CVE-2017-11509: debian debian_linux SQL Injection
CVSS: 9.0v2.0HighModified
AliasesSUSE-SU-2025:03095-1UBUNTU-CVE-2017-11509DEBIAN-CVE-2017-11509DLA-1374-1DLA-2129-1DLA-2824-1
Published 28-03-2018Last modified 16-09-2024
Vulnerability summary
CVE-2017-11509 is a high (CVSS 9.0) SQL Injection vulnerability in debian debian_linux. EPSS estimates a 6.15% chance of exploitation in the next 30 days, higher than 93.4% of scored vulnerabilities. 1 public exploit is recorded.
CVSS score
9.0/10
010
High · v2.0 (NVD)EPSS score
6.15%
0%100%
Low · -0.04 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1reference
Timeline
- 28-03-2018PublishedVulnerability first disclosed.
- 16-09-2024Last modifiedVulnerability information updated.
Description
An authenticated remote attacker can execute arbitrary code in Firebird SQL Server versions 2.5.7 and 3.0.2 by executing a malformed SQL statement.
CVSS metrics
5 scores · 3 sources · 3 versionsHigh 8.8Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HSourcesAll 3 agree
- OSV · UbuntuEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
High 8.8Preferred score · OSV · Ubuntu (Ecosystem advisory) · calculated from vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HSourcesSingle source
High 9.0Preferred score · NVD (NIST)
AV:N/AC:L/Au:S/C:C/I:C/A:CSourcesSingle source
EPSS trend
Probability
6.15%
Chance of exploitation in the next 30 days
Percentile
93%
Versus all other CVEs
30-day change
-0.04 pp
From 6.18% on 20-09-2026
20-09-202620-10-2026
EPSS score6.15%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (tenable.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Debian3 products
- firebird2.5< 2.5.2.26540.ds4-1~deb7u4 | < 2.5.3.26778.ds4-5+deb8u2
- firebird3.0< 3.0.3.32900.ds4-3 | < 3.0.1.32609.ds4-14+deb9u1
- debian_linuxEOL7.0 | 8.0 | 9.0
Suse2 products
- firebird&distro=SUSE Linux Enterprise Module for Package Hub 15 SP6< 3.0.4.33054-150200.3.6.1
- firebird&distro=SUSE Linux Enterprise Module for Package Hub 15 SP7< 3.0.4.33054-150200.3.6.1
Ubuntu2 products
- firebird2.5All versions (No fix recorded)
- firebird3.0All versions (No fix recorded)
Firebird foundation1 product
- firebird sql server2.5.7 | 3.0.2
Firebirdsql1 product
- firebird2.5.7 | 3.0.2
Opensuse1 product
- firebird&distro=openSUSE Leap 15.6< 3.0.4.33054-150200.3.6.1
6 vendors · 10 products
References
10 links
lists.debian.org/debian-lts-announce/2018/05/msg00005.htmlMailing ListX Refsource MLISTThird Party Advisory- www.tenable.com/security/research/tra-2017-36X Refsource MISCExploitMitigationThird Party AdvisoryREPORT
- lists.debian.org/debian-lts-announce/2020/02/msg00036.htmlMailing ListX Refsource MLISTThird Party Advisory
- lists.debian.org/debian-lts-announce/2021/11/msg00018.htmlMailing ListX Refsource MLISTThird Party Advisory