CVE-2012-5529 : TraceManager in Firebird 2.5.0 and 2.5.1, when trace is enabled, allows remote a

TraceManager in Firebird 2.5.0 and 2.5.1, when trace is enabled, allows remote authenticated users to cause a denial of service (NULL pointer dereference and crash) by preparing an empty dynamic SQL query.

Published 2012-11-20 00:55:01

Updated 2025-04-11 00:51:22

Source Red Hat, Inc.

View at NVD, CVE.org

Vulnerability category: Memory CorruptionDenial of service

Products affected by CVE-2012-5529

Firebirdsql » Firebird » Version: 2.5.0
cpe:2.3:a:firebirdsql:firebird:2.5.0:*:*:*:*:*:*:*
Matching versions
Firebirdsql » Firebird » Version: 2.5.1
cpe:2.3:a:firebirdsql:firebird:2.5.1:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2012-5529

EPSS FAQ

0.97%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 75 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2012-5529

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
3.5	LOW	AV:N/AC:M/Au:S/C:N/I:N/A:P	6.8	2.9	NIST
Access Vector: Network Access Complexity: Medium Authentication: Single Confidentiality Impact: None Integrity Impact: None Availability Impact: Partial

CWE ids for CVE-2012-5529

CWE-399

Assigned by: nvd@nist.gov (Primary)

References for CVE-2012-5529

http://www.securityfocus.com/bid/56521

Firebird 'TraceDSQLPrepare::prepare()' Function NULL Pointer Denial of Service Vulnerability
http://www.openwall.com/lists/oss-security/2012/11/14/8

oss-security - Re: CVE Request -- firebird: DoS (NULL pointer dereference) while preparing an empty query with trace enabled
http://www.debian.org/security/2013/dsa-2648

Debian -- Security Information -- DSA-2648-1 firebird2.5

CVEs referencing this url
https://exchange.xforce.ibmcloud.com/vulnerabilities/80073

Firebird TraceDSQLPrepare::prepare() denial of service CVE-2012-5529 Vulnerability Report
http://tracker.firebirdsql.org/browse/CORE-3884

[#CORE-3884] Server crashes on preparing empty query when trace is enabled - Firebird RDBMS Issue Tracker
Vendor Advisory
http://www.openwall.com/lists/oss-security/2012/11/14/6

oss-security - CVE Request -- firebird: DoS (NULL pointer dereference) while preparing an empty query with trace enabled
http://www.securitytracker.com/id?1027769

Firebird Null Pointer Dereference on Empty Query Lets Remote Authenticated Users Deny Service - SecurityTracker

Jump to

Vulnerability Details : CVE-2012-5529

Products affected by CVE-2012-5529

Exploit prediction scoring system (EPSS) score for CVE-2012-5529

CVSS scores for CVE-2012-5529

CWE ids for CVE-2012-5529

References for CVE-2012-5529