Vulnerability Details : CVE-2023-41038
Firebird is a relational database. Versions 4.0.0 through 4.0.3 and version 5.0 beta1 are vulnerable to a server crash when a user uses a specific form of SET BIND statement. Any non-privileged user with minimum access to a server may type a statement with a long `CHAR` length, which causes the server to crash due to stack corruption. Versions 4.0.4.2981 and 5.0.0.117 contain fixes for this issue. No known workarounds are available.
Products affected by CVE-2023-41038
Please log in to view affected product information.
Exploit prediction scoring system (EPSS) score for CVE-2023-41038
0.34%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 55 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2023-41038
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
7.5
|
HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
3.9
|
3.6
|
GitHub, Inc. | 2024-03-21 |
CWE ids for CVE-2023-41038
-
The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.Assigned by: security-advisories@github.com (Secondary)
References for CVE-2023-41038
-
https://github.com/FirebirdSQL/firebird/security/advisories/GHSA-6fv8-8rwr-9692
Server crash when using specific form of SET BIND statement · Advisory · FirebirdSQL/firebird · GitHub
-
https://firebirdsql.org/en/snapshot-builds
Firebird: Snapshot Builds
Jump to