{"id":"DEBIAN-CVE-2026-34232","details":"Firebird is an open-source relational database management system. In versions prior to 5.0.4, 4.0.7 and 3.0.14, the xdr_status_vector() function does not handle the isc_arg_cstring type when decoding an op_response packet, causing a server crash when one is encountered in the status vector. An unauthenticated attacker can exploit this by sending a crafted op_response packet to the server. This issue has been fixed in versions 5.0.4, 4.0.7 and 3.0.14.","modified":"2026-09-14T17:03:08.807850412Z","published":"2026-04-17T20:16:34.977Z","upstream":["CVE-2026-34232"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2026-34232"}],"affected":[{"package":{"name":"firebird3.0","ecosystem":"Debian:12","purl":"pkg:deb/debian/firebird3.0?arch=source&distro=bookworm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0.11.33637.ds4-2","3.0.11.33637.ds4-2+deb12u1","3.0.11.33637.ds4-2+m68k","3.0.11.33637.ds4-2+m68k.1","3.0.11.33703.ds4-1","3.0.11.33703.ds4-2","3.0.11.33703.ds4-3","3.0.11.33703.ds4-3+exp.0","3.0.11.33703.ds4-3+exp.1","3.0.11.33703.ds4-3+m68k","3.0.11.33703.ds4-4","3.0.11.33703.ds4-4+exp.0","3.0.11.33703.ds4-4+m68k","3.0.12.ds5-1","3.0.12.ds5-2","3.0.12.ds7-1","3.0.12.ds7-10","3.0.12.ds7-11","3.0.12.ds7-12","3.0.12.ds7-13","3.0.12.ds7-13+m68k","3.0.12.ds7-13+m68k.1","3.0.12.ds7-2","3.0.12.ds7-3","3.0.12.ds7-3+exp.0","3.0.12.ds7-5","3.0.12.ds7-5+exp1","3.0.12.ds7-6","3.0.12.ds7-7","3.0.12.ds7-7+exp1","3.0.12.ds7-8","3.0.12.ds7-9","3.0.13.ds7-1","3.0.13.ds7-2","3.0.14.ds7-1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-34232.json"}},{"package":{"name":"firebird3.0","ecosystem":"Debian:13","purl":"pkg:deb/debian/firebird3.0?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0.12.ds7-13","3.0.12.ds7-13+deb13u1","3.0.12.ds7-13+m68k","3.0.12.ds7-13+m68k.1","3.0.13.ds7-1","3.0.13.ds7-2","3.0.14.ds7-1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-34232.json"}},{"package":{"name":"firebird3.0","ecosystem":"Debian:14","purl":"pkg:deb/debian/firebird3.0?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.14.ds7-1"}]}],"versions":["3.0.12.ds7-13","3.0.12.ds7-13+m68k","3.0.12.ds7-13+m68k.1","3.0.13.ds7-1","3.0.13.ds7-2"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-34232.json"}},{"package":{"name":"firebird4.0","ecosystem":"Debian:13","purl":"pkg:deb/debian/firebird4.0?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.0.5.3140.ds6-17","4.0.5.3140.ds6-17+deb13u1","4.0.5.3140.ds6-17+m68k","4.0.6.3221.ds6-1","4.0.6.3221.ds6-2","4.0.7.3271.ds6-1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-34232.json"}},{"package":{"name":"firebird4.0","ecosystem":"Debian:14","purl":"pkg:deb/debian/firebird4.0?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.7.3271.ds6-1"}]}],"versions":["4.0.5.3140.ds6-17","4.0.5.3140.ds6-17+m68k","4.0.6.3221.ds6-1","4.0.6.3221.ds6-2"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-34232.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}