CVE-2017-1297: IBM DB2 for Linux, UNIX and Windows 9.2, 10.1, 10.5, and 11.1 (includes DB2 Connect Server) is vulnerable to a stack-based buffer overflow, caused by improper bounds checking…

Description

IBM DB2 for Linux, UNIX and Windows 9.2, 10.1, 10.5, and 11.1 (includes DB2 Connect Server) is vulnerable to a stack-based buffer overflow, caused by improper bounds checking which could allow a local attacker to execute arbitrary code. IBM X-Force ID: 125159.

CVSS vector

CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Attack vector

Local

Complexity

Low

Privileges

Low

User interaction

Required

Confidentiality

High

Integrity

High

Availability

High

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)1.5% · higher than 74% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

DS

Data Server Client · Ibm

All versions, or not specified · source: NVD

DS

Data Server Driver For Odbc And Cli · Ibm

All versions, or not specified · source: NVD

DS

Data Server Driver Package · Ibm

All versions, or not specified · source: NVD

DS

Data Server Runtime Client · Ibm

All versions, or not specified · source: NVD

DB

Db2 · Ibm

9.7; 9.7; 9.7; 9.7; 9.7; 10.1; +14 more · source: NVD

DC

Db2 Connect · Ibm

9.7; 9.7; 9.7; 10.1; 10.1; 10.1; +6 more · source: NVD