CVE-2025-65104: Firebird: Information leak vulnerability in firebird3 client when used with newer server
Firebird is an open-source relational database management system. In versions FB3 of the client library placed incorrect data length values into XSQLDA fields when communicating with FB4 or higher servers, resulting in an information leak. This issue is fixed by upgrading to the FB4 client or higher.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Firebird client libraryto a version that resolves this vulnerability.Fixed in FB4
Event History
Frequently Asked Questions
What is the severity of CVE-2025-65104?
CVE-2025-65104 is classified as a medium severity vulnerability.
How do I fix CVE-2025-65104?
To fix CVE-2025-65104, upgrade the Firebird client library to version 4.0.0 or higher.
What software is affected by CVE-2025-65104?
CVE-2025-65104 affects the Firebird client library versions between 3.0.0 and 4.0.0.
What type of vulnerability is CVE-2025-65104?
CVE-2025-65104 is an information leak vulnerability.
In which environments will CVE-2025-65104 occur?
CVE-2025-65104 occurs when the Firebird 3 client communicates with Firebird 4 or higher servers.