CVE-2023-41038

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Firebird is a relational database. Versions 4.0.0 through 4.0.3 and version 5.0 beta1 are vulnerable to a server crash when a user uses a specific form of SET BIND statement. Any non-privileged user with minimum access to a server may type a statement with a long `CHAR` length, which causes the server to crash due to stack corruption. Versions 4.0.4.2981 and 5.0.0.117 contain fixes for this issue. No known workarounds are available.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-770

Affected software

No affected versions have been published.

Timeline

Published: Mar 20, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2023

CVE-2023-410397.7RestrictedPython is a restricted execution environment for Python to run untrusted code. Python's "format" functionality allows someone cont CVE-2023-41045.5An invalid Polkit Authentication check and missing authentication requirements for D-Bus methods allowed any local user to configure arbitra CVE-2023-410406.5GitPython is a python library used to interact with Git repositories. In order to resolve some git references, GitPython reads files from th CVE-2023-410413.1Graylog is a free and open log management platform. In a multi-node Graylog cluster, after a user has explicitly logged out, a user session CVE-2023-410426.5Discourse is an open-source discussion platform. Prior to version 3.1.1 of the `stable` branch and version 3.2.0.beta1 of the `beta` and `te CVE-2023-410436.5Discourse is an open-source discussion platform. Prior to version 3.1.1 of the `stable` branch and version 3.2.0.beta1 of the `beta` and `te CVE-2023-410443.8Graylog is a free and open log management platform. A partial path traversal vulnerability exists in Graylog's `Support Bundle` feature. The CVE-2023-410455.3Graylog is a free and open log management platform. Graylog makes use of only one single source port for DNS queries. Graylog binds a single CVE-2023-410466.3XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It is possible in XWiki to execute CVE-2023-410476.5OctoPrint is a web interface for 3D printers. OctoPrint versions up until and including 1.9.2 contain a vulnerability that allows malicious CVE-2023-410485.4plone.namedfile allows users to handle `File` and `Image` fields targeting, but not depending on, Plone Dexterity content. Prior to versions CVE-2023-410496.1@dcl/single-sign-on-client is an open source npm library which deals with single sign on authentication flows. Improper input validation in