CVE-2025-54989

Firebird is a relational database. Prior to versions 3.0.13, 4.0.6, and 5.0.3, there is an XDR message parsing NULL pointer dereference denial-of-service vulnerability in Firebird. This specific flaw exists within the parsing of xdr message from client. It leads to NULL pointer dereference and DoS. This issue has been patched in versions 3.0.13, 4.0.6, and 5.0.3.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://github.com/FirebirdSQL/firebird/commit/169da595f8693fc1a65a79c741724b1bc8db9f25	Patch
https://github.com/FirebirdSQL/firebird/issues/8554	Issue Tracking
https://github.com/FirebirdSQL/firebird/security/advisories/GHSA-7qp6-hqxj-pjjp	Third Party Advisory
https://lists.debian.org/debian-lts-announce/2025/08/msg00021.html

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:firebirdsql:firebird::::::::
	cpe:2.3:a:firebirdsql:firebird::::::::
	cpe:2.3:a:firebirdsql:firebird::::::::

History

03 Nov 2025, 19:16

Type	Values Removed	Values Added
References		() https://lists.debian.org/debian-lts-announce/2025/08/msg00021.html -

Information

Published : 2025-08-15 15:15

Updated : 2025-11-03 19:16

NVD link : CVE-2025-54989

Mitre link : CVE-2025-54989

CVE.ORG link : CVE-2025-54989

JSON object : View

Products Affected

firebirdsql

firebird

CWE

CWE-476

NULL Pointer Dereference

{"id": "CVE-2025-54989", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.9}, {"type": "Primary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2025-08-15T15:15:32.597", "references": [{"url": "https://github.com/FirebirdSQL/firebird/commit/169da595f8693fc1a65a79c741724b1bc8db9f25", "tags": ["Patch"], "source": "[email protected]"}, {"url": "https://github.com/FirebirdSQL/firebird/issues/8554", "tags": ["Issue Tracking"], "source": "[email protected]"}, {"url": "https://github.com/FirebirdSQL/firebird/security/advisories/GHSA-7qp6-hqxj-pjjp", "tags": ["Third Party Advisory"], "source": "[email protected]"}, {"url": "https://lists.debian.org/debian-lts-announce/2025/08/msg00021.html", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-476"}]}], "descriptions": [{"lang": "en", "value": "Firebird is a relational database. Prior to versions 3.0.13, 4.0.6, and 5.0.3, there is an XDR message parsing NULL pointer dereference denial-of-service vulnerability in Firebird. This specific flaw exists within the parsing of xdr message from client. It leads to NULL pointer dereference and DoS. This issue has been patched in versions 3.0.13, 4.0.6, and 5.0.3."}, {"lang": "es", "value": "Firebird es una base de datos relacional. En versiones anteriores a la 3.0.13, 4.0.6 y 5.0.3, exist\u00eda una vulnerabilidad de denegaci\u00f3n de servicio relacionada con la desreferencia de punteros nulos al analizar mensajes XDR en Firebird. Esta falla espec\u00edfica se produce al analizar mensajes XDR del cliente. Provoca la desreferencia de punteros nulos y una denegaci\u00f3n de servicio (DoS). Este problema se ha corregido en las versiones 3.0.13, 4.0.6 y 5.0.3."}], "lastModified": "2025-11-03T19:16:11.913", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:firebirdsql:firebird:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4A13E766-40E2-465B-B161-E8399221EFF6", "versionEndExcluding": "3.0.13"}, {"criteria": "cpe:2.3:a:firebirdsql:firebird:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A077FF0A-B2BD-407F-8FAB-6B87824DBF56", "versionEndExcluding": "4.0.6", "versionStartIncluding": "4.0.0"}, {"criteria": "cpe:2.3:a:firebirdsql:firebird:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A3AC2221-B79F-4F79-B066-037D2A8425E6", "versionEndExcluding": "5.0.3", "versionStartIncluding": "5.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "[email protected]"}