CVE-2020-4363: 
IBM Db2 vulnerability analysis and mitigation

IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) versions 9.7, 10.1, 10.5, 11.1, and 11.5 was identified with a critical buffer overflow vulnerability (CVE-2020-4363). The vulnerability, caused by improper bounds checking, was discovered and reported to IBM by Eddie Zhu from BEIJING DBSEC TECHNOLOGY CO., LTD (IBM Security).

The vulnerability is characterized by a buffer overflow condition resulting from improper bounds checking in the DB2 system. It received a CVSS Base score of 8.4 with a vector of CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating high severity across confidentiality, integrity, and availability impacts (IBM Security).

If exploited, this vulnerability could allow a local attacker to execute arbitrary code on the system with root privileges, potentially leading to complete system compromise (IBM Security).

The vulnerability requires local access to exploit, with no privileges or user interaction needed. The attack complexity is considered low, making it relatively straightforward to exploit for an attacker with local system access (IBM Security).

IBM has released special builds containing interim fixes for all affected versions. These builds are available based on the most recent fixpack level for each impacted release: V9.7 FP11, V10.1 FP6, V10.5 FP11, 11.1 FP5, and V11.5 GA. The fixes can be applied to any affected fixpack level of the appropriate release to remediate this vulnerability. No workarounds are available (IBM Security).