Errata ALT-PU-2026-7495-1: Information
Fixes
Published: April 22, 2026
Modified: May 28, 2026
Modified: May 28, 2026
BDU:2026-05711
Уязвимость функции op_crypt_key_callback системы управления базами данных Firebird, позволяющая нарушителю вызвать отказ в обслуживании
Severity: HIGH (8.2)
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Severity: HIGH (8.5)
Vector: CVSS:2.0/AV:N/AC:L/Au:N/C:N/I:P/A:C
Links:
Published: April 22, 2026
Modified: May 28, 2026
Modified: May 28, 2026
BDU:2026-05713
Уязвимость системы управления базами данных Firebird, связанная с некорректной обработкой синтаксически неверной структуры, позволяющая нарушителю вызвать отказ в обслуживании
Severity: HIGH (7.5)
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Severity: HIGH (7.8)
Vector: CVSS:2.0/AV:N/AC:L/Au:N/C:N/I:N/A:C
Links:
Published: April 22, 2026
Modified: May 28, 2026
Modified: May 28, 2026
BDU:2026-05714
Уязвимость функции xdr_datum системы управления базами данных Firebird, позволяющая нарушителю вызвать отказ в обслуживании
Severity: HIGH (7.5)
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Severity: HIGH (7.8)
Vector: CVSS:2.0/AV:N/AC:L/Au:N/C:N/I:N/A:C
Links:
Published: April 22, 2026
Modified: May 28, 2026
Modified: May 28, 2026
BDU:2026-05715
Уязвимость функции SDL_info системы управления базами данных Firebird, позволяющая нарушителю вызвать отказ в обслуживании
Severity: HIGH (7.5)
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Severity: HIGH (7.8)
Vector: CVSS:2.0/AV:N/AC:L/Au:N/C:N/I:N/A:C
Links:
Published: April 22, 2026
Modified: May 28, 2026
Modified: May 28, 2026
BDU:2026-05716
Уязвимость функции sdl_desc системы управления базами данных Firebird, позволяющая нарушителю вызвать отказ в обслуживании
Severity: HIGH (7.5)
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Severity: HIGH (7.8)
Vector: CVSS:2.0/AV:N/AC:L/Au:N/C:N/I:N/A:C
Links:
Published: April 22, 2026
Modified: May 28, 2026
Modified: May 28, 2026
BDU:2026-05719
Уязвимость системы управления базами данных Firebird, связанная с выходом операции за границы буфера в памяти, позволяющая нарушителю вызвать отказ в обслуживании
Severity: HIGH (8.2)
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Severity: HIGH (8.5)
Vector: CVSS:2.0/AV:N/AC:L/Au:N/C:N/I:P/A:C
Links:
Published: April 22, 2026
Modified: May 28, 2026
Modified: May 28, 2026
BDU:2026-05720
Уязвимость функции ClumpletReader::getClumpletSize() системы управления базами данных Firebird, позволяющая нарушителю вызвать отказ в обслуживании
Severity: HIGH (7.7)
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
Severity: MEDIUM (6.8)
Vector: CVSS:2.0/AV:N/AC:L/Au:S/C:N/I:N/A:C
Links:
Published: April 17, 2026
Modified: April 24, 2026
Modified: April 24, 2026
CVE-2025-65104
Firebird is an open-source relational database management system. In versions FB3 of the client library placed incorrect data length values into XSQLDA fields when communicating with FB4 or higher servers, resulting in an information leak. This issue is fixed by upgrading to the FB4 client or higher.
Severity: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Links:
Published: April 17, 2026
Modified: April 24, 2026
Modified: April 24, 2026
CVE-2026-27890
Firebird is an open-source relational database management system. In versions prior to 5.0.4, 4.0.7 and 3.0.14, when processing CNCT_specific_data segments during authentication, the server assumes segments arrive in strictly ascending order. If segments arrive out of order, the Array class's grow() method computes a negative size value, causing a SIGSEGV crash. An unauthenticated attacker who knows only the server's IP and port can exploit this to crash the server. This issue has been fixed in versions 5.0.4, 4.0.7 and 3.0.14.
Severity: HIGH (8.2)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Links:
Published: April 17, 2026
Modified: April 24, 2026
Modified: April 24, 2026
CVE-2026-28212
Firebird is an open-source relational database management system. In versions prior to 6.0.0, 5.0.4, 4.0.7 and 3.0.14, when processing an op_slice network packet, the server passes an unprepared structure containing a null pointer to the SDL_info() function, resulting in a null pointer dereference and server crash. An unauthenticated attacker can trigger this by sending a crafted packet to the server port. This issue has been fixed in versions 6.0.0, 5.0.4, 4.0.7 and 3.0.14.
Severity: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Links:
Published: April 17, 2026
Modified: April 24, 2026
Modified: April 24, 2026
CVE-2026-28214
Firebird is an open-source relational database management system. In versions prior to 5.0.4, 4.0.7 and 3.0.14, the ClumpletReader::getClumpletSize() function can overflow the totalLength value when parsing a Wide type clumplet, causing an infinite loop. An authenticated user with INSERT privileges on any table can exploit this via a crafted Batch Parameter Block to cause a denial of service against the server. This issue has been fixed in versions 5.0.4, 4.0.7 and 3.0.14.
Severity: MEDIUM (6.0)
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Severity: MEDIUM (6.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Links:
Published: April 17, 2026
Modified: April 24, 2026
Modified: April 24, 2026
CVE-2026-28224
Firebird is an open-source relational database management system. In versions prior to 5.0.4, 4.0.7 and 3.0.14, when the server receives an op_crypt_key_callback packet without prior authentication, the port_server_crypt_callback handler is not initialized, resulting in a null pointer dereference and server crash. An unauthenticated attacker who knows only the server's IP and port can exploit this to crash the server. This issue has been fixed in versions 5.0.4, 4.0.7 and 3.0.14.
Severity: HIGH (8.2)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Links:
Published: April 17, 2026
Modified: April 27, 2026
Modified: April 27, 2026
CVE-2026-33337
Firebird is an open-source relational database management system. In versions prior to 5.0.4, 4.0.7 and 3.0.14, when deserializing a slice packet, the xdr_datum() function does not validate that a cstring length conforms to the slice descriptor bounds, allowing a cstring longer than the allocated buffer to overflow it. An unauthenticated attacker can exploit this by sending a crafted packet to the server, potentially causing a crash or other security impact. This issue has been fixed in versions 5.0.4, 4.0.7 and 3.0.14.
Severity: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Links:
Published: April 17, 2026
Modified: April 27, 2026
Modified: April 27, 2026
CVE-2026-34232
Firebird is an open-source relational database management system. In versions prior to 5.0.4, 4.0.7 and 3.0.14, the xdr_status_vector() function does not handle the isc_arg_cstring type when decoding an op_response packet, causing a server crash when one is encountered in the status vector. An unauthenticated attacker can exploit this by sending a crafted op_response packet to the server. This issue has been fixed in versions 5.0.4, 4.0.7 and 3.0.14.
Severity: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Links:
Published: April 17, 2026
Modified: April 27, 2026
Modified: April 27, 2026
CVE-2026-35215
Firebird is an open-source relational database management system. In versions prior to 5.0.4, 4.0.7 and 3.0.14, the sdl_desc() function does not validate the length of a decoded SDL descriptor from a slice packet. A zero-length descriptor is later used to calculate the number of slice items, causing a division by zero. An unauthenticated attacker can exploit this by sending a crafted slice packet to crash the server. This issue has been fixed in versions 5.0.4, 4.0.7 and 3.0.14.
Severity: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Links:
Published: April 17, 2026
Modified: April 27, 2026
Modified: April 27, 2026
CVE-2026-40342
Firebird is an open-source relational database management system. In versions prior to 5.0.4, 4.0.7 and 3.0.14, the external engine plugin loader concatenates a user-supplied engine name into a filesystem path without filtering path separators or .. components. An authenticated user with CREATE FUNCTION privileges can use a crafted ENGINE name to load an arbitrary shared library from anywhere on the filesystem via path traversal. The library's initialization code executes immediately during loading, before Firebird validates the module, achieving code execution as the server's OS account. This issue has been fixed in versions 5.0.4, 4.0.7 and 3.0.14.
Severity: CRITICAL (9.9)
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Links: