CVE-2023-41038CWE-770

Server crash when using specific form of SET BIND statement

High · published March 20, 2024

CVSS v3.1
7.5
EPSS
1%
Percentile
50.9
In the wild
Unconfirmed
What it is

Firebird is a relational database. Versions 4.0.0 through 4.0.3 and version 5.0 beta1 are vulnerable to a server crash when a user uses a specific form of SET BIND statement. Any non-privileged user with minimum access to a server may type a statement with a long `CHAR` length, which causes the server to crash due to stack corruption. Versions 4.0.4.2981 and 5.0.0.117 contain fixes for this issue. No known workarounds are available.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00658 · 50.9th percentile
Weakness
CWE-770 · Allocation of Resources Without Limits or Throttling
Published
2024-03-20T14:22Z
EPSS history
Timeline
  • 20 MAR 14:22Z
    Server crash when using specific form of SET BIND statement
    cvelistv5