Vulnerabilites related to unixodbc - unixodbc
Vulnerability from fkie_nvd
Published
2018-02-22 18:29
Modified
2024-11-21 04:12
Severity ?
9.8 (Critical) - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
In unixODBC before 2.3.5, there is a buffer overflow in the unicode_to_ansi_copy() function in DriverManager/__info.c.
References
cve@mitre.orghttp://www.unixodbc.org/unixODBC-2.3.5.tar.gzProduct
cve@mitre.orghttps://access.redhat.com/errata/RHSA-2019:2336
cve@mitre.orghttps://sourceforge.net/projects/unixodbc/files/unixODBC/2.3.5/ChangeLog/downloadRelease Notes
af854a3a-2127-422b-91ae-364da2661108http://www.unixodbc.org/unixODBC-2.3.5.tar.gzProduct
af854a3a-2127-422b-91ae-364da2661108https://access.redhat.com/errata/RHSA-2019:2336
af854a3a-2127-422b-91ae-364da2661108https://sourceforge.net/projects/unixodbc/files/unixODBC/2.3.5/ChangeLog/downloadRelease Notes
Impacted products
Vendor Product Version
unixodbc unixodbc *


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:unixodbc:unixodbc:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "BEEAA6DF-63A6-4884-8EF1-D6DFF4175EAC",
                     versionEndExcluding: "2.3.5",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "In unixODBC before 2.3.5, there is a buffer overflow in the unicode_to_ansi_copy() function in DriverManager/__info.c.",
      },
      {
         lang: "es",
         value: "En unixODBC, en versiones anteriores a la 2.3.5, hay un desbordamiento de búfer en la función unicode_to_ansi_copy() en DriverManager/__info.c.",
      },
   ],
   id: "CVE-2018-7409",
   lastModified: "2024-11-21T04:12:05.640",
   metrics: {
      cvssMetricV2: [
         {
            acInsufInfo: false,
            baseSeverity: "HIGH",
            cvssData: {
               accessComplexity: "LOW",
               accessVector: "NETWORK",
               authentication: "NONE",
               availabilityImpact: "PARTIAL",
               baseScore: 7.5,
               confidentialityImpact: "PARTIAL",
               integrityImpact: "PARTIAL",
               vectorString: "AV:N/AC:L/Au:N/C:P/I:P/A:P",
               version: "2.0",
            },
            exploitabilityScore: 10,
            impactScore: 6.4,
            obtainAllPrivilege: false,
            obtainOtherPrivilege: false,
            obtainUserPrivilege: false,
            source: "nvd@nist.gov",
            type: "Primary",
            userInteractionRequired: false,
         },
      ],
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "HIGH",
               baseScore: 9.8,
               baseSeverity: "CRITICAL",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "NONE",
               vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
               version: "3.0",
            },
            exploitabilityScore: 3.9,
            impactScore: 5.9,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2018-02-22T18:29:00.317",
   references: [
      {
         source: "cve@mitre.org",
         tags: [
            "Product",
         ],
         url: "http://www.unixodbc.org/unixODBC-2.3.5.tar.gz",
      },
      {
         source: "cve@mitre.org",
         url: "https://access.redhat.com/errata/RHSA-2019:2336",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Release Notes",
         ],
         url: "https://sourceforge.net/projects/unixodbc/files/unixODBC/2.3.5/ChangeLog/download",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Product",
         ],
         url: "http://www.unixodbc.org/unixODBC-2.3.5.tar.gz",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://access.redhat.com/errata/RHSA-2019:2336",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Release Notes",
         ],
         url: "https://sourceforge.net/projects/unixodbc/files/unixODBC/2.3.5/ChangeLog/download",
      },
   ],
   sourceIdentifier: "cve@mitre.org",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-119",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2018-02-26 14:29
Modified
2024-11-21 04:12
Severity ?
9.8 (Critical) - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
The SQLWriteFileDSN function in odbcinst/SQLWriteFileDSN.c in unixODBC 2.3.5 has strncpy arguments in the wrong order, which allows attackers to cause a denial of service or possibly have unspecified other impact.
References
cve@mitre.orghttp://www.securityfocus.com/bid/103193Third Party Advisory, VDB Entry
cve@mitre.orghttps://access.redhat.com/errata/RHSA-2019:2336
cve@mitre.orghttps://github.com/lurcher/unixODBC/commit/45ef78e037f578b15fc58938a3a3251655e71d6f#diff-d52750c7ba4e594410438569d8e2963aL24Patch
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/103193Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://access.redhat.com/errata/RHSA-2019:2336
af854a3a-2127-422b-91ae-364da2661108https://github.com/lurcher/unixODBC/commit/45ef78e037f578b15fc58938a3a3251655e71d6f#diff-d52750c7ba4e594410438569d8e2963aL24Patch
Impacted products
Vendor Product Version
unixodbc unixodbc 2.3.5


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:unixodbc:unixodbc:2.3.5:*:*:*:*:*:*:*",
                     matchCriteriaId: "AC9BC779-8677-451D-AC52-666C9DD623AE",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "The SQLWriteFileDSN function in odbcinst/SQLWriteFileDSN.c in unixODBC 2.3.5 has strncpy arguments in the wrong order, which allows attackers to cause a denial of service or possibly have unspecified other impact.",
      },
      {
         lang: "es",
         value: "La función SQLWriteFileDSN en odbcinst/SQLWriteFileDSN.c en unixODBC 2.3.5 tiene argumentos strncpy en el orden equivocado. Esto permite que atacantes provoquen una denegación de servicio (DoS) u otro tipo de impacto sin especificar.",
      },
   ],
   id: "CVE-2018-7485",
   lastModified: "2024-11-21T04:12:13.240",
   metrics: {
      cvssMetricV2: [
         {
            acInsufInfo: false,
            baseSeverity: "HIGH",
            cvssData: {
               accessComplexity: "LOW",
               accessVector: "NETWORK",
               authentication: "NONE",
               availabilityImpact: "PARTIAL",
               baseScore: 7.5,
               confidentialityImpact: "PARTIAL",
               integrityImpact: "PARTIAL",
               vectorString: "AV:N/AC:L/Au:N/C:P/I:P/A:P",
               version: "2.0",
            },
            exploitabilityScore: 10,
            impactScore: 6.4,
            obtainAllPrivilege: false,
            obtainOtherPrivilege: false,
            obtainUserPrivilege: false,
            source: "nvd@nist.gov",
            type: "Primary",
            userInteractionRequired: false,
         },
      ],
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "HIGH",
               baseScore: 9.8,
               baseSeverity: "CRITICAL",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "NONE",
               vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
               version: "3.0",
            },
            exploitabilityScore: 3.9,
            impactScore: 5.9,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2018-02-26T14:29:00.383",
   references: [
      {
         source: "cve@mitre.org",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "http://www.securityfocus.com/bid/103193",
      },
      {
         source: "cve@mitre.org",
         url: "https://access.redhat.com/errata/RHSA-2019:2336",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Patch",
         ],
         url: "https://github.com/lurcher/unixODBC/commit/45ef78e037f578b15fc58938a3a3251655e71d6f#diff-d52750c7ba4e594410438569d8e2963aL24",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "http://www.securityfocus.com/bid/103193",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://access.redhat.com/errata/RHSA-2019:2336",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Patch",
         ],
         url: "https://github.com/lurcher/unixODBC/commit/45ef78e037f578b15fc58938a3a3251655e71d6f#diff-d52750c7ba4e594410438569d8e2963aL24",
      },
   ],
   sourceIdentifier: "cve@mitre.org",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-119",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2012-08-31 18:55
Modified
2024-11-21 01:39
Severity ?
Summary
Buffer overflow in the SQLDriverConnect function in unixODBC 2.3.1 allows local users to cause a denial of service (crash) via a long string in the DRIVER option. NOTE: this issue might not be a vulnerability, since the ability to set this option typically implies that the attacker already has legitimate access to cause a DoS or execute code, and therefore the issue would not cross privilege boundaries. There may be limited attack scenarios if isql command-line options are exposed to an attacker, although it seems likely that other, more serious issues would also be exposed, and this issue might not cross privilege boundaries in that context.
References
secalert@redhat.comhttp://www.openwall.com/lists/oss-security/2012/05/29/10
secalert@redhat.comhttp://www.openwall.com/lists/oss-security/2012/05/29/7
secalert@redhat.comhttp://www.openwall.com/lists/oss-security/2012/05/30/7
secalert@redhat.comhttp://www.openwall.com/lists/oss-security/2012/05/31/2
secalert@redhat.comhttp://www.openwall.com/lists/oss-security/2012/06/06/3
secalert@redhat.comhttp://www.osvdb.org/82460
secalert@redhat.comhttp://www.securityfocus.com/bid/53712
secalert@redhat.comhttps://exchange.xforce.ibmcloud.com/vulnerabilities/75940
af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2012/05/29/10
af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2012/05/29/7
af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2012/05/30/7
af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2012/05/31/2
af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2012/06/06/3
af854a3a-2127-422b-91ae-364da2661108http://www.osvdb.org/82460
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/53712
af854a3a-2127-422b-91ae-364da2661108https://exchange.xforce.ibmcloud.com/vulnerabilities/75940
Impacted products
Vendor Product Version
unixodbc unixodbc 2.3.1


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:unixodbc:unixodbc:2.3.1:*:*:*:*:*:*:*",
                     matchCriteriaId: "4F534A85-7BFF-43BB-8CC1-F7D197AD2343",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [
      {
         sourceIdentifier: "secalert@redhat.com",
         tags: [
            "disputed",
         ],
      },
   ],
   descriptions: [
      {
         lang: "en",
         value: "Buffer overflow in the SQLDriverConnect function in unixODBC 2.3.1 allows local users to cause a denial of service (crash) via a long string in the DRIVER option. NOTE: this issue might not be a vulnerability, since the ability to set this option typically implies that the attacker already has legitimate access to cause a DoS or execute code, and therefore the issue would not cross privilege boundaries. There may be limited attack scenarios if isql command-line options are exposed to an attacker, although it seems likely that other, more serious issues would also be exposed, and this issue might not cross privilege boundaries in that context.",
      },
      {
         lang: "es",
         value: "** EN DISPUTA ** Desbordamiento de búfer en la función SQLDriverConnect en unixODBC v2.3.1 permite a usuarios locales provocar una denegación de servicio (caída de la aplicación) a través de una cadena larga en la opción 'DRIVER'. NOTA: este problema  puede no ser una vulnerabilidad, ya que la capacidad de establecer esta opción suele implicar que el atacante ya tiene acceso legítimo para causar una denegación de servicio o ejecutar código, y por lo tanto el problema no sería con los privilegios. Puede haber escenarios limitados de ataque si las opciones de la línea de comandos isql están expuestos a un atacante, aunque parece probable que otros asuntos más graves también se verían expuestos, y este problema no puede cruzar los límites de privilegio en ese contexto.\r\n",
      },
   ],
   id: "CVE-2012-2658",
   lastModified: "2024-11-21T01:39:23.420",
   metrics: {
      cvssMetricV2: [
         {
            acInsufInfo: false,
            baseSeverity: "LOW",
            cvssData: {
               accessComplexity: "LOW",
               accessVector: "LOCAL",
               authentication: "NONE",
               availabilityImpact: "PARTIAL",
               baseScore: 2.1,
               confidentialityImpact: "NONE",
               integrityImpact: "NONE",
               vectorString: "AV:L/AC:L/Au:N/C:N/I:N/A:P",
               version: "2.0",
            },
            exploitabilityScore: 3.9,
            impactScore: 2.9,
            obtainAllPrivilege: false,
            obtainOtherPrivilege: false,
            obtainUserPrivilege: false,
            source: "nvd@nist.gov",
            type: "Primary",
            userInteractionRequired: false,
         },
      ],
   },
   published: "2012-08-31T18:55:01.137",
   references: [
      {
         source: "secalert@redhat.com",
         url: "http://www.openwall.com/lists/oss-security/2012/05/29/10",
      },
      {
         source: "secalert@redhat.com",
         url: "http://www.openwall.com/lists/oss-security/2012/05/29/7",
      },
      {
         source: "secalert@redhat.com",
         url: "http://www.openwall.com/lists/oss-security/2012/05/30/7",
      },
      {
         source: "secalert@redhat.com",
         url: "http://www.openwall.com/lists/oss-security/2012/05/31/2",
      },
      {
         source: "secalert@redhat.com",
         url: "http://www.openwall.com/lists/oss-security/2012/06/06/3",
      },
      {
         source: "secalert@redhat.com",
         url: "http://www.osvdb.org/82460",
      },
      {
         source: "secalert@redhat.com",
         url: "http://www.securityfocus.com/bid/53712",
      },
      {
         source: "secalert@redhat.com",
         url: "https://exchange.xforce.ibmcloud.com/vulnerabilities/75940",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://www.openwall.com/lists/oss-security/2012/05/29/10",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://www.openwall.com/lists/oss-security/2012/05/29/7",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://www.openwall.com/lists/oss-security/2012/05/30/7",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://www.openwall.com/lists/oss-security/2012/05/31/2",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://www.openwall.com/lists/oss-security/2012/06/06/3",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://www.osvdb.org/82460",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://www.securityfocus.com/bid/53712",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://exchange.xforce.ibmcloud.com/vulnerabilities/75940",
      },
   ],
   sourceIdentifier: "secalert@redhat.com",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-119",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2019-11-14 02:15
Modified
2024-11-21 01:25
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
The SQLDriverConnect() function in unixODBC before 2.2.14p2 have a possible buffer overflow condition when specifying a large value for SAVEFILE parameter in the connection string.
References
secalert@redhat.comhttps://access.redhat.com/security/cve/cve-2011-1145Third Party Advisory
secalert@redhat.comhttps://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-1145Issue Tracking, Third Party Advisory
secalert@redhat.comhttps://bugzilla.suse.com/show_bug.cgi?id=CVE-2011-1145Issue Tracking, Third Party Advisory
secalert@redhat.comhttps://security-tracker.debian.org/tracker/CVE-2011-1145Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://access.redhat.com/security/cve/cve-2011-1145Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-1145Issue Tracking, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://bugzilla.suse.com/show_bug.cgi?id=CVE-2011-1145Issue Tracking, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://security-tracker.debian.org/tracker/CVE-2011-1145Third Party Advisory
Impacted products
Vendor Product Version
unixodbc unixodbc *
debian debian_linux 8.0
debian debian_linux 9.0
debian debian_linux 10.0
opensuse opensuse 11.3
opensuse opensuse 11.4
redhat enterprise_linux 4.0
redhat enterprise_linux 5.0
redhat enterprise_linux 6.0


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:unixodbc:unixodbc:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "AC3FD1A2-06D7-41C9-8B81-6672D3C77B20",
                     versionEndIncluding: "2.2.14",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "DEECE5FC-CACF-4496-A3E7-164736409252",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "07B237A9-69A3-4A9C-9DA0-4E06BD37AE73",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:o:opensuse:opensuse:11.3:*:*:*:*:*:*:*",
                     matchCriteriaId: "5646FDE9-CF21-46A9-B89D-F5BBDB4249AF",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:o:opensuse:opensuse:11.4:*:*:*:*:*:*:*",
                     matchCriteriaId: "DE554781-1EB9-446E-911F-6C11970C47F4",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:o:redhat:enterprise_linux:4.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "6172AF57-B26D-45F8-BE3A-F75ABDF28F49",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:o:redhat:enterprise_linux:5.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "1D8B549B-E57B-4DFE-8A13-CAB06B5356B3",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "2F6AB192-9D7D-4A9A-8995-E53A9DE9EAFC",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "The SQLDriverConnect() function in unixODBC before 2.2.14p2 have a possible buffer overflow condition when specifying a large value for SAVEFILE parameter in the connection string.",
      },
      {
         lang: "es",
         value: "La función SQLDriverConnect() en unixODBC versiones anterior a la versión 2.2.14p2, tiene una posible condición de desbordamiento del búfer cuando se especifica valor grande para el parámetro SAVEFILE en la cadena de conexión.",
      },
   ],
   id: "CVE-2011-1145",
   lastModified: "2024-11-21T01:25:39.533",
   metrics: {
      cvssMetricV2: [
         {
            acInsufInfo: false,
            baseSeverity: "MEDIUM",
            cvssData: {
               accessComplexity: "LOW",
               accessVector: "LOCAL",
               authentication: "NONE",
               availabilityImpact: "PARTIAL",
               baseScore: 4.6,
               confidentialityImpact: "PARTIAL",
               integrityImpact: "PARTIAL",
               vectorString: "AV:L/AC:L/Au:N/C:P/I:P/A:P",
               version: "2.0",
            },
            exploitabilityScore: 3.9,
            impactScore: 6.4,
            obtainAllPrivilege: false,
            obtainOtherPrivilege: false,
            obtainUserPrivilege: false,
            source: "nvd@nist.gov",
            type: "Primary",
            userInteractionRequired: false,
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "HIGH",
               baseScore: 7.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "LOW",
               scope: "UNCHANGED",
               userInteraction: "NONE",
               vectorString: "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
               version: "3.1",
            },
            exploitabilityScore: 1.8,
            impactScore: 5.9,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2019-11-14T02:15:10.657",
   references: [
      {
         source: "secalert@redhat.com",
         tags: [
            "Third Party Advisory",
         ],
         url: "https://access.redhat.com/security/cve/cve-2011-1145",
      },
      {
         source: "secalert@redhat.com",
         tags: [
            "Issue Tracking",
            "Third Party Advisory",
         ],
         url: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-1145",
      },
      {
         source: "secalert@redhat.com",
         tags: [
            "Issue Tracking",
            "Third Party Advisory",
         ],
         url: "https://bugzilla.suse.com/show_bug.cgi?id=CVE-2011-1145",
      },
      {
         source: "secalert@redhat.com",
         tags: [
            "Third Party Advisory",
         ],
         url: "https://security-tracker.debian.org/tracker/CVE-2011-1145",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
         ],
         url: "https://access.redhat.com/security/cve/cve-2011-1145",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Issue Tracking",
            "Third Party Advisory",
         ],
         url: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-1145",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Issue Tracking",
            "Third Party Advisory",
         ],
         url: "https://bugzilla.suse.com/show_bug.cgi?id=CVE-2011-1145",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
         ],
         url: "https://security-tracker.debian.org/tracker/CVE-2011-1145",
      },
   ],
   sourceIdentifier: "secalert@redhat.com",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-120",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2012-08-31 18:55
Modified
2024-11-21 01:39
Severity ?
Summary
Buffer overflow in the SQLDriverConnect function in unixODBC 2.0.10, 2.3.1, and earlier allows local users to cause a denial of service (crash) via a long string in the FILEDSN option. NOTE: this issue might not be a vulnerability, since the ability to set this option typically implies that the attacker already has legitimate access to cause a DoS or execute code, and therefore the issue would not cross privilege boundaries. There may be limited attack scenarios if isql command-line options are exposed to an attacker, although it seems likely that other, more serious issues would also be exposed, and this issue might not cross privilege boundaries in that context.
References
secalert@redhat.comhttp://www.openwall.com/lists/oss-security/2012/05/29/10
secalert@redhat.comhttp://www.openwall.com/lists/oss-security/2012/05/29/7
secalert@redhat.comhttp://www.openwall.com/lists/oss-security/2012/05/30/7
secalert@redhat.comhttp://www.openwall.com/lists/oss-security/2012/05/31/2
secalert@redhat.comhttp://www.openwall.com/lists/oss-security/2012/06/06/3
secalert@redhat.comhttp://www.osvdb.org/82460
secalert@redhat.comhttp://www.securityfocus.com/bid/53712
secalert@redhat.comhttps://exchange.xforce.ibmcloud.com/vulnerabilities/75940
af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2012/05/29/10
af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2012/05/29/7
af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2012/05/30/7
af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2012/05/31/2
af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2012/06/06/3
af854a3a-2127-422b-91ae-364da2661108http://www.osvdb.org/82460
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/53712
af854a3a-2127-422b-91ae-364da2661108https://exchange.xforce.ibmcloud.com/vulnerabilities/75940
Impacted products
Vendor Product Version
unixodbc unixodbc *
unixodbc unixodbc 2.0.10
unixodbc unixodbc 2.3.0


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:unixodbc:unixodbc:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "D9AF21C8-80BE-45A9-B033-1FF206059458",
                     versionEndIncluding: "2.3.1",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:unixodbc:unixodbc:2.0.10:*:*:*:*:*:*:*",
                     matchCriteriaId: "53E54259-66C8-48FD-8F07-B67B066B5245",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:unixodbc:unixodbc:2.3.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "79F0ED4D-F042-4E60-BA0F-24E323294C1E",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [
      {
         sourceIdentifier: "secalert@redhat.com",
         tags: [
            "disputed",
         ],
      },
   ],
   descriptions: [
      {
         lang: "en",
         value: "Buffer overflow in the SQLDriverConnect function in unixODBC 2.0.10, 2.3.1, and earlier allows local users to cause a denial of service (crash) via a long string in the FILEDSN option. NOTE: this issue might not be a vulnerability, since the ability to set this option typically implies that the attacker already has legitimate access to cause a DoS or execute code, and therefore the issue would not cross privilege boundaries. There may be limited attack scenarios if isql command-line options are exposed to an attacker, although it seems likely that other, more serious issues would also be exposed, and this issue might not cross privilege boundaries in that context.",
      },
      {
         lang: "es",
         value: "** EN DISPUTA ** Desbordamiento de búfer en la función SQLDriverConnect en unixODBC v2.0.10, v2.3.1 y anteriores permite a usuarios locales provocar una denegación de servicio (caída de la aplicación) a través de una cadena larga en la opción FILEDSN. NOTA: este problema puede no ser una vulnerabilidad, ya que la capacidad de establecer esta opción suele implicar que el atacante ya tiene acceso legítimo para causar una denegación de servicio o ejecutar código, y por lo tanto el problema sería de  privilegios. Puede haber escenarios limitados de ataque si las opciones de la línea de comandos isql están expuestas a un atacante, aunque parece probable que otros asuntos más graves también se verían expuestos, y este problema podría no cruzar los límites de privilegio en ese contexto.\r\n",
      },
   ],
   id: "CVE-2012-2657",
   lastModified: "2024-11-21T01:39:23.093",
   metrics: {
      cvssMetricV2: [
         {
            acInsufInfo: false,
            baseSeverity: "LOW",
            cvssData: {
               accessComplexity: "LOW",
               accessVector: "LOCAL",
               authentication: "NONE",
               availabilityImpact: "PARTIAL",
               baseScore: 2.1,
               confidentialityImpact: "NONE",
               integrityImpact: "NONE",
               vectorString: "AV:L/AC:L/Au:N/C:N/I:N/A:P",
               version: "2.0",
            },
            exploitabilityScore: 3.9,
            impactScore: 2.9,
            obtainAllPrivilege: false,
            obtainOtherPrivilege: false,
            obtainUserPrivilege: false,
            source: "nvd@nist.gov",
            type: "Primary",
            userInteractionRequired: false,
         },
      ],
   },
   published: "2012-08-31T18:55:00.980",
   references: [
      {
         source: "secalert@redhat.com",
         url: "http://www.openwall.com/lists/oss-security/2012/05/29/10",
      },
      {
         source: "secalert@redhat.com",
         url: "http://www.openwall.com/lists/oss-security/2012/05/29/7",
      },
      {
         source: "secalert@redhat.com",
         url: "http://www.openwall.com/lists/oss-security/2012/05/30/7",
      },
      {
         source: "secalert@redhat.com",
         url: "http://www.openwall.com/lists/oss-security/2012/05/31/2",
      },
      {
         source: "secalert@redhat.com",
         url: "http://www.openwall.com/lists/oss-security/2012/06/06/3",
      },
      {
         source: "secalert@redhat.com",
         url: "http://www.osvdb.org/82460",
      },
      {
         source: "secalert@redhat.com",
         url: "http://www.securityfocus.com/bid/53712",
      },
      {
         source: "secalert@redhat.com",
         url: "https://exchange.xforce.ibmcloud.com/vulnerabilities/75940",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://www.openwall.com/lists/oss-security/2012/05/29/10",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://www.openwall.com/lists/oss-security/2012/05/29/7",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://www.openwall.com/lists/oss-security/2012/05/30/7",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://www.openwall.com/lists/oss-security/2012/05/31/2",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://www.openwall.com/lists/oss-security/2012/06/06/3",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://www.osvdb.org/82460",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://www.securityfocus.com/bid/53712",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://exchange.xforce.ibmcloud.com/vulnerabilities/75940",
      },
   ],
   sourceIdentifier: "secalert@redhat.com",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-119",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

cve-2018-7409
Vulnerability from cvelistv5
Published
2018-02-22 18:00
Modified
2024-08-05 06:24
Severity ?
Summary
In unixODBC before 2.3.5, there is a buffer overflow in the unicode_to_ansi_copy() function in DriverManager/__info.c.
References
http://www.unixodbc.org/unixODBC-2.3.5.tar.gzx_refsource_MISC
https://sourceforge.net/projects/unixodbc/files/unixODBC/2.3.5/ChangeLog/downloadx_refsource_MISC
https://access.redhat.com/errata/RHSA-2019:2336vendor-advisory, x_refsource_REDHAT
Impacted products
Vendor Product Version
n/a n/a Version: n/a
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-05T06:24:11.943Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "http://www.unixodbc.org/unixODBC-2.3.5.tar.gz",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://sourceforge.net/projects/unixodbc/files/unixODBC/2.3.5/ChangeLog/download",
               },
               {
                  name: "RHSA-2019:2336",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2019:2336",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "n/a",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "n/a",
                  },
               ],
            },
         ],
         datePublic: "2018-02-22T00:00:00",
         descriptions: [
            {
               lang: "en",
               value: "In unixODBC before 2.3.5, there is a buffer overflow in the unicode_to_ansi_copy() function in DriverManager/__info.c.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "n/a",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2019-08-06T14:06:12",
            orgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
            shortName: "mitre",
         },
         references: [
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "http://www.unixodbc.org/unixODBC-2.3.5.tar.gz",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://sourceforge.net/projects/unixodbc/files/unixODBC/2.3.5/ChangeLog/download",
            },
            {
               name: "RHSA-2019:2336",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2019:2336",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "cve@mitre.org",
               ID: "CVE-2018-7409",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "n/a",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "n/a",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "n/a",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "In unixODBC before 2.3.5, there is a buffer overflow in the unicode_to_ansi_copy() function in DriverManager/__info.c.",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "n/a",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "http://www.unixodbc.org/unixODBC-2.3.5.tar.gz",
                     refsource: "MISC",
                     url: "http://www.unixodbc.org/unixODBC-2.3.5.tar.gz",
                  },
                  {
                     name: "https://sourceforge.net/projects/unixodbc/files/unixODBC/2.3.5/ChangeLog/download",
                     refsource: "MISC",
                     url: "https://sourceforge.net/projects/unixodbc/files/unixODBC/2.3.5/ChangeLog/download",
                  },
                  {
                     name: "RHSA-2019:2336",
                     refsource: "REDHAT",
                     url: "https://access.redhat.com/errata/RHSA-2019:2336",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
      assignerShortName: "mitre",
      cveId: "CVE-2018-7409",
      datePublished: "2018-02-22T18:00:00",
      dateReserved: "2018-02-22T00:00:00",
      dateUpdated: "2024-08-05T06:24:11.943Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2012-2658
Vulnerability from cvelistv5
Published
2012-08-31 00:00
Modified
2024-08-06 19:42
Severity ?
Summary
Buffer overflow in the SQLDriverConnect function in unixODBC 2.3.1 allows local users to cause a denial of service (crash) via a long string in the DRIVER option. NOTE: this issue might not be a vulnerability, since the ability to set this option typically implies that the attacker already has legitimate access to cause a DoS or execute code, and therefore the issue would not cross privilege boundaries. There may be limited attack scenarios if isql command-line options are exposed to an attacker, although it seems likely that other, more serious issues would also be exposed, and this issue might not cross privilege boundaries in that context.
References
http://www.osvdb.org/82460vdb-entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/75940vdb-entry
http://www.openwall.com/lists/oss-security/2012/06/06/3mailing-list
http://www.openwall.com/lists/oss-security/2012/05/30/7mailing-list
http://www.openwall.com/lists/oss-security/2012/05/31/2mailing-list
http://www.securityfocus.com/bid/53712vdb-entry
http://www.openwall.com/lists/oss-security/2012/05/29/10mailing-list
http://www.openwall.com/lists/oss-security/2012/05/29/7mailing-list
Impacted products
Vendor Product Version
n/a n/a Version: n/a
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-06T19:42:31.612Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  name: "82460",
                  tags: [
                     "vdb-entry",
                     "x_transferred",
                  ],
                  url: "http://www.osvdb.org/82460",
               },
               {
                  name: "unixodbc-sdc-bo(75940)",
                  tags: [
                     "vdb-entry",
                     "x_transferred",
                  ],
                  url: "https://exchange.xforce.ibmcloud.com/vulnerabilities/75940",
               },
               {
                  name: "[oss-security] 20120605 Re: CVE id request: Multiple buffer overflow in unixODBC",
                  tags: [
                     "mailing-list",
                     "x_transferred",
                  ],
                  url: "http://www.openwall.com/lists/oss-security/2012/06/06/3",
               },
               {
                  name: "[oss-security] 20120530 Re: CVE id request: Multiple buffer overflow in unixODBC",
                  tags: [
                     "mailing-list",
                     "x_transferred",
                  ],
                  url: "http://www.openwall.com/lists/oss-security/2012/05/30/7",
               },
               {
                  name: "[oss-security] 20120531 Re: CVE id request: Multiple buffer overflow in unixODBC",
                  tags: [
                     "mailing-list",
                     "x_transferred",
                  ],
                  url: "http://www.openwall.com/lists/oss-security/2012/05/31/2",
               },
               {
                  name: "53712",
                  tags: [
                     "vdb-entry",
                     "x_transferred",
                  ],
                  url: "http://www.securityfocus.com/bid/53712",
               },
               {
                  name: "[oss-security] 20120529 Re: CVE id request: Multiple buffer overflow in unixODBC",
                  tags: [
                     "mailing-list",
                     "x_transferred",
                  ],
                  url: "http://www.openwall.com/lists/oss-security/2012/05/29/10",
               },
               {
                  name: "[oss-security] 20120529 CVE id request: Multiple buffer overflow in unixODBC",
                  tags: [
                     "mailing-list",
                     "x_transferred",
                  ],
                  url: "http://www.openwall.com/lists/oss-security/2012/05/29/7",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "n/a",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "n/a",
                  },
               ],
            },
         ],
         datePublic: "2012-05-29T00:00:00",
         descriptions: [
            {
               lang: "en",
               value: "Buffer overflow in the SQLDriverConnect function in unixODBC 2.3.1 allows local users to cause a denial of service (crash) via a long string in the DRIVER option. NOTE: this issue might not be a vulnerability, since the ability to set this option typically implies that the attacker already has legitimate access to cause a DoS or execute code, and therefore the issue would not cross privilege boundaries. There may be limited attack scenarios if isql command-line options are exposed to an attacker, although it seems likely that other, more serious issues would also be exposed, and this issue might not cross privilege boundaries in that context.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "n/a",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-02-12T00:00:00",
            orgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
            shortName: "redhat",
         },
         references: [
            {
               name: "82460",
               tags: [
                  "vdb-entry",
               ],
               url: "http://www.osvdb.org/82460",
            },
            {
               name: "unixodbc-sdc-bo(75940)",
               tags: [
                  "vdb-entry",
               ],
               url: "https://exchange.xforce.ibmcloud.com/vulnerabilities/75940",
            },
            {
               name: "[oss-security] 20120605 Re: CVE id request: Multiple buffer overflow in unixODBC",
               tags: [
                  "mailing-list",
               ],
               url: "http://www.openwall.com/lists/oss-security/2012/06/06/3",
            },
            {
               name: "[oss-security] 20120530 Re: CVE id request: Multiple buffer overflow in unixODBC",
               tags: [
                  "mailing-list",
               ],
               url: "http://www.openwall.com/lists/oss-security/2012/05/30/7",
            },
            {
               name: "[oss-security] 20120531 Re: CVE id request: Multiple buffer overflow in unixODBC",
               tags: [
                  "mailing-list",
               ],
               url: "http://www.openwall.com/lists/oss-security/2012/05/31/2",
            },
            {
               name: "53712",
               tags: [
                  "vdb-entry",
               ],
               url: "http://www.securityfocus.com/bid/53712",
            },
            {
               name: "[oss-security] 20120529 Re: CVE id request: Multiple buffer overflow in unixODBC",
               tags: [
                  "mailing-list",
               ],
               url: "http://www.openwall.com/lists/oss-security/2012/05/29/10",
            },
            {
               name: "[oss-security] 20120529 CVE id request: Multiple buffer overflow in unixODBC",
               tags: [
                  "mailing-list",
               ],
               url: "http://www.openwall.com/lists/oss-security/2012/05/29/7",
            },
         ],
         tags: [
            "disputed",
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
      assignerShortName: "redhat",
      cveId: "CVE-2012-2658",
      datePublished: "2012-08-31T00:00:00",
      dateReserved: "2012-05-14T00:00:00",
      dateUpdated: "2024-08-06T19:42:31.612Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2012-2657
Vulnerability from cvelistv5
Published
2012-08-31 00:00
Modified
2024-08-06 19:42
Severity ?
Summary
Buffer overflow in the SQLDriverConnect function in unixODBC 2.0.10, 2.3.1, and earlier allows local users to cause a denial of service (crash) via a long string in the FILEDSN option. NOTE: this issue might not be a vulnerability, since the ability to set this option typically implies that the attacker already has legitimate access to cause a DoS or execute code, and therefore the issue would not cross privilege boundaries. There may be limited attack scenarios if isql command-line options are exposed to an attacker, although it seems likely that other, more serious issues would also be exposed, and this issue might not cross privilege boundaries in that context.
References
http://www.osvdb.org/82460vdb-entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/75940vdb-entry
http://www.openwall.com/lists/oss-security/2012/06/06/3mailing-list
http://www.openwall.com/lists/oss-security/2012/05/30/7mailing-list
http://www.openwall.com/lists/oss-security/2012/05/31/2mailing-list
http://www.securityfocus.com/bid/53712vdb-entry
http://www.openwall.com/lists/oss-security/2012/05/29/10mailing-list
http://www.openwall.com/lists/oss-security/2012/05/29/7mailing-list
Impacted products
Vendor Product Version
n/a n/a Version: n/a
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2012-2657",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2024-06-26T19:00:40.470154Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2024-06-26T19:00:49.184Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
         {
            providerMetadata: {
               dateUpdated: "2024-08-06T19:42:32.111Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  name: "82460",
                  tags: [
                     "vdb-entry",
                     "x_transferred",
                  ],
                  url: "http://www.osvdb.org/82460",
               },
               {
                  name: "unixodbc-sdc-bo(75940)",
                  tags: [
                     "vdb-entry",
                     "x_transferred",
                  ],
                  url: "https://exchange.xforce.ibmcloud.com/vulnerabilities/75940",
               },
               {
                  name: "[oss-security] 20120605 Re: CVE id request: Multiple buffer overflow in unixODBC",
                  tags: [
                     "mailing-list",
                     "x_transferred",
                  ],
                  url: "http://www.openwall.com/lists/oss-security/2012/06/06/3",
               },
               {
                  name: "[oss-security] 20120530 Re: CVE id request: Multiple buffer overflow in unixODBC",
                  tags: [
                     "mailing-list",
                     "x_transferred",
                  ],
                  url: "http://www.openwall.com/lists/oss-security/2012/05/30/7",
               },
               {
                  name: "[oss-security] 20120531 Re: CVE id request: Multiple buffer overflow in unixODBC",
                  tags: [
                     "mailing-list",
                     "x_transferred",
                  ],
                  url: "http://www.openwall.com/lists/oss-security/2012/05/31/2",
               },
               {
                  name: "53712",
                  tags: [
                     "vdb-entry",
                     "x_transferred",
                  ],
                  url: "http://www.securityfocus.com/bid/53712",
               },
               {
                  name: "[oss-security] 20120529 Re: CVE id request: Multiple buffer overflow in unixODBC",
                  tags: [
                     "mailing-list",
                     "x_transferred",
                  ],
                  url: "http://www.openwall.com/lists/oss-security/2012/05/29/10",
               },
               {
                  name: "[oss-security] 20120529 CVE id request: Multiple buffer overflow in unixODBC",
                  tags: [
                     "mailing-list",
                     "x_transferred",
                  ],
                  url: "http://www.openwall.com/lists/oss-security/2012/05/29/7",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "n/a",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "n/a",
                  },
               ],
            },
         ],
         datePublic: "2012-05-29T00:00:00",
         descriptions: [
            {
               lang: "en",
               value: "Buffer overflow in the SQLDriverConnect function in unixODBC 2.0.10, 2.3.1, and earlier allows local users to cause a denial of service (crash) via a long string in the FILEDSN option. NOTE: this issue might not be a vulnerability, since the ability to set this option typically implies that the attacker already has legitimate access to cause a DoS or execute code, and therefore the issue would not cross privilege boundaries. There may be limited attack scenarios if isql command-line options are exposed to an attacker, although it seems likely that other, more serious issues would also be exposed, and this issue might not cross privilege boundaries in that context.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "n/a",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-02-12T00:00:00",
            orgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
            shortName: "redhat",
         },
         references: [
            {
               name: "82460",
               tags: [
                  "vdb-entry",
               ],
               url: "http://www.osvdb.org/82460",
            },
            {
               name: "unixodbc-sdc-bo(75940)",
               tags: [
                  "vdb-entry",
               ],
               url: "https://exchange.xforce.ibmcloud.com/vulnerabilities/75940",
            },
            {
               name: "[oss-security] 20120605 Re: CVE id request: Multiple buffer overflow in unixODBC",
               tags: [
                  "mailing-list",
               ],
               url: "http://www.openwall.com/lists/oss-security/2012/06/06/3",
            },
            {
               name: "[oss-security] 20120530 Re: CVE id request: Multiple buffer overflow in unixODBC",
               tags: [
                  "mailing-list",
               ],
               url: "http://www.openwall.com/lists/oss-security/2012/05/30/7",
            },
            {
               name: "[oss-security] 20120531 Re: CVE id request: Multiple buffer overflow in unixODBC",
               tags: [
                  "mailing-list",
               ],
               url: "http://www.openwall.com/lists/oss-security/2012/05/31/2",
            },
            {
               name: "53712",
               tags: [
                  "vdb-entry",
               ],
               url: "http://www.securityfocus.com/bid/53712",
            },
            {
               name: "[oss-security] 20120529 Re: CVE id request: Multiple buffer overflow in unixODBC",
               tags: [
                  "mailing-list",
               ],
               url: "http://www.openwall.com/lists/oss-security/2012/05/29/10",
            },
            {
               name: "[oss-security] 20120529 CVE id request: Multiple buffer overflow in unixODBC",
               tags: [
                  "mailing-list",
               ],
               url: "http://www.openwall.com/lists/oss-security/2012/05/29/7",
            },
         ],
         tags: [
            "disputed",
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
      assignerShortName: "redhat",
      cveId: "CVE-2012-2657",
      datePublished: "2012-08-31T00:00:00",
      dateReserved: "2012-05-14T00:00:00",
      dateUpdated: "2024-08-06T19:42:32.111Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2018-7485
Vulnerability from cvelistv5
Published
2018-02-26 14:00
Modified
2024-08-05 06:31
Severity ?
Summary
The SQLWriteFileDSN function in odbcinst/SQLWriteFileDSN.c in unixODBC 2.3.5 has strncpy arguments in the wrong order, which allows attackers to cause a denial of service or possibly have unspecified other impact.
References
https://github.com/lurcher/unixODBC/commit/45ef78e037f578b15fc58938a3a3251655e71d6f#diff-d52750c7ba4e594410438569d8e2963aL24x_refsource_MISC
http://www.securityfocus.com/bid/103193vdb-entry, x_refsource_BID
https://access.redhat.com/errata/RHSA-2019:2336vendor-advisory, x_refsource_REDHAT
Impacted products
Vendor Product Version
n/a n/a Version: n/a
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-05T06:31:03.541Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://github.com/lurcher/unixODBC/commit/45ef78e037f578b15fc58938a3a3251655e71d6f#diff-d52750c7ba4e594410438569d8e2963aL24",
               },
               {
                  name: "103193",
                  tags: [
                     "vdb-entry",
                     "x_refsource_BID",
                     "x_transferred",
                  ],
                  url: "http://www.securityfocus.com/bid/103193",
               },
               {
                  name: "RHSA-2019:2336",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2019:2336",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "n/a",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "n/a",
                  },
               ],
            },
         ],
         datePublic: "2018-02-26T00:00:00",
         descriptions: [
            {
               lang: "en",
               value: "The SQLWriteFileDSN function in odbcinst/SQLWriteFileDSN.c in unixODBC 2.3.5 has strncpy arguments in the wrong order, which allows attackers to cause a denial of service or possibly have unspecified other impact.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "n/a",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2019-08-06T14:06:12",
            orgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
            shortName: "mitre",
         },
         references: [
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://github.com/lurcher/unixODBC/commit/45ef78e037f578b15fc58938a3a3251655e71d6f#diff-d52750c7ba4e594410438569d8e2963aL24",
            },
            {
               name: "103193",
               tags: [
                  "vdb-entry",
                  "x_refsource_BID",
               ],
               url: "http://www.securityfocus.com/bid/103193",
            },
            {
               name: "RHSA-2019:2336",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2019:2336",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "cve@mitre.org",
               ID: "CVE-2018-7485",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "n/a",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "n/a",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "n/a",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "The SQLWriteFileDSN function in odbcinst/SQLWriteFileDSN.c in unixODBC 2.3.5 has strncpy arguments in the wrong order, which allows attackers to cause a denial of service or possibly have unspecified other impact.",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "n/a",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://github.com/lurcher/unixODBC/commit/45ef78e037f578b15fc58938a3a3251655e71d6f#diff-d52750c7ba4e594410438569d8e2963aL24",
                     refsource: "MISC",
                     url: "https://github.com/lurcher/unixODBC/commit/45ef78e037f578b15fc58938a3a3251655e71d6f#diff-d52750c7ba4e594410438569d8e2963aL24",
                  },
                  {
                     name: "103193",
                     refsource: "BID",
                     url: "http://www.securityfocus.com/bid/103193",
                  },
                  {
                     name: "RHSA-2019:2336",
                     refsource: "REDHAT",
                     url: "https://access.redhat.com/errata/RHSA-2019:2336",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
      assignerShortName: "mitre",
      cveId: "CVE-2018-7485",
      datePublished: "2018-02-26T14:00:00",
      dateReserved: "2018-02-26T00:00:00",
      dateUpdated: "2024-08-05T06:31:03.541Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2011-1145
Vulnerability from cvelistv5
Published
2019-11-14 01:01
Modified
2024-08-06 22:14
Severity ?
Summary
The SQLDriverConnect() function in unixODBC before 2.2.14p2 have a possible buffer overflow condition when specifying a large value for SAVEFILE parameter in the connection string.
References
https://security-tracker.debian.org/tracker/CVE-2011-1145x_refsource_MISC
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-1145x_refsource_MISC
https://bugzilla.suse.com/show_bug.cgi?id=CVE-2011-1145x_refsource_MISC
https://access.redhat.com/security/cve/cve-2011-1145x_refsource_MISC
Impacted products
Vendor Product Version
unixodbc unixodbc Version: before 2.2.14p2
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-06T22:14:27.892Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://security-tracker.debian.org/tracker/CVE-2011-1145",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-1145",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://bugzilla.suse.com/show_bug.cgi?id=CVE-2011-1145",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/security/cve/cve-2011-1145",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "unixodbc",
               vendor: "unixodbc",
               versions: [
                  {
                     status: "affected",
                     version: "before 2.2.14p2",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "The SQLDriverConnect() function in unixODBC before 2.2.14p2 have a possible buffer overflow condition when specifying a large value for SAVEFILE parameter in the connection string.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "Buffer Overflow",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2019-11-14T01:01:55",
            orgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
            shortName: "redhat",
         },
         references: [
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://security-tracker.debian.org/tracker/CVE-2011-1145",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-1145",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://bugzilla.suse.com/show_bug.cgi?id=CVE-2011-1145",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://access.redhat.com/security/cve/cve-2011-1145",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
      assignerShortName: "redhat",
      cveId: "CVE-2011-1145",
      datePublished: "2019-11-14T01:01:55",
      dateReserved: "2011-03-03T00:00:00",
      dateUpdated: "2024-08-06T22:14:27.892Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}