Описание
Security update for firebird
This update for firebird fixes the following issues
- CVE-2025-65104: Information leak vulnerability in firebird3 client when used with newer (>= 4) server (bsc#1262330).
- CVE-2026-27890: Pre-Auth DOS (bsc#1262328).
- CVE-2026-28212: One packet DoS (bsc#1262329).
- CVE-2026-28214: Server hangs when using specific clumplet on batch creation (bsc#1262327).
- CVE-2026-28224: CryptCallback DOS (bsc#1262326).
- CVE-2026-33337: Buffer overflow on parsing corrupted slice packet (bsc#1262325).
- CVE-2026-34232: DoS via
op_responsepacket from client (bsc#1262324). - CVE-2026-35215: DoS via malicious slice descriptor in slice packet (bsc#1262322).
- CVE-2026-40342: Path traversal when declaring external routine (bsc#1262320).
Список пакетов
SUSE Linux Enterprise Module for Package Hub 15 SP7
Ссылки
- Link for SUSE-SU-2026:1868-1
- E-Mail link for SUSE-SU-2026:1868-1
- SUSE Security Ratings
- SUSE Bug 1262320
- SUSE Bug 1262322
- SUSE Bug 1262324
- SUSE Bug 1262325
- SUSE Bug 1262326
- SUSE Bug 1262327
- SUSE Bug 1262328
- SUSE Bug 1262329
- SUSE Bug 1262330
- SUSE CVE CVE-2025-65104 page
- SUSE CVE CVE-2026-27890 page
- SUSE CVE CVE-2026-28212 page
- SUSE CVE CVE-2026-28214 page
- SUSE CVE CVE-2026-28224 page
- SUSE CVE CVE-2026-33337 page
- SUSE CVE CVE-2026-34232 page
- SUSE CVE CVE-2026-35215 page
Описание
Firebird is an open-source relational database management system. In versions FB3 of the client library placed incorrect data length values into XSQLDA fields when communicating with FB4 or higher servers, resulting in an information leak. This issue is fixed by upgrading to the FB4 client or higher.
Затронутые продукты
Ссылки
- CVE-2025-65104
- SUSE Bug 1262330
Описание
Firebird is an open-source relational database management system. In versions prior to 5.0.4, 4.0.7 and 3.0.14, when processing CNCT_specific_data segments during authentication, the server assumes segments arrive in strictly ascending order. If segments arrive out of order, the Array class's grow() method computes a negative size value, causing a SIGSEGV crash. An unauthenticated attacker who knows only the server's IP and port can exploit this to crash the server. This issue has been fixed in versions 5.0.4, 4.0.7 and 3.0.14.
Затронутые продукты
Ссылки
- CVE-2026-27890
- SUSE Bug 1262328
Описание
Firebird is an open-source relational database management system. In versions prior to 6.0.0, 5.0.4, 4.0.7 and 3.0.14, when processing an op_slice network packet, the server passes an unprepared structure containing a null pointer to the SDL_info() function, resulting in a null pointer dereference and server crash. An unauthenticated attacker can trigger this by sending a crafted packet to the server port. This issue has been fixed in versions 6.0.0, 5.0.4, 4.0.7 and 3.0.14.
Затронутые продукты
Ссылки
- CVE-2026-28212
- SUSE Bug 1262329
Описание
Firebird is an open-source relational database management system. In versions prior to 5.0.4, 4.0.7 and 3.0.14, the ClumpletReader::getClumpletSize() function can overflow the totalLength value when parsing a Wide type clumplet, causing an infinite loop. An authenticated user with INSERT privileges on any table can exploit this via a crafted Batch Parameter Block to cause a denial of service against the server. This issue has been fixed in versions 5.0.4, 4.0.7 and 3.0.14.
Затронутые продукты
Ссылки
- CVE-2026-28214
- SUSE Bug 1262327
Описание
Firebird is an open-source relational database management system. In versions prior to 5.0.4, 4.0.7 and 3.0.14, when the server receives an op_crypt_key_callback packet without prior authentication, the port_server_crypt_callback handler is not initialized, resulting in a null pointer dereference and server crash. An unauthenticated attacker who knows only the server's IP and port can exploit this to crash the server. This issue has been fixed in versions 5.0.4, 4.0.7 and 3.0.14.
Затронутые продукты
Ссылки
- CVE-2026-28224
- SUSE Bug 1262326
Описание
Firebird is an open-source relational database management system. In versions prior to 5.0.4, 4.0.7 and 3.0.14, when deserializing a slice packet, the xdr_datum() function does not validate that a cstring length conforms to the slice descriptor bounds, allowing a cstring longer than the allocated buffer to overflow it. An unauthenticated attacker can exploit this by sending a crafted packet to the server, potentially causing a crash or other security impact. This issue has been fixed in versions 5.0.4, 4.0.7 and 3.0.14.
Затронутые продукты
Ссылки
- CVE-2026-33337
- SUSE Bug 1262325
Описание
Firebird is an open-source relational database management system. In versions prior to 5.0.4, 4.0.7 and 3.0.14, the xdr_status_vector() function does not handle the isc_arg_cstring type when decoding an op_response packet, causing a server crash when one is encountered in the status vector. An unauthenticated attacker can exploit this by sending a crafted op_response packet to the server. This issue has been fixed in versions 5.0.4, 4.0.7 and 3.0.14.
Затронутые продукты
Ссылки
- CVE-2026-34232
- SUSE Bug 1262324
Описание
Firebird is an open-source relational database management system. In versions prior to 5.0.4, 4.0.7 and 3.0.14, the sdl_desc() function does not validate the length of a decoded SDL descriptor from a slice packet. A zero-length descriptor is later used to calculate the number of slice items, causing a division by zero. An unauthenticated attacker can exploit this by sending a crafted slice packet to crash the server. This issue has been fixed in versions 5.0.4, 4.0.7 and 3.0.14.
Затронутые продукты
Ссылки
- CVE-2026-35215
- SUSE Bug 1262322
Описание
Firebird is an open-source relational database management system. In versions prior to 5.0.4, 4.0.7 and 3.0.14, the external engine plugin loader concatenates a user-supplied engine name into a filesystem path without filtering path separators or .. components. An authenticated user with CREATE FUNCTION privileges can use a crafted ENGINE name to load an arbitrary shared library from anywhere on the filesystem via path traversal. The library's initialization code executes immediately during loading, before Firebird validates the module, achieving code execution as the server's OS account. This issue has been fixed in versions 5.0.4, 4.0.7 and 3.0.14.
Затронутые продукты
Ссылки
- CVE-2026-40342
- SUSE Bug 1262320