Detections
Analytics
IBM DB2 Multiple Vulnerabilities (7257697, 7257698) (Unix)
high Nessus Plugin ID 298042
Language:
Synopsis
The remote database server is affected by a multiple vulnerabilities.Description
According to its self-reported version number, IBM Db2 on Unix may be affected by a multiple vulnerabilities:- IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 - 11.5.9 and 12.1.0 - 12.1.3 could allow an authenticated user to cause a denial of service due to improper neutralization of special elements in data query logic when the RPSCAN feature is enabled. (CVE-2025-36428)
- IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 - 11.5.9 and 12.1.0 - 12.1.3 is vulnerable to a denial of service as the server may crash under certain conditions with a specially crafted query with XML columns. (CVE-2025-36442)
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
Solution
Apply the appropriate IBM DB2 Fix Pack or Special Build based on the most recent fix pack level for your branch.See Also
Plugin Details
Severity: High
ID: 298042
File Name: db2_7257697_7257698_nix.nasl
Version: 1.2
Type: local
Agent: unix
Family: Databases
Published: 2/5/2026
Updated: 2/6/2026
Configuration: Enable thorough checks (optional)
Supported Sensors: Nessus Agent, Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 5.1
CVSS v2
Risk Factor: High
Base Score: 7.8
Temporal Score: 5.8
Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C
CVSS Score Source: CVE-2025-36442
CVSS v3
Risk Factor: High
Base Score: 7.5
Temporal Score: 6.5
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
CPE: cpe:/a:ibm:db2
Required KB Items: installed_sw/DB2 Server
Excluded KB Items: SMB/db2/Installed
Exploit Ease: No known exploits are available
Patch Publication Date: 1/29/2026
Vulnerability Publication Date: 1/29/2026
Reference Information
CVE: CVE-2025-36428, CVE-2025-36442