Database version 6.1 creates an account with a default user name and password, which allows remote attackers to gain access to the database.
CVE-2006-3067, published 2006-06-19. Medium severity, CVSS 5.0. EPSS: 2.5% chance of exploitation in the next 30 days. Multiple unspecified vulnerabilities in IBM DB2 Universal Database (UDB) before 8.1 FixPak 12 allow remote attackers to cause a denial of service (application crash) via a (1) "long column list" in…

Latest

CVE-2010-3739, published 2010-10-05. Medium severity, CVSS 6.4. EPSS: 1.1% chance of exploitation in the next 30 days. The audit facility in the Security component in IBM DB2 UDB 9.5 before FP6a uses instance-level audit settings to capture connection (aka CONNECT and AUTHENTICATION) events in certain circumstances…
CVE-2009-4150, published 2009-12-02. Medium severity, CVSS 4.6. EPSS: 0.4% chance of exploitation in the next 30 days. dasauto in IBM DB2 8 before FP18, 9.1 before FP8, 9.5 before FP4, and 9.7 before FP1 permits execution by unprivileged user accounts, which has unspecified impact and local attack vectors.
CVE-2008-3960, published 2008-09-11. Medium severity, CVSS 5.0. EPSS: 1.7% chance of exploitation in the next 30 days. Unspecified vulnerability in the JDBC Applet Server Service (aka db2jds) in IBM DB2 UDB 8 before Fixpak 17 allows remote attackers to cause a denial of service (service crash) via "malicious packets."
CVE-2008-3858, published 2008-08-28. Medium severity, CVSS 4.3. EPSS: 1.9% chance of exploitation in the next 30 days. The Downlevel DB2RA Support component in IBM DB2 9.1 before Fixpak 4a allows remote attackers to cause a denial of service (instance crash) via a crafted CONNECT data stream that simulates a V7…
CVE-2008-3857, published 2008-08-28. Medium severity, CVSS 4.6. EPSS: 0.3% chance of exploitation in the next 30 days. The Base Service Utilities component in IBM DB2 9.1 before Fixpak 5 retains a cleartext password in memory after the database connection that sent the password is fully established, which might allow…
CVE-2008-3856, published 2008-08-28. High severity, CVSS 7.5. EPSS: 2.4% chance of exploitation in the next 30 days. The routine infrastructure component in IBM DB2 8 before FP17, 9.1 before FP5, and 9.5 before FP1 on Unix and Linux does not change the ownership of the db2fmp process, which has unknown impact and…
CVE-2008-3855, published 2008-08-28. Medium severity, CVSS 4.6. EPSS: 0.4% chance of exploitation in the next 30 days. Unspecified vulnerability in the DB2 Administration Server (DAS) in the Core DAS function component in IBM DB2 9.1 before Fixpak 5 allows local users to gain privileges, aka a "FILE CREATION…