Skip to content
OpenAdvisories
Medium WID-SEC-2025-2532 11 CVEs

IBM DB2: Mehrere Schwachstellen

Published Nov 9, 2025 · Updated Apr 27, 2026 · Revision 5 · de-DE

Vendor: IBM Product: Db2 Product: License Metric Tool Product: Tivoli Key Lifecycle Manager Platform: Linux Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in IBM DB2 ausnutzen, um Informationen offenzulegen, um einen Denial of Service Angriff durchzuführen, um Sicherheitsvorkehrungen zu umgehen, und um seine Privilegien zu erhöhen.

Product

IBM DB2 ist ein relationales Datenbanksystem (RDBS) von IBM.

Vulnerabilities 11

  • High 7.5
    CVE-2023-1370

    Stack exhaustion in json-smart leads to denial of service when parsing malformed JSON

    [Json-smart](https://netplex.github.io/json-smart/) is a performance focused, JSON processor lib. When reaching a ‘[‘ or ‘{‘ character in the JSON input, the code parses an array or an object respectively. It was discovered that the code does not have any lim…

    json-smart json-smart druid thingsboard-tb-node Debian Ubuntu Wolfi Maven
  • High 7.5
    CVE-2024-57699

    Netplex Json-smart Uncontrolled Recursion vulnerability

    A security issue was found in Netplex Json-smart 2.5.0 through 2.5.1. When loading a specially crafted JSON input, containing a large number of ’{’, a stack exhaustion can be trigger, which could allow an attacker to cause a Denial of Service (DoS). This issu…

    trino trino-plugin-opensearch trino-plugin-lakehouse trino-plugin-pinot Debian Ubuntu Wolfi Maven
  • High 7.4
    CVE-2025-36186

    IBM Db2 privilege escalation

    IBM Db2 12.1.0 through 12.1.3 for Linux, UNIX and Windows (includes Db2 Connect Server) under specific configurations could allow a local user to execute malicious code that escalate their privileges to root due to execution of unnecessary privileges operated…

    IBM Db2
  • Medium 6.5
    CVE-2024-47118

    IBM Db2 is vulnerable to a denial of service as the server may crash under certain conditions with a specially crafted query

    IBM Db2 10.5.0 through 10.5.11, 11.1.0 through 11.1.4.7, 11.5.0 through 11.5.9, and 12.1.0 through 12.1.3 for Linux, UNIX and Windows (includes Db2 Connect Server) is vulnerable to a denial of service as the server may crash under certain conditions with a sp…

    IBM Db2
  • Medium 6.5
    CVE-2025-36006

    IBM Db2 denial of service

    IBM Db2 10.5.0 through 10.5.11, 11.1.0 through 11.1.4.7, 11.5.0 through 11.5.9, and 12.1.0 through 12.1.3 for Linux, UNIX and Windows (includes Db2 Connect Server) could allow an authenticated user to cause a denial due to the improper release of resources af…

    IBM Db2
  • Medium 6.5
    CVE-2025-36008

    IBM Db2 denial of service

    IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.3 for Linux, UNIX and Windows (includes Db2 Connect Server) could allow an authenticated user to cause a denial of service due to improper allocation of resources.

    IBM Db2
  • Medium 6.3
    CVE-2025-33012

    IBM Db2 improper account lockout

    IBM Db2 10.5.0 through 10.5.11, 11.1.0 through 11.1.4.7, 11.5.0 through 11.5.9, and 12.1.0 through 12.1.3 for Linux could allow an authenticated user to regain access after account lockout due to password use after expiration date.

    IBM Db2
  • Medium 6.2
    CVE-2025-36185

    IBM Db2 denial of service

    IBM Db2 12.1.0 through 12.1.2 for Linux, UNIX and Windows (includes Db2 Connect Server) could allow a local user to cause a denial of service due to improper neutralization of special elements in data query logic.

    IBM Db2
  • Medium 5.3
    CVE-2025-2534

    IBM Db2 denial of service

    IBM Db2 11.1.0 through 11.1.4.7, 11.5.0 through 11.5.9, and 12.1.0 through 12.1.3 for Linux, UNIX and Windows (includes Db2 Connect Server) is vulnerable to a denial of service as the server may crash under certain conditions with a specially crafted query.

    IBM Db2
  • Medium 5.1
    CVE-2025-36136

    IBM denial of service

    IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.3 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow a local user to cause a denial of service due to the database monitor script incorrectly detecting that the instance is still starti…

    IBM Db2
  • Medium 4.6
    CVE-2025-36131

    IBM Db2 information disclosure

    IBM Db2 11.1.0 through 11.1.4.7, 11.5.0 through 11.5.9, and 12.1.0 through 12.1.3 for Linux, UNIX and Windows (includes Db2 Connect Server) clpplus command exposes user credentials to the terminal which could be obtained by a third party with physical access …

    IBM Db2

Revision history

  1. #5

    Neue Updates von IBM aufgenommen

  2. #4

    Neue Updates von IBM aufgenommen

  3. #3

    Neue Updates von IBM aufgenommen

  4. #2

    Neue Updates von IBM aufgenommen

  5. #1

    Initiale Fassung

References