Package: release.debian.org
Severity: normal
Tags: trixie
X-Debbugs-Cc: [email protected]
Control: affects -1 + src:firebird3.0
User: [email protected]
Usertags: pu
* CVE-2025-54989: XDR Message Parsing NULL Pointer Dereference
(Closes: #1111321)
diffstat for firebird3.0-3.0.12.ds7 firebird3.0-3.0.12.ds7
changelog | 8 +++
patches/0001-Fix-for-GHSA-7qp6-hqxj-pjjp-ZDI-CAN-26486.patch | 28 +++++++++++
patches/series | 1
3 files changed, 37 insertions(+)
diff -Nru firebird3.0-3.0.12.ds7/debian/changelog
firebird3.0-3.0.12.ds7/debian/changelog
--- firebird3.0-3.0.12.ds7/debian/changelog 2025-03-23 18:20:32.000000000
+0200
+++ firebird3.0-3.0.12.ds7/debian/changelog 2025-08-25 12:04:01.000000000
+0300
@@ -1,3 +1,11 @@
+firebird3.0 (3.0.12.ds7-13+deb13u1) trixie; urgency=medium
+
+ * Non-maintainer upload.
+ * CVE-2025-54989: XDR Message Parsing NULL Pointer Dereference
+ (Closes: #1111321)
+
+ -- Adrian Bunk <[email protected]> Mon, 25 Aug 2025 12:04:01 +0300
+
firebird3.0 (3.0.12.ds7-13) unstable; urgency=medium
[ Carles Pina i Estany ]
diff -Nru
firebird3.0-3.0.12.ds7/debian/patches/0001-Fix-for-GHSA-7qp6-hqxj-pjjp-ZDI-CAN-26486.patch
firebird3.0-3.0.12.ds7/debian/patches/0001-Fix-for-GHSA-7qp6-hqxj-pjjp-ZDI-CAN-26486.patch
---
firebird3.0-3.0.12.ds7/debian/patches/0001-Fix-for-GHSA-7qp6-hqxj-pjjp-ZDI-CAN-26486.patch
1970-01-01 02:00:00.000000000 +0200
+++
firebird3.0-3.0.12.ds7/debian/patches/0001-Fix-for-GHSA-7qp6-hqxj-pjjp-ZDI-CAN-26486.patch
2025-08-25 12:03:31.000000000 +0300
@@ -0,0 +1,28 @@
+From 1ece01433e84376e0e32260c4237a9f5c4dbe274 Mon Sep 17 00:00:00 2001
+From: AlexPeshkoff <[email protected]>
+Date: Mon, 5 May 2025 19:03:13 +0300
+Subject: Fix for GHSA-7qp6-hqxj-pjjp / ZDI-CAN-26486
+
+---
+ src/remote/protocol.cpp | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/src/remote/protocol.cpp b/src/remote/protocol.cpp
+index cc8f492910..435c32c889 100644
+--- a/src/remote/protocol.cpp
++++ b/src/remote/protocol.cpp
+@@ -1857,6 +1857,11 @@ static bool_t xdr_trrq_message( XDR* xdrs, USHORT
msg_type)
+ rem_port* port = xdrs->x_public;
+ Rpr* procedure = port->port_rpr;
+
++ // normally that never happens
++ fb_assert(procedure);
++ if (!procedure)
++ return false;
++
+ if (msg_type == 1)
+ return xdr_message(xdrs, procedure->rpr_out_msg,
procedure->rpr_out_format);
+
+--
+2.30.2
+
diff -Nru firebird3.0-3.0.12.ds7/debian/patches/series
firebird3.0-3.0.12.ds7/debian/patches/series
--- firebird3.0-3.0.12.ds7/debian/patches/series 2025-01-25
17:22:59.000000000 +0200
+++ firebird3.0-3.0.12.ds7/debian/patches/series 2025-08-25
12:03:59.000000000 +0300
@@ -30,3 +30,4 @@
deb/cve-2017-11509.patch
out/hppa-mod_loader.patch
out/hurd-maxpathlen.patch
+0001-Fix-for-GHSA-7qp6-hqxj-pjjp-ZDI-CAN-26486.patch
