CVE-2014-9323
MediumExploitation Probability (EPSS)
High risk87th percentile - higher than 87% of all known CVEs
Summary
The xdr_status_vector function in Firebird before 2.1.7 and 2.5.x before 2.5.3 SU1 allows remote attackers to cause a denial of service (NULL pointer dereference, segmentation fault, and crash) via an op_response action with a non-empty status.
Risk Assessment
A remote attacker can crash the Firebird server, leading to database availability interruptions.
Recommendation
Update Firebird to version 2.1.7 or 2.5.3 SU1 or later.
Other vulnerabilities in Firebird
See all- CVE-2007-2606High
Multiple buffer overflows in Firebird 2.1 allow attackers to trigger memory corruption by processing specially crafted data in config\ConfigFile.cpp or msgs\check_msgs.epp. This may lead to unspecified impacts, including potential code execution.
- CVE-2026-28214Medium
In Firebird, an open-source relational database management system, versions prior to 5.0.4, 4.0.7 and 3.0.14 have a flaw in ClumpletReader::getClumpletSize() that can overflow totalLength when parsing a Wide clumplet, causing an infinite loop. An authenticated user with INSERT privileges on any table can exploit this via a crafted Batch Parameter Block to cause a denial of service against the server. The issue is fixed in 5.0.4, 4.0.7 and 3.0.14.
Original NVD description (English source)
The xdr_status_vector function in Firebird before 2.1.7 and 2.5.x before 2.5.3 SU1 allows remote attackers to cause a denial of service (NULL pointer dereference, segmentation fault, and crash) via an op_response action with a non-empty status.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS