CVE-2007-3338

CRITICAL 10.0CVE-2007-3338 · Published 22/06/2007 · updated 16/06/2026

In short

CVE-2007-3338 is a CRITICAL (CVSS 10.0) vulnerability affecting database server (ingres).
Chance of exploitation in the next 30 days (EPSS): 6.7%, higher than 93.9% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
database server ingres	`= 2.5= 2.6= 9.0.4= r3`	No fix yet

Description

Multiple stack-based buffer overflows in Ingres database server 2006 9.0.4, r3, 2.6, and 2.5, as used in multiple CA (Computer Associates) products, allow remote attackers to execute arbitrary code via the (1) uuid_from_char or (2) duve_get_args functions.

References

osvdb.org/37483
secunia.com/advisories/25756 · Vendor Advisory
secunia.com/advisories/25775 · Vendor Advisory
supportconnectw.ca.com/public/ca_common_docs/ingresvuln_letter.asp · Patch
ca.com/us/securityadvisor/newsinfo/collateral.aspx
ngssoftware.com/advisories/high-risk-vulnerability-in-ingres-stack-overflow
ngssoftware.com/advisories/medium-risk-vulnerability-in-ingres-stack-overflow
securityfocus.com/archive/1/472194/100/0/threaded
securityfocus.com/archive/1/472197/100/0/threaded
securityfocus.com/bid/24585
vupen.com/english/advisories/2007/2288 · Vendor Advisory
vupen.com/english/advisories/2007/2290 · Vendor Advisory

More vulnerabilities in database server

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free