Most recent entries from all

bdu:2026-07740

EUVD-2026-292448

fkie_cve-2026-40342

Firebird is an open-source relational database management system. In versions prior to 5.0.4, 4.0.7 and 3.0.14, the external engine plugin loader concatenates a user-supplied engine name into a filesystem path without filtering path separators or .. components. An authenticated user with CREATE FUNCTION privileges can use a crafted ENGINE name to load an arbitrary shared library from anywhere on the filesystem via path traversal. The library's initialization code executes immediately during loading, before Firebird validates the module, achieving code execution as the server's OS account. This issue has been fixed in versions 5.0.4, 4.0.7 and 3.0.14.

OESA-2026-2013 — firebird security update

Affected: openEuler:22.03-LTS-SP4: firebird

Firebird is a relational database offering many ANSI SQL standard features that runs on Linux, Windows, MacOS and a variety of Unix platforms. Firebird offers excellent concurrency, high performance, and powerful language support for stored procedures and triggers. It has been used in production systems, under a variety of names, since 1981. Security Fix(es):

Firebird is an open-source relational database management system. In versions FB3 of the client library placed incorrect data length values into XSQLDA fields when communicating with FB4 or higher servers, resulting in an information leak. This issue is fixed by upgrading to the FB4 client or higher.(CVE-2025-65104)

Firebird is an open-source relational database management system. In versions prior to 5.0.4, 4.0.7 and 3.0.14, when processing CNCT_specific_data segments during authentication, the server assumes segments arrive in strictly ascending order. If segments arrive out of order, the Array class's grow() method computes a negative size value, causing a SIGSEGV crash. An unauthenticated attacker who knows only the server's IP and port can exploit this to crash the server. This issue has been fixed in versions 5.0.4, 4.0.7 and 3.0.14.(CVE-2026-27890)

Firebird is an open-source relational database management system. In versions prior to 6.0.0, 5.0.4, 4.0.7 and 3.0.14, when processing an op_slice network packet, the server passes an unprepared structure containing a null pointer to the SDL_info() func…

SUSE-SU-2026:1868-1 — Security update for firebird

Security update for firebird

UBUNTU-CVE-2026-40342

Affected: Ubuntu:18.04:LTS: firebird3.0, Ubuntu:20.04:LTS: firebird3.0, Ubuntu:22.04:LTS: firebird3.0, Ubuntu:24.04:LTS: firebird3.0, Ubuntu:25.10: firebird3.0, Ubuntu:25.10: firebird4.0, Ubuntu:26.04:LTS: firebird3.0, Ubuntu:26.04:LTS: firebird4.0

WID-SEC-W-2026-1171 — Firebird: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in Firebird ausnutzen, um beliebigen Programmcode mit Administratorrechten auszuführen, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand zu verursachen.