IBM Product Security Update Advisory (CVE-2025-36247)

Overview

 

IBM have released security updates that address vulnerabilities in its products. Users of affected products are advised to update to the latest version.

 

 

Affected Products

 

CVE-2025-36247

 

IBM Db2 versions: 11.5.0 or later and 11.5.9 or earlier
IBM Db2 versions: 12.1.0 or later and 12.1.3 or earlier

 

 

Resolved Vulnerabilities

 

XML foreign object injection vulnerability in IBM Db2 (CVE-2025-36247)

 

 

Vulnerability Patches

 

Vulnerability Patches have been made available with the latest update. Please follow the instructions on the Referenced Sites to update to the latest version of Vulnerability Patches.

 

CVE-2025-36247

 

IBM Db2 Versions: Special Build #66394 for V11.5.9 or later[2]
IBM Db2 Version: Special Build #72296 for V12.1.2 or later[3]
IBM Db2 version: Special Build #74153 or later for V12.1.3 [4]

 

 

References

 

[1] Security Bulletin: IBM® Db2® is vulnerable to external entities parsing in XML (CVE-2025-36247)
https://www.ibm.com/support/pages/node/7259961
[2] Db2 v11.5.9 Published Cumulative Special Build Downloads
https://www.ibm.com/support/pages/node/7087189
[3] Db2 v12.1.2 Published Cumulative Special Build Downloads
https://www.ibm.com/support/pages/db2-v1212-published-cumulative-special-build-downloads
[4] Db2 v12.1.3 Published Cumulative Special Build Downloads
https://www.ibm.com/support/pages/db2-v1213-published-cumulative-special-build-downloads