CVE-2017-1297
published 2017-06-27CVE-2017-1297: IBM DB2 for Linux, UNIX and Windows 9.2, 10.1, 10.5, and 11.1 (includes DB2 Connect Server) is vulnerable to a stack-based buffer overflow, caused by improper…
PriorityP343high7.3CVSS 3.0
AVLACLPRLUIRSUCHIHAH
EXPLOIT
EPSS
1.49%
71.2th percentile
IBM DB2 for Linux, UNIX and Windows 9.2, 10.1, 10.5, and 11.1 (includes DB2 Connect Server) is vulnerable to a stack-based buffer overflow, caused by improper bounds checking which could allow a local attacker to execute arbitrary code. IBM X-Force ID: 125159.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ibm | db2 | — | — |
| ibm | db2 | — | — |
| ibm | db2 | — | — |
| ibm | db2 | — | — |
| ibm | db2_connect | — | — |
| ibm | db2_connect | — | — |
| ibm | db2_connect | — | — |
| ibm | db2_connect | — | — |
CVSS provenance
nvdv3.07.3HIGHCVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
nvdv2.04.4MEDIUMAV:L/AC:M/Au:N/C:P/I:P/A:P
vendor_redhat7.5HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-w857-2m85-c8wr: IBM DB2 for Linux, UNIX and Windows 9
ghsa_unreviewed·2022-05-17
CVE-2017-1297 [HIGH] CWE-119 GHSA-w857-2m85-c8wr: IBM DB2 for Linux, UNIX and Windows 9
IBM DB2 for Linux, UNIX and Windows 9.2, 10.1, 10.5, and 11.1 (includes DB2 Connect Server) is vulnerable to a stack-based buffer overflow, caused by improper bounds checking which could allow a local attacker to execute arbitrary code. IBM X-Force ID: 125159.
Red Hat
jasper: reachable assertion in jpc_dec_process_siz() - dec->numvtiles
vendor_redhat·2017-08-25·CVSS 7.5
CVE-2017-13746 [HIGH] CWE-617 jasper: reachable assertion in jpc_dec_process_siz() - dec->numvtiles
jasper: reachable assertion in jpc_dec_process_siz() - dec->numvtiles
There is a reachable assertion abort in the function jpc_dec_process_siz() in jpc/jpc_dec.c:1297 in JasPer 2.0.12 that will lead to a remote denial of service attack.
Package: netpbm (Red Hat Enterprise Linux 5) - Not affected
Package: jasper (Red Hat Enterprise Linux 6) - Not affected
Package: jasper (Red Hat Enterprise Linux 7) - Not affected
Package: jasper (Red Hat Enterprise Linux 9) - Not affected
Package: mingw-virt-viewer (Red Hat Enterprise Virtualization 3) - Not affected
No detection rules found.
http://www.ibm.com/support/docview.wss?uid=swg22004878http://www.securityfocus.com/bid/99271http://www.securitytracker.com/id/1038772https://exchange.xforce.ibmcloud.com/vulnerabilities/125159https://www.exploit-db.com/exploits/42260/http://www.ibm.com/support/docview.wss?uid=swg22004878http://www.securityfocus.com/bid/99271http://www.securitytracker.com/id/1038772https://exchange.xforce.ibmcloud.com/vulnerabilities/125159https://www.exploit-db.com/exploits/42260/
2017-06-27
Published