CVE-2007-5757

MediumCVSS 6.9/10Last modified Jun 16, 2026

Description

Untrusted search path vulnerability in db2pd in IBM DB2 Universal Database (UDB) 8 before FixPak 16 and 9 before Fix Pack 4 allows local users to gain root privileges via a modified DB2INSTANCE environment variable that points to a malicious library. NOTE: this might be the same issue as CVE-2008-0697.

Metrics

CVSS 2.0 6.9/10AV:L/AC:M/Au:N/C:C/I:C/A:C

Weakness enumeration

CWE-264

Affected software

No affected versions have been published.

Timeline

Published: Feb 13, 2008
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2007

CVE-2007-57586.9Stack-based buffer overflow in db2dasrrm in the DB2 Administration Server (DAS) in IBM DB2 Universal Database 9.5 before Fix Pack 1, 9.1 bef CVE-2007-57609.3Array index error in the XFree86-Misc extension in X.Org Xserver before 1.4.1 allows context-dependent attackers to execute arbitrary code v CVE-2007-57617.2The NantSys device 5.0.0.115 in Motorola netOctopus 5.1.2 build 1011 has weak permissions for the \\.\NantSys device interface (nantsys.sys)CVE-2007-57627.2NICM.SYS driver 3.0.0.4, as used in Novell NetWare Client 4.91 SP4, allows local users to execute arbitrary code by opening the \\.\nicm dev CVE-2007-57647.2Buffer overflow in the pioout program in printers.rte in IBM AIX 5.2, 5.3, and 6.1 allows local users to gain privileges via a long command CVE-2007-57667.5SQL injection vulnerability in okxLOV.jsp in Oracle E-Business Suite 11 and 12 allows remote attackers to execute arbitrary SQL commands via CVE-2007-576710.0Heap-based buffer overflow in the Client Trust application (clntrust.exe) in Novell BorderManager 3.8 before Update 1.5 allows remote attack CVE-2007-57685.0The Globe7 soft phone client 7.3 sends username and password information in cleartext, which allows remote attackers to obtain sensitive inf CVE-2007-576910.0Double free vulnerability in the getreply function in ftp.c in netkit ftp (netkit-ftp) 0.17 20040614 and later allows remote FTP servers to CVE-2007-57705.0The (1) Net::ftptls, (2) Net::telnets, (3) Net::imap, (4) Net::pop, and (5) Net::smtp libraries in Ruby 1.8.5 and 1.8.6 do not verify that t CVE-2007-57717.5Flatnuke 3 (aka FlatnuX) allows remote attackers to obtain administrative access via a myforum%00 cookie.CVE-2007-57726.0Direct static code injection vulnerability in the download module in Flatnuke 3 allows remote authenticated administrators to inject arbitra