Multiple format string vulnerabilities in IBM DB2 Universal Database 8.1 may allow local users to execute arbitrary code via certain comman…

Published 22 y ago 2004-08-20 · modified 4 mo ago 2026-06-16 · JSON

CVSS

7.2

v2.0 · NVD

CISA KEV

not known exploited

EPSS

1.3%

percentile 70%

Public exploits

Exploit-DB

Multiple format string vulnerabilities in IBM DB2 Universal Database 8.1 may allow local users to execute arbitrary code via certain command line arguments to (1) db2start, (2) db2stop, or (3) db2govd.

Exploit prediction (EPSS)

1.26% probability of exploitation in the next 30 days, higher than 70% of all scored CVEs.

Exploits and detections

EDB-23346 IBM DB2 - 'db2govd' Format String Arbitrary Code Execution · local · 2003-11-07
EDB-23345 IBM DB2 - 'db2stop' Format String Arbitrary Code Execution · local · 2003-11-07
EDB-23344 IBM DB2 - 'db2start' Format String Arbitrary Code Execution · local · 2003-11-07

CVSS scores

Assigned by	Version	Score	Vector
NVD	2.0	7.2	`AV:L/AC:L/Au:N/C:C/I:C/A:C`

Classification

Technology feeds: IBM Db2 (RSS, critical only)

References

securityfocus.com /bid/8989 · vdb-entry, x_refsource_BID, x_transferred
exchange.xforce.ibmcloud.com /vulnerabilities/13633 · vdb-entry, x_refsource_XF, x_transferred
secnetops.com /research/advisories/SRT2003-11-06-0710.txt · x_refsource_MISC, x_transferred
securityfocus.com /archive/1/343804 · mailing-list, x_refsource_BUGTRAQ, x_transferred

Sources

CVE List: CVE-2003-1051
NVD: CVE-2003-1051

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.