[Pkg-firebird-general] Fw: [Firebird-devel] Patch for vulnerability firebird 1.0.3 ?
Wed, 16 Jun 2004 15:02:36 +0200
----- Original Message -----
From: "Alex Peshkov" <firstname.lastname@example.org>
Sent: Wednesday, June 16, 2004 1:57 PM
Subject: Re: [Firebird-devel] Patch for vulnerability firebird 1.0.3 ?
> Remco Seesink wrote:
> >I am trying to fix a security bug on firebird 1.0.2 and 1.0.3 on debian.
The details of the bug can be found here:
> >I was wondering if somebody already made a patch for this bug. The
current plan is to support both firebird 1.0.3 and 1.5.0 in debian. This is
why upgrading to 1.5.0 wouldn't help.
> >If there is no patch, any pointers to what source files are likely
> Unfortunately, very many.
> It was rather big code review during which we tried to fix a great(!)
> lot of buffer overflows in firebird sources.
> Particular this bug may be fixed relatively easy, but on my mind it has
> no sence - there is a great lot of other overflows and some other
> security holes (including execution of arbitrary code with root rights)
> that were fixed in fb1.5.
> It seems unreal to me to backport them all to 1.0, therefore if one
> cares about security - use 1.5.
> >Remco Seesink.
> This SF.Net email is sponsored by The 2004 JavaOne(SM) Conference
> Learn from the experts at JavaOne(SM), Sun's Worldwide Java Developer
> Conference, June 28 - July 1 at the Moscone Center in San Francisco, CA
> REGISTER AND SAVE! http://java.sun.com/javaone/sf Priority Code NWMGYKND
> Firebird-Devel mailing list, web interface at