Skip to content
OpenAdvisories
Medium ELSA-2019-2336 2 CVEs

Moderate: unixODBC security update (Oracle Linux 7)

Published Aug 13, 2019 · Updated Aug 13, 2019

Ecosystem: Oracle Linux

Summary

[2.3.1-14.0.1]
- backport unchecked malloc memory references fix [Orabug: 29684195]

[2.3.1-14]
- fixed insecure buffer copy (#1571530)
- fixed possible buffer overflow (#1571528)

[2.3.1-13]
- revert: ltdl bundling

[2.3.1-12]
- fix the libtool-ltdl compatibility
Resolves: rhbz#1267438

Fixed packages 2

ReleasePackageFixed in
Oracle Linux · 7 unixODBC 0:2.3.1-14.0.1.el7
Oracle Linux · 7 unixODBC-devel 0:2.3.1-14.0.1.el7

Vulnerabilities 2

  • Unscored —
    CVE-2018-7409

    In unixODBC before 2.3.5, there is a buffer overflow in the unicode_to_ansi_copy() function in DriverManager/__info.c.

    unixodbc unixodbc Debian Ubuntu
  • Unscored —
    CVE-2018-7485

    The SQLWriteFileDSN function in odbcinst/SQLWriteFileDSN.c in unixODBC 2.3.5 has strncpy arguments in the wrong order, …