CVE-2017-6369 Insufficient checks in the UDF subsystem in Firebird 2.5.x before 2.5.7 and 3.0.x before 3.0.2 allow remote authenticated users to execute code by using a 'system' entrypoint from fbudf.so.
HighCVSS 8.8
EPSS 3.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Insufficient checks in the UDF subsystem in Firebird 2.5.x before 2.5.7 and 3.0.x before 3.0.2 allow remote authenticated users to execute code by using a 'system' entrypoint from fbudf.so.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/firebird3.0(Debian:12) | < 3.0.1.32609.ds4-14 | 3.0.1.32609.ds4-14 |
| debian/firebird3.0(Debian:13) | < 3.0.1.32609.ds4-14 | 3.0.1.32609.ds4-14 |
| debian/firebird3.0(Debian:14) | < 3.0.1.32609.ds4-14 | 3.0.1.32609.ds4-14 |
| firebirdsql firebird | >= 2.5.0, < 2.5.7 | 2.5.7 |
| firebirdsql firebird | >= 3.0.0, < 3.0.2 | 3.0.2 |
References
- Debian Security Tracker CVE-2017-6369 vendor-advisory
- tracker.firebirdsql.org issue-tracking vendor-advisory
- DSA-3824 mailing-list vendor-advisory
- 97070 third-party-advisory vdb-entry
- USN-3929-1 third-party-advisory vendor-advisory
- bugs.debian.org issue-tracking