CVE-2007-2606
HighSummary
Multiple buffer overflows in Firebird 2.1 allow attackers to trigger memory corruption by processing specially crafted data in config\ConfigFile.cpp or msgs\check_msgs.epp. This may lead to unspecified impacts, including potential code execution.
Risk Assessment
The risk for organizations includes potential remote or local memory corruption, which could result in system crashes or unauthorized data access.
Recommendation
It is recommended to upgrade Firebird to version 2.5 or later, which includes fixes for these vulnerabilities. If upgrade is not possible, restrict access to configuration and message files.
Other vulnerabilities in Firebird 2.1
See all- CVE-2026-28214Medium
In Firebird, an open-source relational database management system, versions prior to 5.0.4, 4.0.7 and 3.0.14 have a flaw in ClumpletReader::getClumpletSize() that can overflow totalLength when parsing a Wide clumplet, causing an infinite loop. An authenticated user with INSERT privileges on any table can exploit this via a crafted Batch Parameter Block to cause a denial of service against the server. The issue is fixed in 5.0.4, 4.0.7 and 3.0.14.
- CVE-2014-9323Medium
The xdr_status_vector function in Firebird before 2.1.7 and 2.5.x before 2.5.3 SU1 allows remote attackers to cause a denial of service (NULL pointer dereference, segmentation fault, and crash) via an op_response action with a non-empty status.
Original NVD description (English source)
Multiple buffer overflows in Firebird 2.1 allow attackers to trigger memory corruption and possibly have other unspecified impact via certain input processed by (1) config\ConfigFile.cpp or (2) msgs\check_msgs.epp. NOTE: if ConfigFile.cpp reads a configuration file with restrictive permissions, then the ConfigFile.cpp vector may not cross privilege boundaries and perhaps should not be included in CVE.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS