Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.5
CVE-2018-1451: IBM DB2 may let local user overwrite its files
CVE-2018-1451 · published 8 years ago
Summary
Versions 9.7, 10.1, 10.5, and 11.1 of IBM DB2 for Linux, UNIX and Windows can be tricked by someone with local access into replacing files that belong to the DB2 instance owner. This could let an attacker change configuration or inject malicious code, potentially compromising the database. Install the latest security update from IBM and limit local user privileges to prevent exploitation.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| ibm | db2 |
9.7 10.1 10.5 11.1 cpe:2.3:a:ibm:db2:9.7:*:*:*:*:*:*:* |
Original advisory text
IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 contains a vulnerability that could allow a local user to overwrite arbitrary files owned by the DB2 inst...
IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 contains a vulnerability that could allow a local user to overwrite arbitrary files owned by the DB2 instance owner. IBM X-Force ID: 140046.
References
- http://www.ibm.com/support/docview.wss?uid=swg22016181 Vendor Advisory
- http://www.securitytracker.com/id/1041004 Third Party Advisory VDB Entry
- https://exchange.xforce.ibmcloud.com/vulnerabilities/140046 VDB Entry Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker partial control (estimated)
Timeline
Published25 May 2018
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2018-1451 · NVD
Track software like this
Free during beta