Skip to content
OpenAdvisories
Medium WID-SEC-2026-0352 7 CVEs

IBM DB2: Mehrere Schwachstellen

Published Feb 9, 2026 · Updated Jul 1, 2026 · Revision 3 · de-DE

Vendor: IBM Product: Db2 Product: License Metric Tool Product: Tivoli Business Service Manager Platform: Linux Platform: Windows

Summary

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in IBM DB2 ausnutzen, um einen Denial of Service Angriff durchzuführen und vertrauliche Informationen offenzulegen.

Product

IBM DB2 ist ein relationales Datenbanksystem (RDBS) von IBM.

Vulnerabilities 7

  • High 7.1
    CVE-2025-36247

    IBM Db2 XML External Entity Reference

    IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 through 11.5.9 and 12.1.0 through 12.1.3 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to ex…

    IBM DB2 for Linux, UNIX and Windows Linux Windows
  • Medium 6.5
    CVE-2025-13867

    IBM Db2 Denial of Service

    IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 through 11.5.9 and 12.1.0 through 12.1.3 could allow an authenticated user to cause a denial of service due to improper neutralization of special elements in data query logic

    IBM DB2 for Linux, UNIX and Windows Linux Windows
  • Medium 6.5
    CVE-2025-14689

    IBM Db2 Denial of Service

    IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 12.1.0 through 12.1.3 could allow an authenticated user to cause a denial of service due to improper neutralization of special elements in data query logic with federated objects.

    IBM DB2 for Linux, UNIX and Windows Linux Windows
  • Medium 6.5
    CVE-2025-33124

    Fixes to common vulnerabilities found in IBM Db2 Merge Backup for Linux, UNIX and Windows

    IBM DB2 Merge Backup for Linux, UNIX and Windows 12.1.0.0 could allow an authenticated user to cause the program to crash due to the incorrect calculation of a buffer size.

    IBM DB2 Merge Backup for Linux, UNIX and Windows Linux Windows
  • Medium 6.5
    CVE-2025-33130

    Fixes to common vulnerabilities found in IBM Db2 Merge Backup for Linux, UNIX and Windows

    IBM DB2 Merge Backup for Linux, UNIX and Windows 12.1.0.0 could allow an authenticated user to cause the program to crash due to a buffer being overwritten when it is allocated on the stack.

    IBM DB2 Merge Backup for Linux, UNIX and Windows Linux Windows
  • Medium 5.5
    CVE-2025-13108

    Fixes to common vulnerabilities found in IBM Db2 Merge Backup for Linux, UNIX and Windows

    IBM DB2 Merge Backup for Linux, UNIX and Windows 12.1.0.0 could allow an attacker to access sensitive information in memory due to the buffer not properly clearing resources.

    IBM DB2 Merge Backup for Linux, UNIX and Windows Linux Windows
  • Medium 5.3
    CVE-2025-36425

    IBM Db2 Information Disclosure

    IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 through 11.5.9 and 12.1.0 through 12.1.3 could allow an authenticated user to obtain sensitive information under specific HADR configuration.

    IBM DB2 for Linux, UNIX and Windows Linux Windows

Revision history

  1. #3

    Neue Updates von IBM aufgenommen

  2. #2

    Neue Updates von IBM aufgenommen

  3. #1

    Initiale Fassung

References