CVE-2014-0907

Severity: high (CVSS 7.2 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2014-05-30 · updated 2026-06-17

Description

Multiple untrusted search path vulnerabilities in unspecified (1) setuid and (2) setgid programs in IBM DB2 9.5, 9.7 before FP9a, 9.8, 10.1 before FP3a, and 10.5 before FP3a on Linux and UNIX allow local users to gain root privileges via a Trojan horse library.

Affected products

IBM Db2 for Linux, UNIX and Windows: 9.5, 9.7, 9.7.0.1, 9.7.0.2, 9.7.0.3, 9.7.0.4 (+12)

References

http://packetstormsecurity.com/files/126940/IBM-DB2-Privilege-Escalation.html
http://seclists.org/fulldisclosure/2014/Jun/7
http://secunia.com/advisories/59451
http://secunia.com/advisories/59463
http://secunia.com/advisories/60482
http://www-01.ibm.com/support/docview.wss?uid=isg400001841
http://www-01.ibm.com/support/docview.wss?uid=isg400001843
http://www-01.ibm.com/support/docview.wss?uid=swg1IT00627
http://www-01.ibm.com/support/docview.wss?uid=swg1IT00684
http://www-01.ibm.com/support/docview.wss?uid=swg1IT00685
http://www-01.ibm.com/support/docview.wss?uid=swg1IT00686
http://www-01.ibm.com/support/docview.wss?uid=swg1IT00687

Get alerted when CVE-2014-0907 or the next vulnerability affects your stack