DSA-1529-1

    Dashboard / Vulnerabilities / DSA-1529-1

    DSA-1529-1

    Published: 24 Mar 2008Last Modified: 4 Jul 2022

    Summary: firebird - multiple vulnerabilities

    Details: Multiple security problems have been discovered in the Firebird database, which may lead to the execution of arbitrary code or denial of service. This Debian security advisory is a bit unusual. While it's normally our strict policy to backport security bugfixes to older releases, this turned out to be infeasible for Firebird 1.5 due to large infrastructural changes necessary to fix these issues. As a consequence security support for Firebird 1.5 is hereby discontinued, leaving two options to administrators running a Firebird database: 1. Administrators running Firebird in a completely internal setup with trusted users could leave it unchanged. 2. Everyone else should upgrade to the firebird2.0 packages available at [backports.org](http://www.backports.org/backports.org/pool/main/f/firebird2.0/). Version 2.0.3.12981.ds1-6~bpo40+1 fixes all known issues. Please refer to the [general backports.org documentation](http://www.backports.org/dokuwiki/doku.php?id=instructions) to add the packages to your package management configuration. These packages are backported to run with Debian stable. Since firebird2.0 is not a drop-in replacement for firebird2 (which is the source package name for the Firebird 1.5 packages) these updates are not released through security.debian.org. Corrections for potential future security problems affecting Debian stable will be released through backports.org as well. Arrangements have been made to ensure that Firebird in the upcoming Debian 5.0 release will be supportable with regular backported security bugfixes again. For a more detailed description of the security problems, please refer to the entries in the Debian Bug Tracking System referenced above and the following URLs: <http://www.firebirdsql.org/rlsnotes/Firebird-2.0-ReleaseNotes.pdf> <http://www.firebirdsql.org/rlsnotes/Firebird-2.0.1-ReleaseNotes.pdf> <http://www.firebirdsql.org/rlsnotes/Firebird-2.0.2-ReleaseNotes.pdf>

    References:

    Affected packages

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    DSA-1529-1 | CVE-DB