EUVD-2025-209528Severity by source
AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:L
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
7DescriptionGitHub Advisory
Firebird is an open-source relational database management system. In versions FB3 of the client library placed incorrect data length values into XSQLDA fields when communicating with FB4 or higher servers, resulting in an information leak. This issue is fixed by upgrading to the FB4 client or higher.
AnalysisAI
Information disclosure in Firebird 3.x client library when connecting to Firebird 4+ servers allows local authenticated users to leak sensitive data through incorrect XSQLDA field length values. The vulnerability requires both the FB3 client library and an FB4+ server in the deployment. No active exploitation confirmed (not in CISA KEV), but CVSS 7.9 with scope change (S:C) indicates potential cross-boundary impact. Remediation requires upgrading the client library to Firebird 4.0.0 or higher.
Technical ContextAI
Firebird is an open-source SQL relational database management system supporting ANSI SQL standards. XSQLDA (Extended SQL Descriptor Area) is a data structure used in Firebird's client-server protocol to describe the format and metadata of query parameters and result sets. The vulnerability stems from CWE-200 (Exposure of Sensitive Information) where the FB3 client library incorrectly populates data length fields in XSQLDA structures during inter-version communication with FB4+ servers. This protocol-level incompatibility causes the client to misinterpret buffer boundaries, potentially exposing memory contents beyond intended data boundaries. The affected component is specifically the FB3 client library (cpe:2.3:a:firebirdsql:firebird:*:*:*:*:*:*:*:*), not the server itself, making this a client-side library vulnerability dependent on server version interaction.
RemediationAI
Upgrade all Firebird client libraries to version 4.0.0 or higher, available at https://github.com/FirebirdSQL/firebird/releases/tag/v4.0.0. This is a client-side fix requiring application redeployment or library updates on systems running database client applications, not server patching. For environments unable to immediately upgrade client libraries, enforce network segmentation to limit local access to systems running Firebird clients, and audit all users with local system access (PR:L requirement). Alternatively, downgrade Firebird servers to 3.x versions to match client library versions, though this sacrifices FB4+ features and may introduce other security regressions. Monitor database connection logs for unexpected data access patterns that could indicate information leak exploitation. No server-side configuration workaround exists - this requires binary client library replacement.
Stack-based buffer overflow in Firebird 2.1.3 through 2.1.5 before 18514, and 2.5.1 through 2.5.3 before 26623, on Windo
Firebird is a relational database. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable. Public ex
FireBird 2.5.5 allows remote authenticated users to cause a denial of service (daemon crash) by using service manager to
Remote code execution in Firebird RDBMS versions prior to 5.0.4, 4.0.7, and 3.0.14 allows authenticated users with CREAT
Insufficient checks in the UDF subsystem in Firebird 2.5.x before 2.5.7 and 3.0.x before 3.0.2 allow remote authenticate
The xdr_status_vector function in Firebird before 2.1.7 and 2.5.x before 2.5.3 SU1 allows remote attackers to cause a de
Null pointer dereference in Firebird SQL server causes remote denial-of-service when unauthenticated attackers send malf
Remote denial-of-service in Firebird database server versions prior to 5.0.4, 4.0.7, and 3.0.14 allows unauthenticated n
Firebird database server crashes via crafted slice packet exploiting zero-length SDL descriptor validation flaw. Remote
Remote denial-of-service in Firebird Database Server versions prior to 5.0.4, 4.0.7, and 3.0.14 allows unauthenticated n
Buffer overflow in Firebird RDBMS allows remote unauthenticated attackers to crash database servers via malformed slice
Remote unauthenticated denial of service in Firebird SQL database server versions prior to 6.0.0/5.0.4/4.0.7/3.0.14 allo
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: High| Product | Status |
|---|---|
| SUSE Linux Enterprise Module for Package Hub 15 SP7 | Fixed |
| openSUSE Leap 15.6 | Fixed |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Fixed |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Fixed |
| openSUSE Leap 15.3 | Fixed |
| openSUSE Leap 15.4 | Fixed |
| openSUSE Leap 15.5 | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today