Segfault Vulnerability in Firebird 4.0 Due to Improper Connection Pool Management
Summary
DEBIAN-CVE-2025-24975: Firebird is a relational database. Affects firebird4.0 versions < 4.0.5.3140.ds6-17+deb13u1. Fixed in 4.0.5.3140.ds6-17+deb13u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Firebird is a powerful open-source relational database management system known for its high performance and support for various SQL standards. It is widely used for building database applications and offers features such as stored procedures, triggers, and multi-version concurrency control. However, prior to specific snapshot versions, Firebird is vulnerable if the ExtConnPoolSize setting is not configured correctly, leading to potential server crashes and data access issues.
Vulnerability Detail
The vulnerability arises when the ExtConnPoolSize is not set to 0, allowing connections stored in the ExtConnPool to be improperly managed. If the CryptCallback interface is not verified during connection creation, it can lead to a segmentation fault (segfault) in the server process. This issue affects both encrypted and unencrypted databases, potentially allowing unauthorized access to sensitive data and causing server instability.
How To Fix
Minimum fixed version
4.0.5.3140.ds6-17+deb13u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade firebird4.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, set the ExtConnPoolSize to 0 in the firebird.conf configuration file. This can be done by adding or modifying the following line:
ExtConnPoolSize = 0
Conclusion
The Firebird 4.0 vulnerability poses a significant risk to database stability and security. It is crucial for users to update to the latest patched versions or apply the recommended workaround to mitigate potential issues. Regular monitoring for vulnerabilities using tools like Vulert can help maintain application security.
See every vulnerability recorded for firebird4.0 →
FAQ
The vulnerability can lead to segmentation faults in the Firebird server, causing crashes and potential data access issues for both encrypted and unencrypted databases.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Check your application against this vulnerability using the Vulert playground without any signup.
Versions prior to snapshot 4.0.6.3183, 5.0.2.1610, and 6.0.0.609 are affected by this vulnerability.
Yes, the permanent fix is to update to the patched versions of Firebird as specified in the 'how to fix' section.
If immediate updating is not possible, implement the workaround by setting ExtConnPoolSize to 0 in the firebird.conf file.
References
Related vulnerabilities
Recent vulnerabilities recorded for firebird4.0.
