Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.0
CVE-2014-9323: Firebird database can crash from crafted response
CVE-2014-9323 · published 11 years ago
Summary
Versions of Firebird earlier than 2.1.7 and 2.5.3 SU1 can be forced to stop working when they receive a specially crafted reply that contains an unexpected status. This makes the server process crash, potentially interrupting service for legitimate users. Upgrade Firebird to the latest release or apply the vendor’s patch to prevent the crash.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| firebirdsql | firebird |
< 2.1.7 >= 2.5, <= 2.5.3 cpe:2.3:a:firebirdsql:firebird:*:*:*:*:*:*:*:* |
| opensuse | evergreen |
11.4 cpe:2.3:o:opensuse:evergreen:11.4:*:*:*:*:*:*:* |
| debian | debian_linux |
7.0 8.0 cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:* |
| canonical | ubuntu_linux |
14.04 cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:* |
Original advisory text
The xdr_status_vector function in Firebird before 2.1.7 and 2.5.x before 2.5.3 SU1 allows remote attackers to cause a denial of service (NULL pointer dereference, segmentation fault, and crash) via...
The xdr_status_vector function in Firebird before 2.1.7 and 2.5.x before 2.5.3 SU1 allows remote attackers to cause a denial of service (NULL pointer dereference, segmentation fault, and crash) via an op_response action with a non-empty status.
References
- http://www.debian.org/security/2014/dsa-3109 Third Party Advisory
- http://www.firebirdsql.org/en/news/security-updates-for-v2-1-and-v2-5-series-660... Vendor Advisory
- http://www.mandriva.com/security/advisories?name=MDVSA-2015:172 Broken Link
- https://usn.ubuntu.com/3929-1/ Third Party Advisory
- http://advisories.mageia.org/MGASA-2014-0523.html Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2014-12/msg00012.html Mailing List Third Party Advisory
- http://tracker.firebirdsql.org/browse/CORE-4630 Exploit Vendor Advisory
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker partial control
Severity
5.0
Medium
Type
CWE-476NULL Pointer Dereference
Timeline
Published16 Dec 2014
Updated31 Oct 2026
First seen29 Sep 2026
Track software like this
Free during beta