Unixodbc is a modestly represented but widely embedded open-source ODBC driver manager that sits in the data-access layer of many applications and database-client tools across Unix and Linux systems. Vulnerabilities affecting the vendor skew strongly toward critical severity and recur through memory-safety weakness classes including buffer overflows, out-of-bounds pointer offsets, and improper memory-bounds checking—flaws characteristic of a C-based library handling untrusted database connection strings and driver protocol data. Defenders should prioritize updates to this library in environments where it is linked by database clients or application middleware; current severity and exploitation status are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Unixodbc over time
Signals from CVEs in this vendor scope (6 CVEs).
6 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2018-7485CRITICAL The SQLWriteFileDSN function in odbcinst/SQLWriteFileDSN.c in unixODBC 2.3.5 has strncpy arguments in the wrong order, which allows attackers to cause a denial of service or possib | Feb 26, 2018 | 9.8 | 31 | NO | NO |
CVE-2018-7409CRITICAL In unixODBC before 2.3.5, there is a buffer overflow in the unicode_to_ansi_copy() function in DriverManager/__info.c. | Feb 22, 2018 | 9.8 | 31 | NO | NO |
CVE-2024-1013HIGH An out-of-bounds stack write flaw was found in unixODBC on 64-bit architectures where the caller has 4 bytes and callee writes 8 bytes. This issue may go unnoticed on little-endian | Mar 18, 2024 | 7.8 | 25 | NO | NO |
CVE-2011-1145HIGH The SQLDriverConnect() function in unixODBC before 2.2.14p2 have a possible buffer overflow condition when specifying a large value for SAVEFILE parameter in the connection string. | Nov 14, 2019 | 7.8 | 25 | NO | NO |
Buffer overflow in the SQLDriverConnect function in unixODBC 2.3.1 allows local users to cause a denial of service (crash) via a long string in the DRIVER option. NOTE: this issue | Aug 31, 2012 | 2.1 | 13 | NO | NO |
Buffer overflow in the SQLDriverConnect function in unixODBC 2.0.10, 2.3.1, and earlier allows local users to cause a denial of service (crash) via a long string in the FILEDSN opt | Aug 31, 2012 | 2.1 | 13 | NO | NO |
Signals from CVEs in this vendor scope (6 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Unixodbc.
Media articles that mention a CVE ID that affects a product developed by Unixodbc — matched by CVE ID, not by vendor name.