CVE-2014-9323

The xdr_status_vector function in Firebird before 2.1.7 and 2.5.x before 2.5.3 SU1 allows remote...

5.0 MediumFix available

The xdr_status_vector function in Firebird before 2.1.7 and 2.5.x before 2.5.3 SU1 allows remote attackers to cause a denial of service (NULL pointer dereference, segmentation fault, and crash) via an op_response action with a non-empty status.

Exploit likelihood

2.90%Up 1.6 points since Feb 4, 2022

What each source reports

NVD Score used 5.0

Record: CVE-2014-9323
CVSS 2.0: 5.0 MediumAV:N/AC:L/Au:N/C:N/I:N/A:P
Weakness: CWE-476
Updated: 2026-11-02

CVE List No score

Record: CVE-2014-9323
Updated: 2026-11-02

EUVDEUVD-2014-9148 No score

Record: EUVD-2014-9148
Updated: 2026-11-02

GitHub AdvisoriesGHSA-2hhr-r74q-p8fq No score

The xdr_status_vector function in Firebird before 2.1.7 and 2.5.x before 2.5.3 SU1 allows remote...

Record: GHSA-2hhr-r74q-p8fq
Weakness: CWE-476
Updated: 2026-11-02

OSVUBUNTU-CVE-2014-9323 No score

Record: UBUNTU-CVE-2014-9323
Updated: 2026-11-02

OSVUSN-3929-1 No score

firebird2.5 vulnerabilities

It was discovered that Firebird incorrectly handled certain malformed packets. A remote attacker could possibly use this issue with a specially crafted network packet to cause Firebird to crash, resulting in a denial of service. (CVE-2014-9323)

It was discovered that Firebird incorrectly handled certain UDF libraries. A remote attacker could possibly use this issue to execute arbitrary code. (CVE-2017-6369)

Record: USN-3929-1
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`firebird2.5` Debian:6.0	before 2.5.0.26054~ReleaseCandidate3.ds2-1+squeeze2, plus listed versions 2.5.0.26054~ReleaseCandidate3.ds2-12.5.0.26054~ReleaseCandidate3.ds2-1+squeeze1	2.5.0.26054~ReleaseCandidate3.ds2-1+squeeze2
`firebird2.1` Debian:6.0	before 2.1.3.18185-0.ds1-11+squeeze2, plus listed versions 2.1.3.18185-0.ds1-112.1.3.18185-0.ds1-11+squeeze1	2.1.3.18185-0.ds1-11+squeeze2
`firebird2.5` Debian:7	before 2.5.2.26540.ds4-1~deb7u2, plus listed versions 2.5.2.26540.ds4-1~deb7u12.5.2~svn+54698.ds4-3	2.5.2.26540.ds4-1~deb7u2
`firebird2.5` Ubuntu:14.04:LTS	before 2.5.2.26540.ds4-9ubuntu1.1, plus listed versions 2.5.2.26540.ds4-32.5.2.26540.ds4-72.5.2.26540.ds4-82.5.2.26540.ds4-8ubuntu12.5.2.26540.ds4-8ubuntu22.5.2.26540.ds4-9ubuntu1	2.5.2.26540.ds4-9ubuntu1.1
`firebird2.5` Ubuntu:14.04:LTS From an advisory covering 2 CVEs	before 2.5.2.26540.ds4-9ubuntu1.1, plus listed versions 2.5.2.26540.ds4-32.5.2.26540.ds4-72.5.2.26540.ds4-82.5.2.26540.ds4-8ubuntu12.5.2.26540.ds4-8ubuntu22.5.2.26540.ds4-9ubuntu1	2.5.2.26540.ds4-9ubuntu1.1

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2014-9323 is a medium vulnerability (CVSS 5.0) in Firebirdsql Firebird, published December 16, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.90%, the 86th percentile. Fixed in firebird2.5 2.5.0.26054~ReleaseCandidate3.ds2-1+squeeze2.

References

Show 7 moreShow less