Every CVESearch/Get API key

CVE-2012-2657

** DISPUTED ** Buffer overflow in the SQLDriverConnect function in unixODBC 2.0.10, 2.3.1, and...

2.1 LowFix availableDisputed

CVE-2012-2657 is a low vulnerability (CVSS 2.1) in Unixodbc, published August 31, 2012. Its validity is disputed. EPSS puts the chance of exploitation in the next 30 days at 0.44%, the 39th percentile. Fixed in unixodbc 2.3.6-0.1.

What does this mean?
Severity
2.1 LowCVSS 2.0, NVD
Exploit chance
0.44%EPSS, 39th percentile
Exploitation
None knownNot on CISA’s or ENISA’s lists
Fixed in
2.3.6-0.1unixodbc +4 more

Description

Buffer overflow in the SQLDriverConnect function in unixODBC 2.0.10, 2.3.1, and earlier allows local users to cause a denial of service (crash) via a long string in the FILEDSN option. NOTE: this issue might not be a vulnerability, since the ability to set this option typically implies that the attacker already has legitimate access to cause a DoS or execute code, and therefore the issue would not cross privilege boundaries. There may be limited attack scenarios if isql command-line options are exposed to an attacker, although it seems likely that other, more serious issues would also be exposed, and this issue might not cross privilege boundaries in that context.

Exploit likelihood

0.44%Down 1.4 points since Feb 4, 2022
90%50%10%1%

Affected products

Affected packages

Affected packages
PackageAffectedFixed
unixodbc
Debian:12
before 2.3.6-0.1
2.3.6-0.1
unixodbc
Debian:13
before 2.3.6-0.1
2.3.6-0.1
unixodbc
Debian:14
before 2.3.6-0.1
2.3.6-0.1
unixodbc
Ubuntu:Pro:14.04:LTS
All versions, plus listed versions
2.2.14p2-5ubuntu42.2.14p2-5ubuntu52.2.14p2-5ubuntu5+esm1
None known
unixodbc
Ubuntu:Pro:16.04:LTS
All versions, plus listed versions
2.3.1-32.3.1-42.3.1-4.12.3.1-4.1ubuntu0.1~esm12.3.1-4.1ubuntu0.1~esm2
None known

What each source reports

NVD Score used2.1

Buffer overflow in the SQLDriverConnect function in unixODBC 2.0.10, 2.3.1, and earlier allows local users to cause a denial of service (crash) via a long string in the FILEDSN option. NOTE: this issue might not be a vulnerability, since the ability to set this option typically implies that the attacker already has legitimate access to cause a DoS or execute code, and therefore the issue would not cross privilege boundaries. There may be limited attack scenarios if isql command-line options are exposed to an attacker, although it seems likely that other, more serious issues would also be exposed, and this issue might not cross privilege boundaries in that context.

Record
CVE-2012-2657
CVSS 2.0
2.1 LowAV:L/AC:L/Au:N/C:N/I:N/A:P
Weakness
CWE-119
Updated
2026-11-02
CVE ListNo score

Buffer overflow in the SQLDriverConnect function in unixODBC 2.0.10, 2.3.1, and earlier allows local users to cause a denial of service (crash) via a long string in the FILEDSN option. NOTE: this issue might not be a vulnerability, since the ability to set this option typically implies that the attacker already has legitimate access to cause a DoS or execute code, and therefore the issue would not cross privilege boundaries. There may be limited attack scenarios if isql command-line options are exposed to an attacker, although it seems likely that other, more serious issues would also be exposed, and this issue might not cross privilege boundaries in that context.

Record
CVE-2012-2657
Updated
2026-11-02
EUVDEUVD-2012-2642No score

Buffer overflow in the SQLDriverConnect function in unixODBC 2.0.10, 2.3.1, and earlier allows local users to cause a denial of service (crash) via a long string in the FILEDSN option. NOTE: this issue might not be a vulnerability, since the ability to set this option typically implies that the attacker already has legitimate access to cause a DoS or execute code, and therefore the issue would not cross privilege boundaries. There may be limited attack scenarios if isql command-line options are exposed to an attacker, although it seems likely that other, more serious issues would also be exposed, and this issue might not cross privilege boundaries in that context.

Record
EUVD-2012-2642
Updated
2026-11-03
GitHub AdvisoriesGHSA-v3gw-vw4w-6f6jNo score

** DISPUTED ** Buffer overflow in the SQLDriverConnect function in unixODBC 2.0.10, 2.3.1, and...

** DISPUTED ** Buffer overflow in the SQLDriverConnect function in unixODBC 2.0.10, 2.3.1, and earlier allows local users to cause a denial of service (crash) via a long string in the FILEDSN option. NOTE: this issue might not be a vulnerability, since the ability to set this option typically implies that the attacker already has legitimate access to cause a DoS or execute code, and therefore the issue would not cross privilege boundaries. There may be limited attack scenarios if isql command-line options are exposed to an attacker, although it seems likely that other, more serious issues would also be exposed, and this issue might not cross privilege boundaries in that context.

Record
GHSA-v3gw-vw4w-6f6j
Weakness
CWE-119
Updated
2026-11-02
OSVBELL-CVE-2012-26572.1

CVE-2012-2657 does not affect BellSoft software

Record
BELL-CVE-2012-2657
CVSS 2.0
2.1 LowAV:L/AC:L/Au:N/C:N/I:N/A:P
Updated
2026-11-02
OSVNo score

Buffer overflow in the SQLDriverConnect function in unixODBC 2.0.10, 2.3.1, and earlier allows local users to cause a denial of service (crash) via a long string in the FILEDSN option. NOTE: this issue might not be a vulnerability, since the ability to set this option typically implies that the attacker already has legitimate access to cause a DoS or execute code, and therefore the issue would not cross privilege boundaries. There may be limited attack scenarios if isql command-line options are exposed to an attacker, although it seems likely that other, more serious issues would also be exposed, and this issue might not cross privilege boundaries in that context.

Record
CVE-2012-2657
Updated
2026-11-02
OSVDEBIAN-CVE-2012-2657No score

Buffer overflow in the SQLDriverConnect function in unixODBC 2.0.10, 2.3.1, and earlier allows local users to cause a denial of service (crash) via a long string in the FILEDSN option. NOTE: this issue might not be a vulnerability, since the ability to set this option typically implies that the attacker already has legitimate access to cause a DoS or execute code, and therefore the issue would not cross privilege boundaries. There may be limited attack scenarios if isql command-line options are exposed to an attacker, although it seems likely that other, more serious issues would also be exposed, and this issue might not cross privilege boundaries in that context.

Record
DEBIAN-CVE-2012-2657
Updated
2026-11-02
OSVUBUNTU-CVE-2012-2657No score

Buffer overflow in the SQLDriverConnect function in unixODBC 2.0.10, 2.3.1, and earlier allows local users to cause a denial of service (crash) via a long string in the FILEDSN option. NOTE: this issue might not be a vulnerability, since the ability to set this option typically implies that the attacker already has legitimate access to cause a DoS or execute code, and therefore the issue would not cross privilege boundaries. There may be limited attack scenarios if isql command-line options are exposed to an attacker, although it seems likely that other, more serious issues would also be exposed, and this issue might not cross privilege boundaries in that context.

Record
UBUNTU-CVE-2012-2657
Updated
2026-11-02

History

History
RecordedChangedSources
facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

Show 9 moreShow less
PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open