Firebird Client Library Information Leak Vulnerability

A vulnerability allowing information leakage has been identified in the Firebird client library version 3.0.13 and prior. When this client library communicates with Firebird server version 4.0 or higher, it incorrectly populates data length values in the XSQLDA fields. This miscommunication can lead to unintended information disclosure.

Impact

Exploitation of this vulnerability causes an information leak, where incorrect data length values are transmitted, potentially allowing for unauthorized data access or manipulation.

Remediation

Users can upgrade to the Firebird client version 4.0.0 or higher to address this vulnerability. Alternatively, version 3.0.14 can be used once it is released.