DescriptionAn authenticated remote attacker can execute arbitrary code in Firebird SQL Server versions 2.5.7 and 3.0.2 by executing a malformed SQL statement.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
NVD severityhigh (attack range: remote)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
firebird2.5 (PTS)jessie (security), jessie2.5.3.26778.ds4-5+deb8u1vulnerable
firebird3.0 (PTS)stretch3.0.1.32609.ds4-14vulnerable
buster, sid3.0.5.33100.ds4-2fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs


[stretch] - firebird3.0 <postponed> (Minor issue, can be fixed along in a future update)
[jessie] - firebird2.5 <no-dsa> (Minor issue, can be fixed along in a future update)
Firebird upstream responded to Tenable the issue is not intended to be addressed
in "any current release".
Issue adressed by disabling UDFs in firebird.conf, this is not a source code fix,
and might actually be considered more justof a mitigation.
Steps to reproduce (partly) in:

Search for package or bug name: Reporting problems