CVE-2024-37071 — Memory Allocation with Excessive Size Value in IBM DB2

CWE-789 — Memory Allocation with Excessive Size Value3 documents3 sources

Severity

6.5MEDIUMNVD

CNA5.3

EPSS

0.1%

top 71.73%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

IBM DB2

Timeline

PublishedDec 7

Description

IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 could allow an authenticated user to cause a denial of service with a specially crafted query due to improper memory allocation.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HExploitability: 2.8 | Impact: 3.6

Affected Packages1 packages

▶NVDibm/db210.5.0 — 10.5.11+2

🔴Vulnerability Details

CVEList

IBM Db2 denial of service↗2024-12-07

▶

GHSA

GHSA-5f8v-qp5p-3gmv: IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10↗2024-12-07

▶