CVE-2007-1087

HighCVSS 7.2/10Last modified Jun 16, 2026

Description

IBM DB2 8.x before 8.1 FixPak 15 and 9.1 before Fix Pack 2 does not properly terminate certain input strings, which allows local users to execute arbitrary code via unspecified environment variables that trigger a heap-based buffer overflow.

Metrics

CVSS 2.0 7.2/10AV:L/AC:L/Au:N/C:C/I:C/A:C

Weakness enumeration

CWE-119

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=481Broken Link
http://osvdb.org/40970Broken Link
http://www-1.ibm.com/support/docview.wss?uid=swg21255747Patch, Vendor Advisory
http://www.attrition.org/pipermail/vim/2007-August/001765.htmlThird Party Advisory
http://www.securityfocus.com/bid/22677Patch, Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/32651Third Party Advisory, VDB Entry
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=481Broken Link
http://osvdb.org/40970Broken Link
http://www-1.ibm.com/support/docview.wss?uid=swg21255747Patch, Vendor Advisory
http://www.attrition.org/pipermail/vim/2007-August/001765.htmlThird Party Advisory
http://www.securityfocus.com/bid/22677Patch, Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/32651Third Party Advisory, VDB Entry

Timeline

Published: Feb 23, 2007
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2007

CVE-2007-10887.2Stack-based buffer overflow in IBM DB2 8.x before 8.1 FixPak 15 and 9.1 before Fix Pack 2 allows local users to execute arbitrary code via a CVE-2007-10897.2IBM DB2 Universal Database (UDB) 9.1 GA through 9.1 FP1 allows local users with table SELECT privileges to perform unauthorized UPDATE and D CVE-2007-10907.1Microsoft Windows Explorer on Windows XP and 2003 allows remote user-assisted attackers to cause a denial of service (crash) via a malformed CVE-2007-10916.8Microsoft Internet Explorer 7 allows remote attackers to prevent users from leaving a site, spoof the address bar, and conduct phishing and CVE-2007-10929.3Mozilla Firefox 1.5.0.9 and 2.0.0.1, and SeaMonkey before 1.0.8 allow remote attackers to execute arbitrary code via JavaScript onUnload han CVE-2007-109310.0Multiple unspecified vulnerabilities in JP1/Cm2/Network Node Manager (NNM) before 07-10-05, and before 08-00-02 in the 08-x series, allow re CVE-2007-10947.8Microsoft Internet Explorer 7 allows remote attackers to cause a denial of service (NULL dereference and application crash) via JavaScript o CVE-2007-10956.8Mozilla Firefox before 2.0.0.8 and SeaMonkey before 1.1.5 do not properly implement JavaScript onUnload handlers, which allows remote attack CVE-2007-10966.8Cross-site scripting (XSS) vulnerability in ps_cart.php in VirtueMart before 20070116 allows remote attackers to inject arbitrary web script CVE-2007-109710.0Unrestricted file upload vulnerability in the onAttachFiles function in the upload tool (inc/lib/attachment.lib.php) in Wiclear before 0.11.CVE-2007-10987.8Multiple unspecified vulnerabilities in ScryMUD before 2.1.11 have unknown impact and attack vectors, possibly related to denial of service CVE-2007-10997.5dbclient in Dropbear SSH client before 0.49 does not sufficiently warn the user when it detects a hostkey mismatch, which might allow remote