Skip to content
OpenAdvisories
High WID-SEC-2026-0262 17 CVEs

IBM DB2: Mehrere Schwachstellen

Published Jan 29, 2026 · Updated Jul 1, 2026 · Revision 4 · de-DE

Vendor: IBM Product: Db2 Product: License Metric Tool Product: Tivoli Business Service Manager Platform: Linux Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in IBM DB2 ausnutzen, um seine Privilegien zu erhöhen, und um einen Denial of Service Angriff durchzuführen.

Product

IBM DB2 ist ein relationales Datenbanksystem (RDBS) von IBM.

Vulnerabilities 17

  • High 8.4
    CVE-2025-36384

    IBM Db2 Privilege Escalation

    IBM Db2 for Windows 12.1.0 - 12.1.3 could allow a local user with filesystem access to escalate their privileges due to the use of an unquoted search path element.

    IBM DB2 for Linux, UNIX and Windows Linux Windows
  • High 7.2
    CVE-2025-36184

    IBM Db2 Privilege Escalation

    IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 - 11.5.9 could allow an instance owner to execute malicious code that escalate their privileges to root due to execution of unnecessary privileges operated at a higher than minimum level.

    IBM DB2 for Linux, UNIX and Windows Linux Windows
  • Medium 6.8
    CVE-2025-36365

    IBM Db2 Privilege Escalation

    IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 - 11.5.9 and 12.1.0 - 12.1.3 under specific configuration of cataloged remote storage aliases could allow an authenticated user to execute unauthorized commands due to an authorization b…

    IBM DB2 for Linux, UNIX and Windows Linux Windows
  • Medium 6.5
    CVE-2025-2668

    IBM Db2 Denial of Service

    IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 - 11.5.9 is vulnerable to a denial of service as the server may crash when an authenticated user creates a specially crafted query.

    IBM DB2 for Linux, UNIX and Windows Linux Windows
  • Medium 6.5
    CVE-2025-36001 Public exploit

    IBM Db2 Denial of Service

    IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 - 11.5.9 and 12.1.0 - 12.1.3 could allow an authenticated user to cause a denial of service using a specially crafted SQL statement including XML that performs uncontrolled recursion.

    IBM DB2 for Linux, UNIX and Windows Linux Windows
  • Medium 6.5
    CVE-2025-36009

    IBM Db2 Denial of Service

    IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow an authenticated user to cause a denial of service due to excessive use of a global variable.

    IBM DB2 for Linux, UNIX and Windows Linux Windows
  • Medium 6.5
    CVE-2025-36070

    IBM Db2 Denial of Service

    IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 - 11.5.9 and 12.1.0 - 12.1.3 is vulnerable to a denial of service as a trap may occur when selecting from certain types of tables.

    IBM DB2 for Linux, UNIX and Windows Linux Windows
  • Medium 6.5
    CVE-2025-36098

    IBM Db2 Denial of Service

    IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 - 11.5.9 and 12.1.0 - 12.1.3 could allow an authenticated user to cause a denial of service due to improper allocation of resources.

    IBM DB2 for Linux, UNIX and Windows Linux Windows
  • Medium 6.5
    CVE-2025-36366

    IBM Db2 Denial of Service

    IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) could allow a user to cause a denial of service by executing a query that invokes the JSON_Object scalar function, which may trigger an unhandled exception leading to abnormal server terminatio…

    IBM DB2 for Linux, UNIX and Windows Linux Windows
  • Medium 6.5
    CVE-2025-36387

    IBM Db2 Denial of Service

    IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.5.0 - 11.5.9 could allow an authenticated user to cause a denial of service when given specially crafted query.

    IBM DB2 for Linux, UNIX and Windows Linux Windows
  • Medium 6.5
    CVE-2025-36423

    IBM Db2 Denial of Service

    IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 12.1.0 - 12.1.3 could allow a local user to cause a denial of service due to improper neutralization of special elements in data query logic.

    IBM DB2 for Linux, UNIX and Windows Linux Windows
  • Medium 6.5
    CVE-2025-36424

    IBM Db2 Denial of Service

    IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) could allow a user to cause a denial of service due to improper neutralization of special elements in data query logic.

    IBM DB2 for Linux, UNIX and Windows Linux Windows
  • Medium 6.5
    CVE-2025-36427

    IBM Db2 Denial of Service

    IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) could allow a user to cause a denial of service due to insufficient validation of special elements in data query logic.

    IBM DB2 for Linux, UNIX and Windows Linux Windows
  • Medium 6.5
    CVE-2025-36442

    IBM Db2 Denial of Service

    IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 - 11.5.9 and 12.1.0 - 12.1.3 is vulnerable to a denial of service as the server may crash under certain conditions with a specially crafted query with XML columns.

    IBM DB2 for Linux, UNIX and Windows Linux Windows
  • Medium 6.2
    CVE-2025-36123

    IBM Db2 Denial of Service

    IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.5.0 - 11.5.9 and 12.1.0 - 12.1.3 could allow a local user to cause a denial of service when copying large table containing XML data due to improper allocation of system resources.

    IBM DB2 for Linux, UNIX and Windows Linux Windows
  • Medium 6.2
    CVE-2025-36353

    IBM Db2 Denial of Service

    IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 - 11.5.9 and 12.1.0 - 12.1.3 could allow a local user to cause a denial of service due to improper neutralization of special elements in data query logic.

    IBM DB2 for Linux, UNIX and Windows Linux Windows
  • Medium 5.3
    CVE-2025-36428

    IBM Db2 Denial of Service

    IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 - 11.5.9 and 12.1.0 - 12.1.3 could allow an authenticated user to cause a denial of service due to improper neutralization of special elements in data query logic when the RPSCAN feature…

    IBM DB2 for Linux, UNIX and Windows Linux Windows

Revision history

  1. #4

    Neue Updates von IBM aufgenommen

  2. #3

    Neue Updates von IBM aufgenommen

  3. #2

    Referenz(en) aufgenommen: EUVD-2025-206550, EUVD-2025-206551, EUVD-2025-206552, EUVD-2025-206554, EUVD-2025-206557, EUVD-2025-206553, EUVD-2025-206555, EUVD-2025-206558, EUVD-2025-206559, EUVD-2025-206560, EUVD-2025-206561, EUVD-2025-206563, EUVD-2025-206564, EUVD-2025-206565, EUVD-2025-206567, EUVD-2025-206566, EUVD-2025-206556

  4. #1

    Initiale Fassung

References