CVE-2005-4869 Null dereference in n/a

Low 2.1 Published 6 Oct 2007 Updated 8 Aug 2024

Local attackers can crash IBM DB2 by passing empty strings to to_char or to_date functions, causing a null pointer dereference.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2005-4869?

CVE-2005-4869 is a low-severity vulnerability in Ibm Db2, published on 6 Oct 2007. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

The (1) to_char and (2) to_date function in IBM DB2 8.1 allows local users to cause a denial of service (application crash) via an empty string in the second parameter, which causes a null pointer dereference.

Which versions are affected by CVE-2005-4869?

It affects 1 product.

Products include Ibm Db2.

How do I fix CVE-2005-4869?

No fix has been published for CVE-2005-4869 yet. Limit exposure of the affected software until one is available.

Is CVE-2005-4869 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2005-4869 exists.

Public exploit code: 1 Exploit-DB entry.

All Ibm Db2 vulnerabilities

Sources

Also known as GHSA-8vg7-hm2j-f2h5.