CVE-2014-9323

Name: CVE-2014-9323
Creator: NVD / NIST
Published: 2014-12-16T18:59:14.357+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

UnknownEPSS 2.90%

Last modified Jun 17, 2026

CVE-2014-9323 is a vulnerability of currently unknown severity. The xdr_status_vector function in Firebird before 2.1.7 and 2.5.x before 2.5.3 SU1 allows remote attackers to cause a denial of service (NULL pointer dereference, segmentation fault, and crash) via an op_response action with a non-empty status.. EPSS estimates a 2.90% chance of exploitation in the next 30 days.

Description

The xdr_status_vector function in Firebird before 2.1.7 and 2.5.x before 2.5.3 SU1 allows remote attackers to cause a denial of service (NULL pointer dereference, segmentation fault, and crash) via an op_response action with a non-empty status.

Metrics

EPSS Probability

2.90%

85.1th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-476

Affected Software

Vendor	Product	Versions
Firebirdsql	Firebird	< 2.1.7
Firebirdsql	Firebird	>= 2.5, <= 2.5.3
Opensuse	Evergreen	11.4
Debian	Debian Linux	7.0
Debian	Debian Linux	8.0
Canonical	Ubuntu Linux	14.04

References

http://advisories.mageia.org/MGASA-2014-0523.htmlThird Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2014-12/msg00012.htmlMailing List, Third Party Advisory
http://tracker.firebirdsql.org/browse/CORE-4630Exploit, Vendor Advisory
http://www.debian.org/security/2014/dsa-3109Third Party Advisory
http://www.firebirdsql.org/en/news/security-updates-for-v2-1-and-v2-5-series-66011/Vendor Advisory
http://www.mandriva.com/security/advisories?name=MDVSA-2015:172Broken Link
https://usn.ubuntu.com/3929-1/Third Party Advisory
http://advisories.mageia.org/MGASA-2014-0523.htmlThird Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2014-12/msg00012.htmlMailing List, Third Party Advisory
http://tracker.firebirdsql.org/browse/CORE-4630Exploit, Vendor Advisory
http://www.debian.org/security/2014/dsa-3109Third Party Advisory
http://www.firebirdsql.org/en/news/security-updates-for-v2-1-and-v2-5-series-66011/Vendor Advisory
http://www.mandriva.com/security/advisories?name=MDVSA-2015:172Broken Link
https://usn.ubuntu.com/3929-1/Third Party Advisory

Timeline

Published: Dec 16, 2014
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2014-9323?

How severe is CVE-2014-9323?

Severity scoring for CVE-2014-9323 is pending analysis. The EPSS model estimates a 2.90% probability of exploitation in the next 30 days.

How do I fix CVE-2014-9323?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2014-9323?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST