Memory corruption in IBM DB2 for Linux, UNIX and Windows
Priority LOW 31CWE-119Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA.
Summary
IBM DB2 for Linux, UNIX and Windows 9.2, 10.1, 10.5, and 11.1 (includes DB2 Connect Server) is vulnerable to a buffer overflow that could allow a local user to overwrite DB2 files or cause a denial of service. IBM X-Force ID: 120668.
Why it matters now
EPSS 0.00372 31st percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| IBM | DB2 for Linux, UNIX and Windows | 10.5; 10.1; 9.7; 11.1 | — | No fix listed | CNA |
- DB2 for Linux, UNIX and Windows VendorIBM Affected 10.5; 10.1; 9.7; 11.1 Fixed in — No fix listed CNA
CPE configurations NVD · 38
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:ibm:data_server_client:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | IBM |
| cpe:2.3:a:ibm:data_server_driver_for_odbc_and_cli:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | IBM |
| cpe:2.3:a:ibm:data_server_driver_package:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | IBM |
| cpe:2.3:a:ibm:data_server_runtime_client:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | IBM |
| cpe:2.3:a:ibm:db2:9.7:*:*:*:advanced_enterprise:*:*:* | 9.7 | Vulnerable | IBM |
| cpe:2.3:a:ibm:db2:9.7:*:*:*:advanced_workgroup:*:*:* | 9.7 | Vulnerable | IBM |
| cpe:2.3:a:ibm:db2:9.7:*:*:*:enterprise:*:*:* | 9.7 | Vulnerable | IBM |
| cpe:2.3:a:ibm:db2:9.7:*:*:*:express:*:*:* | 9.7 | Vulnerable | IBM |
| cpe:2.3:a:ibm:db2:9.7:*:*:*:workgroup:*:*:* | 9.7 | Vulnerable | IBM |
| cpe:2.3:a:ibm:db2:10.1:*:*:*:advanced_enterprise:*:*:* | 10.1 | Vulnerable | IBM |
- cpe:2.3:a:ibm:data_server_client:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·IBM
- cpe:2.3:a:ibm:data_server_driver_for_odbc_and_cli:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·IBM
- cpe:2.3:a:ibm:data_server_driver_package:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·IBM
- cpe:2.3:a:ibm:data_server_runtime_client:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·IBM
- cpe:2.3:a:ibm:db2:9.7:*:*:*:advanced_enterprise:*:*:* Versions 9.7 Vulnerable ·IBM
- cpe:2.3:a:ibm:db2:9.7:*:*:*:advanced_workgroup:*:*:* Versions 9.7 Vulnerable ·IBM
- cpe:2.3:a:ibm:db2:9.7:*:*:*:enterprise:*:*:* Versions 9.7 Vulnerable ·IBM
- cpe:2.3:a:ibm:db2:9.7:*:*:*:express:*:*:* Versions 9.7 Vulnerable ·IBM
- cpe:2.3:a:ibm:db2:9.7:*:*:*:workgroup:*:*:* Versions 9.7 Vulnerable ·IBM
- cpe:2.3:a:ibm:db2:10.1:*:*:*:advanced_enterprise:*:*:* Versions 10.1 Vulnerable ·IBM
Show 28 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:ibm:db2:10.1:*:*:*:advanced_workgroup:*:*:* | 10.1 | Vulnerable | IBM |
| cpe:2.3:a:ibm:db2:10.1:*:*:*:enterprise:*:*:* | 10.1 | Vulnerable | IBM |
| cpe:2.3:a:ibm:db2:10.1:*:*:*:express:*:*:* | 10.1 | Vulnerable | IBM |
| cpe:2.3:a:ibm:db2:10.1:*:*:*:workgroup:*:*:* | 10.1 | Vulnerable | IBM |
| cpe:2.3:a:ibm:db2:10.5:*:*:*:advanced_enterprise:*:*:* | 10.5 | Vulnerable | IBM |
| cpe:2.3:a:ibm:db2:10.5:*:*:*:advanced_workgroup:*:*:* | 10.5 | Vulnerable | IBM |
| cpe:2.3:a:ibm:db2:10.5:*:*:*:enterprise:*:*:* | 10.5 | Vulnerable | IBM |
| cpe:2.3:a:ibm:db2:10.5:*:*:*:express:*:*:* | 10.5 | Vulnerable | IBM |
| cpe:2.3:a:ibm:db2:10.5:*:*:*:workgroup:*:*:* | 10.5 | Vulnerable | IBM |
| cpe:2.3:a:ibm:db2:11.1:*:*:*:advanced_enterprise:*:*:* | 11.1 | Vulnerable | IBM |
| cpe:2.3:a:ibm:db2:11.1:*:*:*:advanced_workgroup:*:*:* | 11.1 | Vulnerable | IBM |
| cpe:2.3:a:ibm:db2:11.1:*:*:*:enterprise:*:*:* | 11.1 | Vulnerable | IBM |
| cpe:2.3:a:ibm:db2:11.1:*:*:*:express:*:*:* | 11.1 | Vulnerable | IBM |
| cpe:2.3:a:ibm:db2:11.1:*:*:*:workgroup:*:*:* | 11.1 | Vulnerable | IBM |
| cpe:2.3:a:ibm:db2_connect:9.7:*:*:*:application_server:*:*:* | 9.7 | Vulnerable | IBM |
| cpe:2.3:a:ibm:db2_connect:9.7:*:*:*:enterprise:*:*:* | 9.7 | Vulnerable | IBM |
| cpe:2.3:a:ibm:db2_connect:9.7:*:*:*:unlimited:*:*:* | 9.7 | Vulnerable | IBM |
| cpe:2.3:a:ibm:db2_connect:10.1:*:*:*:application_server:*:*:* | 10.1 | Vulnerable | IBM |
| cpe:2.3:a:ibm:db2_connect:10.1:*:*:*:enterprise:*:*:* | 10.1 | Vulnerable | IBM |
| cpe:2.3:a:ibm:db2_connect:10.1:*:*:*:unlimited:*:*:* | 10.1 | Vulnerable | IBM |
| cpe:2.3:a:ibm:db2_connect:10.5:*:*:*:application_server:*:*:* | 10.5 | Vulnerable | IBM |
| cpe:2.3:a:ibm:db2_connect:10.5:*:*:*:enterprise:*:*:* | 10.5 | Vulnerable | IBM |
| cpe:2.3:a:ibm:db2_connect:10.5:*:*:*:unlimited:*:*:* | 10.5 | Vulnerable | IBM |
| cpe:2.3:a:ibm:db2_connect:11.1.0.0:*:*:*:application_server:*:*:* | 11.1.0.0 | Vulnerable | IBM |
| cpe:2.3:a:ibm:db2_connect:11.1.0.0:*:*:*:enterprise:*:*:* | 11.1.0.0 | Vulnerable | IBM |
| cpe:2.3:a:ibm:db2_connect:11.1.0.0:*:*:*:unlimited:*:*:* | 11.1.0.0 | Vulnerable | IBM |
| cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Linux |
| cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Microsoft |
- cpe:2.3:a:ibm:db2:10.1:*:*:*:advanced_workgroup:*:*:* Versions 10.1 Vulnerable ·IBM
- cpe:2.3:a:ibm:db2:10.1:*:*:*:enterprise:*:*:* Versions 10.1 Vulnerable ·IBM
- cpe:2.3:a:ibm:db2:10.1:*:*:*:express:*:*:* Versions 10.1 Vulnerable ·IBM
- cpe:2.3:a:ibm:db2:10.1:*:*:*:workgroup:*:*:* Versions 10.1 Vulnerable ·IBM
- cpe:2.3:a:ibm:db2:10.5:*:*:*:advanced_enterprise:*:*:* Versions 10.5 Vulnerable ·IBM
- cpe:2.3:a:ibm:db2:10.5:*:*:*:advanced_workgroup:*:*:* Versions 10.5 Vulnerable ·IBM
- cpe:2.3:a:ibm:db2:10.5:*:*:*:enterprise:*:*:* Versions 10.5 Vulnerable ·IBM
- cpe:2.3:a:ibm:db2:10.5:*:*:*:express:*:*:* Versions 10.5 Vulnerable ·IBM
- cpe:2.3:a:ibm:db2:10.5:*:*:*:workgroup:*:*:* Versions 10.5 Vulnerable ·IBM
- cpe:2.3:a:ibm:db2:11.1:*:*:*:advanced_enterprise:*:*:* Versions 11.1 Vulnerable ·IBM
- cpe:2.3:a:ibm:db2:11.1:*:*:*:advanced_workgroup:*:*:* Versions 11.1 Vulnerable ·IBM
- cpe:2.3:a:ibm:db2:11.1:*:*:*:enterprise:*:*:* Versions 11.1 Vulnerable ·IBM
- cpe:2.3:a:ibm:db2:11.1:*:*:*:express:*:*:* Versions 11.1 Vulnerable ·IBM
- cpe:2.3:a:ibm:db2:11.1:*:*:*:workgroup:*:*:* Versions 11.1 Vulnerable ·IBM
- cpe:2.3:a:ibm:db2_connect:9.7:*:*:*:application_server:*:*:* Versions 9.7 Vulnerable ·IBM
- cpe:2.3:a:ibm:db2_connect:9.7:*:*:*:enterprise:*:*:* Versions 9.7 Vulnerable ·IBM
- cpe:2.3:a:ibm:db2_connect:9.7:*:*:*:unlimited:*:*:* Versions 9.7 Vulnerable ·IBM
- cpe:2.3:a:ibm:db2_connect:10.1:*:*:*:application_server:*:*:* Versions 10.1 Vulnerable ·IBM
- cpe:2.3:a:ibm:db2_connect:10.1:*:*:*:enterprise:*:*:* Versions 10.1 Vulnerable ·IBM
- cpe:2.3:a:ibm:db2_connect:10.1:*:*:*:unlimited:*:*:* Versions 10.1 Vulnerable ·IBM
- cpe:2.3:a:ibm:db2_connect:10.5:*:*:*:application_server:*:*:* Versions 10.5 Vulnerable ·IBM
- cpe:2.3:a:ibm:db2_connect:10.5:*:*:*:enterprise:*:*:* Versions 10.5 Vulnerable ·IBM
- cpe:2.3:a:ibm:db2_connect:10.5:*:*:*:unlimited:*:*:* Versions 10.5 Vulnerable ·IBM
- cpe:2.3:a:ibm:db2_connect:11.1.0.0:*:*:*:application_server:*:*:* Versions 11.1.0.0 Vulnerable ·IBM
- cpe:2.3:a:ibm:db2_connect:11.1.0.0:*:*:*:enterprise:*:*:* Versions 11.1.0.0 Vulnerable ·IBM
- cpe:2.3:a:ibm:db2_connect:11.1.0.0:*:*:*:unlimited:*:*:* Versions 11.1.0.0 Vulnerable ·IBM
- cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Linux
- cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2017-1105
- 2026-10-03 Alias added: GHSA-gr4h-p789-rmqq
References
More IBM Data Server Client vulnerabilities
- TI-2017-01061 Memory corruption in IBM DB2 for Linux, UNIX and Windows CVSS 3.0HIGH 7.3
Sources
- CVE-2017-1105 · CVE Program
- CVE-2017-1105 · NVD
- FIRST EPSS
- GHSA-gr4h-p789-rmqq · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences