{"id":"DEBIAN-CVE-2026-33337","details":"Firebird is an open-source relational database management system. In versions prior to 5.0.4, 4.0.7 and 3.0.14, when deserializing a slice packet, the xdr_datum() function does not validate that a cstring length conforms to the slice descriptor bounds, allowing a cstring longer than the allocated buffer to overflow it. An unauthenticated attacker can exploit this by sending a crafted packet to the server, potentially causing a crash or other security impact. This issue has been fixed in versions 5.0.4, 4.0.7 and 3.0.14.","modified":"2026-09-14T17:03:28.885695414Z","published":"2026-04-17T19:16:36.223Z","upstream":["CVE-2026-33337"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2026-33337"}],"affected":[{"package":{"name":"firebird3.0","ecosystem":"Debian:12","purl":"pkg:deb/debian/firebird3.0?arch=source&distro=bookworm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0.11.33637.ds4-2","3.0.11.33637.ds4-2+deb12u1","3.0.11.33637.ds4-2+m68k","3.0.11.33637.ds4-2+m68k.1","3.0.11.33703.ds4-1","3.0.11.33703.ds4-2","3.0.11.33703.ds4-3","3.0.11.33703.ds4-3+exp.0","3.0.11.33703.ds4-3+exp.1","3.0.11.33703.ds4-3+m68k","3.0.11.33703.ds4-4","3.0.11.33703.ds4-4+exp.0","3.0.11.33703.ds4-4+m68k","3.0.12.ds5-1","3.0.12.ds5-2","3.0.12.ds7-1","3.0.12.ds7-10","3.0.12.ds7-11","3.0.12.ds7-12","3.0.12.ds7-13","3.0.12.ds7-13+m68k","3.0.12.ds7-13+m68k.1","3.0.12.ds7-2","3.0.12.ds7-3","3.0.12.ds7-3+exp.0","3.0.12.ds7-5","3.0.12.ds7-5+exp1","3.0.12.ds7-6","3.0.12.ds7-7","3.0.12.ds7-7+exp1","3.0.12.ds7-8","3.0.12.ds7-9","3.0.13.ds7-1","3.0.13.ds7-2","3.0.14.ds7-1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-33337.json"}},{"package":{"name":"firebird3.0","ecosystem":"Debian:13","purl":"pkg:deb/debian/firebird3.0?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0.12.ds7-13","3.0.12.ds7-13+deb13u1","3.0.12.ds7-13+m68k","3.0.12.ds7-13+m68k.1","3.0.13.ds7-1","3.0.13.ds7-2","3.0.14.ds7-1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-33337.json"}},{"package":{"name":"firebird3.0","ecosystem":"Debian:14","purl":"pkg:deb/debian/firebird3.0?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.14.ds7-1"}]}],"versions":["3.0.12.ds7-13","3.0.12.ds7-13+m68k","3.0.12.ds7-13+m68k.1","3.0.13.ds7-1","3.0.13.ds7-2"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-33337.json"}},{"package":{"name":"firebird4.0","ecosystem":"Debian:13","purl":"pkg:deb/debian/firebird4.0?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.0.5.3140.ds6-17","4.0.5.3140.ds6-17+deb13u1","4.0.5.3140.ds6-17+m68k","4.0.6.3221.ds6-1","4.0.6.3221.ds6-2","4.0.7.3271.ds6-1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-33337.json"}},{"package":{"name":"firebird4.0","ecosystem":"Debian:14","purl":"pkg:deb/debian/firebird4.0?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.7.3271.ds6-1"}]}],"versions":["4.0.5.3140.ds6-17","4.0.5.3140.ds6-17+m68k","4.0.6.3221.ds6-1","4.0.6.3221.ds6-2"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-33337.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}