Vulnerabilities > Firebirdsql

DATE CVE VULNERABILITY TITLE RISK
2018-03-28 CVE-2017-11509 SQL Injection vulnerability in multiple products
An authenticated remote attacker can execute arbitrary code in Firebird SQL Server versions 2.5.7 and 3.0.2 by executing a malformed SQL statement.
network
low complexity
firebirdsql debian CWE-89
critical
9.0
2017-03-24 CVE-2017-6369 Missing Authorization vulnerability in Firebirdsql Firebird
Insufficient checks in the UDF subsystem in Firebird 2.5.x before 2.5.7 and 3.0.x before 3.0.2 allow remote authenticated users to execute code by using a 'system' entrypoint from fbudf.so.
network
low complexity
firebirdsql CWE-862
6.5
2016-01-13 CVE-2016-1569 Improper Input Validation vulnerability in Firebirdsql Firebird 2.5.5
FireBird 2.5.5 allows remote authenticated users to cause a denial of service (daemon crash) by using service manager to invoke the gbak utility with an invalid parameter.
network
low complexity
firebirdsql CWE-20
4.0
2013-03-15 CVE-2013-2492 Improper Restriction of Operations Within the Bounds of A Memory Buffer vulnerability in Firebirdsql Firebird
Stack-based buffer overflow in Firebird 2.1.3 through 2.1.5 before 18514, and 2.5.1 through 2.5.3 before 26623, on Windows allows remote attackers to execute arbitrary code via a crafted packet to TCP port 3050, related to a missing size check during extraction of a group number from CNCT information.
6.8
2012-11-20 CVE-2012-5529 Resource Management Errors vulnerability in Firebirdsql Firebird 2.5.0/2.5.1
TraceManager in Firebird 2.5.0 and 2.5.1, when trace is enabled, allows remote authenticated users to cause a denial of service (NULL pointer dereference and crash) by preparing an empty dynamic SQL query.
3.5
2009-07-29 CVE-2009-2620 Improper Input Validation vulnerability in Firebirdsql Firebird
src/remote/server.cpp in fbserver.exe in Firebird SQL 1.5 before 1.5.6, 2.0 before 2.0.6, 2.1 before 2.1.3, and 2.5 before 2.5 Beta 2 allows remote attackers to cause a denial of service (daemon crash) via a malformed op_connect_request message that triggers an infinite loop or NULL pointer dereference.
network
low complexity
firebirdsql CWE-20
5.0
2008-01-29 CVE-2008-0467 Improper Restriction of Operations Within the Bounds of A Memory Buffer vulnerability in Firebirdsql Firebird
Stack-based buffer overflow in Firebird before 2.0.4, and 2.1.x before 2.1.0 RC1, might allow remote attackers to execute arbitrary code via a long username.
network
low complexity
firebirdsql CWE-119
critical
10.0
2008-01-29 CVE-2008-0387 Numeric Errors vulnerability in Firebirdsql Firebird
Integer overflow in Firebird SQL 1.0.3 and earlier, 1.5.x before 1.5.6, 2.0.x before 2.0.4, and 2.1.x before 2.1.0 RC1 might allow remote attackers to execute arbitrary code via crafted (1) op_receive, (2) op_start, (3) op_start_and_receive, (4) op_send, (5) op_start_and_send, and (6) op_start_send_and_receive XDR requests, which triggers memory corruption.
network
low complexity
firebirdsql CWE-189
7.8
2007-10-11 CVE-2007-4992 Buffer Errors vulnerability in Firebirdsql Firebird 2.0.2
Stack-based buffer overflow in the process_packet function in fbserver.exe in Firebird SQL 2.0.2 allows remote attackers to execute arbitrary code via a long request to TCP port 3050.
network
low complexity
firebirdsql CWE-119
critical
10.0
2007-10-06 CVE-2007-5246 Improper Restriction of Operations Within the Bounds of A Memory Buffer vulnerability in Firebirdsql Firebird 2.0.0.12748/2.0.1.12855
Multiple stack-based buffer overflows in Firebird LI 2.0.0.12748 and 2.0.1.12855, and WI 2.0.0.12748 and 2.0.1.12855, allow remote attackers to execute arbitrary code via (1) a long attach request on TCP port 3050 to the isc_attach_database function or (2) a long create request on TCP port 3050 to the isc_create_database function.
network
low complexity
firebirdsql CWE-119
critical
10.0