Skip to main content

Db2 CVE-2015-1935

HIGH
DEPRECATED: Code (CWE-17)
2015-07-20 psirt@us.ibm.com
RCE Denial Of Service IBM Microsoft Db2
8.0
CVSS 2.0 · NVD
View

Vulnerability Assessment

Weakness
CWE
CWE-17
Impact

CVSS score of 8.0 (HIGH). Attack characteristics: network attack vector, low complexity. EPSS exploitation probability: 4.25%.
Exploit ScenarioDerived

This vulnerability can be exploited remotely over the network. Successful exploitation could compromise the high-severity affected system.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 4.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAI

The scalar-function implementation in IBM DB2 9.7 through FP10, 9.8 through FP5, 10.1 before FP5, and 10.5 through FP5 on Linux, UNIX, and Windows allows remote attackers to cause a denial of service. Rated high severity (CVSS 8.0), this vulnerability is remotely exploitable, low attack complexity.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

This vulnerability is classified under CWE-17. The scalar-function implementation in IBM DB2 9.7 through FP10, 9.8 through FP5, 10.1 before FP5, and 10.5 through FP5 on Linux, UNIX, and Windows allows remote attackers to cause a denial of service or execute arbitrary code via unspecified vectors. Affected products include: Ibm Db2.

Know when Db2 gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 8.0 HIGH
AV:N/AC:L/Au:S/C:P/I:P/A:C

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Confidentiality
P
Integrity
P
Availability
C

DescriptionCVE.org

The scalar-function implementation in IBM DB2 9.7 through FP10, 9.8 through FP5, 10.1 before FP5, and 10.5 through FP5 on Linux, UNIX, and Windows allows remote attackers to cause a denial of service or execute arbitrary code via unspecified vectors.

Threat Intelligence Overview

EPSS Score
4.2%
Top 11% exploitable
Data Quality
3 sources
Confidence: Low
NVD CVE.org EPSS

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 4.2%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Open
Automatable· derived
No
Human Impact· derived
Medium

Priority Score

44
Low Medium High Critical
KEV: 0
EPSS: +4
CVSS: +40
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Remote Code Execution CRITICAL

Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

Affected Products (CPE)CVE.org

cpe:2.3:a:ibm:db2:9.7:*:*:*:advanced_enterprise:*:*:*
cpe:2.3:a:ibm:db2:9.7:*:*:*:advanced_workgroup:*:*:*
cpe:2.3:a:ibm:db2:9.7:*:*:*:enterprise:*:*:*
cpe:2.3:a:ibm:db2:9.7:*:*:*:express:*:*:*
cpe:2.3:a:ibm:db2:9.7:*:*:*:workgroup:*:*:*
cpe:2.3:a:ibm:db2:9.8:*:*:*:advanced_enterprise:*:*:*
cpe:2.3:a:ibm:db2:9.8:*:*:*:advanced_workgroup:*:*:*
cpe:2.3:a:ibm:db2:9.8:*:*:*:enterprise:*:*:*
cpe:2.3:a:ibm:db2:9.8:*:*:*:express:*:*:*
cpe:2.3:a:ibm:db2:9.8:*:*:*:workgroup:*:*:*
cpe:2.3:a:ibm:db2:10.1:*:*:*:advanced_enterprise:*:*:*
cpe:2.3:a:ibm:db2:10.1:*:*:*:advanced_workgroup:*:*:*
cpe:2.3:a:ibm:db2:10.1:*:*:*:enterprise:*:*:*
cpe:2.3:a:ibm:db2:10.1:*:*:*:express:*:*:*
cpe:2.3:a:ibm:db2:10.1:*:*:*:workgroup:*:*:*
cpe:2.3:a:ibm:db2:10.5:*:*:*:advanced_enterprise:*:*:*
cpe:2.3:a:ibm:db2:10.5:*:*:*:advanced_workgroup:*:*:*
cpe:2.3:a:ibm:db2:10.5:*:*:*:enterprise:*:*:*
cpe:2.3:a:ibm:db2:10.5:*:*:*:express:*:*:*
cpe:2.3:a:ibm:db2:10.5:*:*:*:workgroup:*:*:*

More in Db2

View all
CVE-2012-4826 HIGH
8.5 Oct 20

Stack-based buffer overflow in the SQL/PSM (aka SQL Persistent Stored Module) Stored Procedure (SP) infrastructure in IB
CVE-2017-1297 HIGH POC
7.3 Jun 27

IBM DB2 for Linux, UNIX and Windows 9.2, 10.1, 10.5, and 11.1 (includes DB2 Connect Server) is vulnerable to a stack-bas
CVE-2014-3094 HIGH
8.5 Sep 04

Stack-based buffer overflow in IBM DB2 9.7 through FP9a, 9.8 through FP5, 10.1 through FP4, and 10.5 before FP4 on Linux
CVE-2012-1797 CRITICAL
10.0 Mar 20

IBM DB2 9.5 uses world-writable permissions for nodes.reg, which has unspecified impact and attack vectors. Rated critic
CVE-2026-10109 CRITICAL
9.8 Jun 30

Remote code execution in IBM Db2 11.5.0-11.5.9 and 12.1.0-12.1.4 lets unauthenticated network attackers run arbitrary co
CVE-2026-10543 CRITICAL
9.8 Aug 12

Privilege escalation in IBM Db2 (data server versions 11.5.0-11.5.9 and 12.1.0-12.1.5) allows an attacker to submit a sp
CVE-2026-10534 CRITICAL
9.8 Aug 12

Memory-corruption in IBM Db2's IXF file IMPORT parser lets an attacker supply a crafted IXF data file that overflows a s
CVE-2012-2197 HIGH
7.1 Jul 25

Stack-based buffer overflow in the Java Stored Procedure infrastructure in IBM DB2 9.1 before FP12, 9.5 through FP9, 9.7
CVE-2012-3324 CRITICAL
9.0 Sep 25

Directory traversal vulnerability in the UTL_FILE module in IBM DB2 and DB2 Connect 10.1 before FP1 on Windows allows re
CVE-2018-1426 CRITICAL
9.1 Mar 22

IBM GSKit (IBM DB2 for Linux, UNIX and Windows 9.7, 10.1, 10.5, and 11.1) duplicates the PRNG state across fork() system
CVE-2012-0711 HIGH
7.5 Mar 20

Integer signedness error in the db2dasrrm process in the DB2 Administration Server (DAS) in IBM DB2 9.1 through FP11, 9.
CVE-2013-6744 HIGH
8.5 May 30

The Stored Procedure infrastructure in IBM DB2 9.5, 9.7 before FP9a, 10.1 before FP3a, and 10.5 before FP3a on Windows a

Same weakness CWE-17 – DEPRECATED: Code

View all
CVE-2015-0240 CRITICAL POC
10.0
CVE-2014-9222 CRITICAL POC
10.0
CVE-2014-9707 HIGH POC
7.5
CVE-2015-3292 CRITICAL POC
10.0
CVE-2015-2682 MEDIUM POC
5.0
CVE-2015-4335 CRITICAL POC
10.0
CVE-2015-1728 CRITICAL
9.3
CVE-2014-9296 MEDIUM POC
5.0

Same technique RCE

View all
CVE-2021-44228 CRITICAL POC
10.0
CVE-2017-7269 CRITICAL POC
9.8
CVE-2022-47966 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2023-3519 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2016-4117 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8

References

Advisories & patches
PATCH http://www-01.ibm.com/support/docview.wss?uid=swg21902661 ADVISORY http://www-01.ibm.com/support/docview.wss?uid=swg1IT08543 REF http://www-01.ibm.com/support/docview.wss?uid=swg1IT08656 REF http://www-01.ibm.com/support/docview.wss?uid=swg1IT08667 REF http://www-01.ibm.com/support/docview.wss?uid=swg1IT08668 REF http://www.securityfocus.com/bid/75908 REF http://www.securitytracker.com/id/1033063

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy