CVE-2005-4870 — Improper Restriction of Operations within the Bounds of a Memory Buffer in IBM DB2

CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer3 documents3 sources

Severity

4.3MEDIUMNVD

EPSS

2.3%

top 15.11%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

IBM DB2

Timeline

PublishedDec 31

Latest updateMay 1

Description

Stack-based buffer overflows in the (1) xmlvarcharfromfile, (2) xmlclobfromfile, (3) xmlfilefromvarchar, and (4) xmlfilefromclob function calls in IBM DB2 8.1 allow remote attackers to execute arbitrary code via a 94-byte second argument, which causes the return address to be overwritten with a pointer to the argument.

CVSS vector

AV:N/AC:M/C:N/I:P/A:NExploitability: 8.6 | Impact: 2.9

Affected Packages1 packages

▶NVDibm/db28.1

Patches

Patch: secunia.com ↗Patch: www.nextgenss.com ↗Patch: secunia.com ↗

🔴Vulnerability Details

GHSA

GHSA-63qq-8356-xpg6: Stack-based buffer overflows in the (1) xmlvarcharfromfile, (2) xmlclobfromfile, (3) xmlfilefromvarchar, and (4) xmlfilefromclob function calls in IBM↗2022-05-01

▶

CVEList

CVE-2005-4870: Stack-based buffer overflows in the (1) xmlvarcharfromfile, (2) xmlclobfromfile, (3) xmlfilefromvarchar, and (4) xmlfilefromclob function calls in IBM↗2007-10-06

▶