Unscored severity · published Jan 29, 2008
CVE-2008-0387
Integer overflow in Firebird SQL 1.0.3 and earlier, 1.5.x before 1.5.6, 2.0.x before 2.0.4, and 2.1.x before 2.1.0 RC1 might allow remote attackers to execute arbitrary code via…
–
CVSS
45.9%
EPSS
No
On KEV
Description
Integer overflow in Firebird SQL 1.0.3 and earlier, 1.5.x before 1.5.6, 2.0.x before 2.0.4, and 2.1.x before 2.1.0 RC1 might allow remote attackers to execute arbitrary code via crafted (1) op_receive, (2) op_start, (3) op_start_and_receive, (4) op_send, (5) op_start_and_send, and (6) op_start_send_and_receive XDR requests, which triggers memory corruption.
Exploitation
Is it being used?
Exploit prediction (EPSS)45.9% · higher than 99% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FI
Firebird · Firebirdsql
through 1.0.3; 1.5 before 1.5.6; 2.0.0 before 2.0.4; 2.1.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2008-0387
CVE.org
https://www.cve.org/CVERecord?id=CVE-2008-0387
Third Party Advisory
http://secunia.com/advisories/29203
Third Party Advisory
http://secunia.com/advisories/29501
Third Party Advisory
http://security.gentoo.org/glsa/glsa-200803-02.xml
Third Party Advisory
http://securityreason.com/securityalert/3580
Third Party Advisory
http://sourceforge.net/project/shownotes.php?group_id=9028&release_id=570800
Vendor Advisory
http://tracker.firebirdsql.org/browse/CORE-1681
More from Firebird
9.9
CVE-2026-40342
Firebird: Path Traversal + Arbitrary File Write Leads to Remote Code Execution
8.8
CVE-2025-24975
Firebird Non-Authorized Access to Encrypted Database Using Execute Statement on External
8.8
CVE-2017-11509
An authenticated remote attacker can execute arbitrary code in Firebird SQL Server versions 2.5.7 and 3.0.2 by executing a malformed SQL statement
8.8
CVE-2017-6369
Insufficient checks in the UDF subsystem in Firebird 2.5.x before 2.5.7 and 3.0.x before 3.0.2 allow remote authenticated users to execute code by using a 'system' entrypoint from…
8.2
CVE-2026-28224
Firebird Null Pointer Dereference via CryptCallback causes DOS