---
id: CVE-2014-9323
title: >-
  The xdr_status_vector function in Firebird before 2.1.7 and 2.5.x before 2.5.3
  SU1 allows remote attackers to cause a denial of service (NULL pointer
  dereference, segmentation fault, and crash) via an op_response action with a
  non-empty …
summary: >-
  The xdr_status_vector function in Firebird before 2.1.7 and 2.5.x before 2.5.3
  SU1 allows remote attackers to cause a denial of service (NULL pointer
  dereference, segmentation fault, and crash) via an op_response action with a
  non-empty …
severity: medium
cvss: 5
cvssVector: 'AV:N/AC:L/Au:N/C:N/I:N/A:P'
cwe:
  - CWE-476
vendor: firebirdsql
product: firebird
affected:
  - firebird < 2.1.7
  - 'firebird >= 2.5, <= 2.5.3'
  - evergreen = 11.4
  - debian_linux = 7.0
  - debian_linux = 8.0
  - ubuntu_linux = 14.04
patched:
  - firebird 2.1.7
published: '2014-12-16'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T17:17:33.437'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2014-9323'
references:
  - url: 'http://advisories.mageia.org/MGASA-2014-0523.html'
    label: cve@mitre.org
  - url: 'http://lists.opensuse.org/opensuse-security-announce/2014-12/msg00012.html'
    label: cve@mitre.org
  - url: 'http://tracker.firebirdsql.org/browse/CORE-4630'
    label: cve@mitre.org
  - url: 'http://www.debian.org/security/2014/dsa-3109'
    label: cve@mitre.org
  - url: >-
      http://www.firebirdsql.org/en/news/security-updates-for-v2-1-and-v2-5-series-66011/
    label: cve@mitre.org
  - url: 'http://www.mandriva.com/security/advisories?name=MDVSA-2015:172'
    label: cve@mitre.org
  - url: 'https://usn.ubuntu.com/3929-1/'
    label: cve@mitre.org
  - url: 'http://advisories.mageia.org/MGASA-2014-0523.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://lists.opensuse.org/opensuse-security-announce/2014-12/msg00012.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://tracker.firebirdsql.org/browse/CORE-4630'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://www.debian.org/security/2014/dsa-3109'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: >-
      http://www.firebirdsql.org/en/news/security-updates-for-v2-1-and-v2-5-series-66011/
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://www.mandriva.com/security/advisories?name=MDVSA-2015:172'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://usn.ubuntu.com/3929-1/'
    label: af854a3a-2127-422b-91ae-364da2661108
tags:
  - nvd
  - cve.org
epss: 0.02896
epssPercentile: 0.86856
ingestedAt: '2026-10-14T17:44:53.591Z'
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-10-14T16:23:54.787258Z'
---

## Overview

The xdr_status_vector function in Firebird before 2.1.7 and 2.5.x before 2.5.3 SU1 allows remote attackers to cause a denial of service (NULL pointer dereference, segmentation fault, and crash) via an op_response action with a non-empty status.

## Affected

- `firebird < 2.1.7`
- `firebird >= 2.5, <= 2.5.3`
- `evergreen = 11.4`
- `debian_linux = 7.0`
- `debian_linux = 8.0`
- `ubuntu_linux = 14.04`

## Remediation

Upgrade past the affected range:

- `firebird 2.1.7`