Ingres is a legacy relational database system with a narrow, specialized product footprint that maintains presence in established deployments despite limited active development. The vendor's vulnerability disclosures are sparse but recurring around its core database server product and concentrate on memory-boundary handling issues such as buffer-management weaknesses. Vulnerabilities in this product line have historically acquired public exploit tooling; current severity and exploitation activity are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Ingres over time
Signals from CVEs in this vendor scope (7 CVEs).
7 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2007-3336HIGH Multiple "pointer overwrite" vulnerabilities in Ingres database server 2006 9.0.4, r3, 2.6, and 2.5, as used in multiple CA (formerly Computer Associates) products, allow remote at | Jun 22, 2007 | 10.0 | 40 | NO | YES |
CVE-2007-3334HIGH Multiple heap-based buffer overflows in the (1) Communications Server (iigcc.exe) and (2) Data Access Server (iigcd.exe) components for Ingres Database Server 3.0.3, as used in CA | Jun 21, 2007 | 10.0 | 39 | NO | YES |
CVE-2007-3338HIGH Multiple stack-based buffer overflows in Ingres database server 2006 9.0.4, r3, 2.6, and 2.5, as used in multiple CA (Computer Associates) products, allow remote attackers to execu | Jun 22, 2007 | 10.0 | 27 | NO | NO |
CVE-2008-3389MEDIUM Stack-based buffer overflow in the libbecompat library in Ingres 2.6, Ingres 2006 release 1 (aka 9.0.4), and Ingres 2006 release 2 (aka 9.1.0) on Linux and HP-UX allows local users | Aug 5, 2008 | 4.6 | 16 | NO | NO |
CVE-2007-6334MEDIUM Ingres 2.5 and 2.6 on Windows, as used in multiple CA products and possibly other products, assigns the privileges and identity of users to be the same as the first user, which all | Dec 20, 2007 | 5.0 | 16 | NO | NO |
CVE-2008-3356MEDIUM verifydb in Ingres 2.6, Ingres 2006 release 1 (aka 9.0.4), and Ingres 2006 release 2 (aka 9.1.0) on Linux and other Unix platforms sets the ownership or permissions of an iivdb.log | Aug 5, 2008 | 4.6 | 14 | NO | NO |
wakeup in Ingres database server 2006 9.0.4, r3, 2.6, and 2.5, as used in multiple CA (Computer Associates) products, allows local users to truncate arbitrary files via a symlink a | Jun 22, 2007 | 2.1 | 12 | NO | NO |
Signals from CVEs in this vendor scope (7 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Ingres.
Media articles that mention a CVE ID that affects a product developed by Ingres — matched by CVE ID, not by vendor name.