Bug 2388792 (CVE-2025-24975) - CVE-2025-24975 firebirdsql: Firebird Access Bypass
Summary: CVE-2025-24975 firebirdsql: Firebird Access Bypass
Keywords:
Status: NEW
Alias: CVE-2025-24975
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On: 2388809 2388811 2388813 2388815
Blocks:
TreeView+ depends on / blocked
 
Reported: 2025-08-15 16:01 UTC by OSIDB Bzimport
Modified: 2025-08-18 15:31 UTC (History)
0 users

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:


Attachments (Terms of Use)

Description OSIDB Bzimport 2025-08-15 16:01:43 UTC
Firebird is a relational database. Prior to snapshot versions 4.0.6.3183, 5.0.2.1610, and 6.0.0.609, Firebird is vulnerable if ExtConnPoolSize is not set equal to 0. If connections stored in ExtConnPool are not verified for presence and suitability of the CryptCallback interface is used when created versus what is available could result in a segfault in the server process. Encrypted databases, accessed by execute statement on external, may be accessed later by an attachment missing a key to that database. In a case when execute statement are chained, segfault may happen. Additionally, the segfault may affect unencrypted databases. This issue has been patched in snapshot versions 4.0.6.3183, 5.0.2.1610, and 6.0.0.609 and point releases 4.0.6 and 5.0.2. A workaround for this issue involves setting ExtConnPoolSize equal to 0 in firebird.conf.


Note You need to log in before you can comment on or make changes to this bug.