CVE-2025-24975

Katalog CVE

CVSS 8.8 · High EPSS 0,53%

Kerentanan Improper Check for Unusual or Exceptional Conditions pada firebirdsql firebird. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

Firebird is a relational database. Prior to snapshot versions 4.0.6.3183, 5.0.2.1610, and 6.0.0.609, Firebird is vulnerable if ExtConnPoolSize is not set equal to 0. If connections stored in ExtConnPool are not verified for presence and suitability of the CryptCallback interface is used when created versus what is available could result in a segfault in the server process. Encrypted databases, accessed by execute statement on external, may be accessed later by an attachment missing a key to that database. In a case when execute statement are chained, segfault may happen. Additionally, the segfault may affect unencrypted databases. This issue has been patched in snapshot versions 4.0.6.3183, 5.0.2.1610, and 6.0.0.609 and point releases 4.0.6 and 5.0.2. A workaround for this issue involves setting ExtConnPoolSize equal to 0 in firebird.conf.

Rincian

Terbit di NVD

15 Agustus 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-754: Improper Check for Unusual or Exceptional Conditions

EPSS (30 hari)

0,53% peluang dieksploitasi; lebih tinggi dari 43,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/FirebirdSQL/firebird/security/advisories/GHSA-fx9r-rj68-7p69 mitigasi · advisory vendor
• https://github.com/FirebirdSQL/firebird/commit/658abd20449f72097fbbce57e8e6ae42ff837fb6 patch
• https://www.vicarius.io/vsociety/posts/cve-2025-24975-detect-vulnerable-firebird exploit · advisory pihak ketiga
• https://www.vicarius.io/vsociety/posts/cve-2025-24975-mitigate-firebird-vulnerability exploit · advisory pihak ketiga
• https://github.com/FirebirdSQL/firebird/issues/8429 issue tracking