CVE-2012-2658
** DISPUTED ** Buffer overflow in the SQLDriverConnect function in unixODBC 2.3.1 allows local...
CVE-2012-2658 is a low vulnerability (CVSS 2.1) in Unixodbc, published August 31, 2012. Its validity is disputed. EPSS puts the chance of exploitation in the next 30 days at 0.51%, the 44th percentile. Fixed in unixodbc 2.3.6-0.1.
- Severity
- 2.1 LowCVSS 2.0, NVD
- Exploit chance
- 0.51%EPSS, 44th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
2.3.6-0.1unixodbc +4 more
Description
Buffer overflow in the SQLDriverConnect function in unixODBC 2.3.1 allows local users to cause a denial of service (crash) via a long string in the DRIVER option. NOTE: this issue might not be a vulnerability, since the ability to set this option typically implies that the attacker already has legitimate access to cause a DoS or execute code, and therefore the issue would not cross privilege boundaries. There may be limited attack scenarios if isql command-line options are exposed to an attacker, although it seems likely that other, more serious issues would also be exposed, and this issue might not cross privilege boundaries in that context.
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
unixodbcDebian:12 | before 2.3.6-0.1 | 2.3.6-0.1 |
unixodbcDebian:13 | before 2.3.6-0.1 | 2.3.6-0.1 |
unixodbcDebian:14 | before 2.3.6-0.1 | 2.3.6-0.1 |
unixodbcUbuntu:Pro:14.04:LTS | All versions, plus listed versions 2.2.14p2-5ubuntu42.2.14p2-5ubuntu52.2.14p2-5ubuntu5+esm1 | None known |
unixodbcUbuntu:Pro:16.04:LTS | All versions, plus listed versions 2.3.1-32.3.1-42.3.1-4.12.3.1-4.1ubuntu0.1~esm12.3.1-4.1ubuntu0.1~esm2 | None known |
What each source reports
NVD Score used
Buffer overflow in the SQLDriverConnect function in unixODBC 2.3.1 allows local users to cause a denial of service (crash) via a long string in the DRIVER option. NOTE: this issue might not be a vulnerability, since the ability to set this option typically implies that the attacker already has legitimate access to cause a DoS or execute code, and therefore the issue would not cross privilege boundaries. There may be limited attack scenarios if isql command-line options are exposed to an attacker, although it seems likely that other, more serious issues would also be exposed, and this issue might not cross privilege boundaries in that context.
- Record
CVE-2012-2658- CVSS 2.0
- 2.1 Low
AV:L/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-119
- Updated
- 2026-11-02
CVE ListNo score
Buffer overflow in the SQLDriverConnect function in unixODBC 2.3.1 allows local users to cause a denial of service (crash) via a long string in the DRIVER option. NOTE: this issue might not be a vulnerability, since the ability to set this option typically implies that the attacker already has legitimate access to cause a DoS or execute code, and therefore the issue would not cross privilege boundaries. There may be limited attack scenarios if isql command-line options are exposed to an attacker, although it seems likely that other, more serious issues would also be exposed, and this issue might not cross privilege boundaries in that context.
- Record
CVE-2012-2658- Updated
- 2026-11-02
EUVDEUVD-2012-2643No score
Buffer overflow in the SQLDriverConnect function in unixODBC 2.3.1 allows local users to cause a denial of service (crash) via a long string in the DRIVER option. NOTE: this issue might not be a vulnerability, since the ability to set this option typically implies that the attacker already has legitimate access to cause a DoS or execute code, and therefore the issue would not cross privilege boundaries. There may be limited attack scenarios if isql command-line options are exposed to an attacker, although it seems likely that other, more serious issues would also be exposed, and this issue might not cross privilege boundaries in that context.
- Record
EUVD-2012-2643- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-8mx7-qh9r-7vj7No score
** DISPUTED ** Buffer overflow in the SQLDriverConnect function in unixODBC 2.3.1 allows local...
** DISPUTED ** Buffer overflow in the SQLDriverConnect function in unixODBC 2.3.1 allows local users to cause a denial of service (crash) via a long string in the DRIVER option. NOTE: this issue might not be a vulnerability, since the ability to set this option typically implies that the attacker already has legitimate access to cause a DoS or execute code, and therefore the issue would not cross privilege boundaries. There may be limited attack scenarios if isql command-line options are exposed to an attacker, although it seems likely that other, more serious issues would also be exposed, and this issue might not cross privilege boundaries in that context.
- Record
GHSA-8mx7-qh9r-7vj7- Weakness
- CWE-119
- Updated
- 2026-11-02
OSVBELL-CVE-2012-2658
CVE-2012-2658 does not affect BellSoft software
- Record
BELL-CVE-2012-2658- CVSS 2.0
- 2.1 Low
AV:L/AC:L/Au:N/C:N/I:N/A:P - Updated
- 2026-11-02
OSVNo score
Buffer overflow in the SQLDriverConnect function in unixODBC 2.3.1 allows local users to cause a denial of service (crash) via a long string in the DRIVER option. NOTE: this issue might not be a vulnerability, since the ability to set this option typically implies that the attacker already has legitimate access to cause a DoS or execute code, and therefore the issue would not cross privilege boundaries. There may be limited attack scenarios if isql command-line options are exposed to an attacker, although it seems likely that other, more serious issues would also be exposed, and this issue might not cross privilege boundaries in that context.
- Record
CVE-2012-2658- Updated
- 2026-11-02
OSVDEBIAN-CVE-2012-2658No score
Buffer overflow in the SQLDriverConnect function in unixODBC 2.3.1 allows local users to cause a denial of service (crash) via a long string in the DRIVER option. NOTE: this issue might not be a vulnerability, since the ability to set this option typically implies that the attacker already has legitimate access to cause a DoS or execute code, and therefore the issue would not cross privilege boundaries. There may be limited attack scenarios if isql command-line options are exposed to an attacker, although it seems likely that other, more serious issues would also be exposed, and this issue might not cross privilege boundaries in that context.
- Record
DEBIAN-CVE-2012-2658- Updated
- 2026-11-02
OSVUBUNTU-CVE-2012-2658No score
Buffer overflow in the SQLDriverConnect function in unixODBC 2.3.1 allows local users to cause a denial of service (crash) via a long string in the DRIVER option. NOTE: this issue might not be a vulnerability, since the ability to set this option typically implies that the attacker already has legitimate access to cause a DoS or execute code, and therefore the issue would not cross privilege boundaries. There may be limited attack scenarios if isql command-line options are exposed to an attacker, although it seems likely that other, more serious issues would also be exposed, and this issue might not cross privilege boundaries in that context.
- Record
UBUNTU-CVE-2012-2658- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
osvdb.org/82460
exchange.xforce.ibmcloud.com/vulnerabilities/75940
openwall.com/lists/oss-security/2012/06/06/3
securityfocus.com/bid/53712
Show 9 moreShow less
nvd.nist.gov/vuln/detail/CVE-2012-2658
github.com/advisories/GHSA-8mx7-qh9r-7vj7
docs.bell-sw.com/security/cves/CVE-2012-2658
security-tracker.debian.org/tracker/CVE-2012-2658
ubuntu.com/security/CVE-2012-2658
cve.org/CVERecord?id=CVE-2012-2658