CVE-2024-49350: 
IBM Db2 vulnerability analysis and mitigation

IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) versions 11.1.0 through 11.1.4.7, 11.5.0 through 11.5.9, and 12.1.0 through 12.1.1 is vulnerable to a denial of service vulnerability where the server may crash under certain conditions with a specially crafted query (IBM Security, NVD).

The vulnerability is identified as CVE-2024-49350 and has been classified as a Stack-based Buffer Overflow (CWE-121). It has been assigned a CVSS Base score of 6.5 MEDIUM with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (IBM Security, Wiz).

When successfully exploited, this vulnerability can result in a denial of service condition where the IBM Db2 server may crash under specific circumstances when processing a specially crafted query (IBM Security).

IBM has released special builds containing interim fixes for affected versions. Customers running vulnerable versions can download these special builds from Fix Central. The fixes are available for V11.1.4 FP7, V11.5.9, and V12.1.1, and can be applied to any affected mod pack level of the appropriate release. Note that after December 31, 2025, versions 11.1 and 10.5 of Db2 will not receive security fixes as they will reach End of Support (IBM Security).