TI-2018-05395 Aliases CVE-2018-7485 GHSA-2fc5-5jjf-fmx7

The SQLWriteFileDSN function in odbcinst/SQLWriteFileDSN.c in unixODBC 2.3.5 has strncpy…

MEDIUM 48CWE-119Published 2018-02-26 · Updated 2024-08-05

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Partial Red Hat: 10 fixed, 2 without a fix

Attack profile from CVSS 3.0 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-119 and the CVSS impact.

Summary

The SQLWriteFileDSN function in odbcinst/SQLWriteFileDSN.c in unixODBC 2.3.5 has strncpy arguments in the wrong order, which allows attackers to cause a denial of service or possibly have unspecified other impact.

Why it matters now

EPSS 0.03024 87th percentileScored 2026-11-07

Fix Partial Red Hat: 2 advisoriesRed Hat: 10 fixed, 2 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA

— Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:unixodbc:unixodbc:2.3.5:::::::*	2.3.5	Vulnerable	unixodbc

cpe:2.3:a:unixodbc:unixodbc:2.3.5:*:*:*:*:*:*:* Versions 2.3.5 Vulnerable ·unixodbc

Remediation

Red Hat 2 advisories

RHSA-2020:4999 Released 2020-11-10 · Red Hat rating Moderate
unixODBC security update
- Red Hat Enterprise Linux ComputeNode EUS (v. 7.6) unixODBC-2.3.1-14.el7_6
- Red Hat Enterprise Linux ComputeNode Optional EUS (v. 7.6) unixODBC-devel-2.3.1-14.el7_6
- Red Hat Enterprise Linux Server EUS (v. 7.6) unixODBC-2.3.1-14.el7_6, unixODBC-2.3.1-14.el7_6.ppc, unixODBC-devel-2.3.1-14.el7_6 +1
- Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7) unixODBC-2.3.1-14.el7_6, unixODBC-devel-2.3.1-14.el7_6
RHSA-2019:2336 Released 2019-08-06 · Red Hat rating Moderate
unixODBC security update
- Red Hat Enterprise Linux Client (v. 7) unixODBC-2.3.1-14.el7
- Red Hat Enterprise Linux Client Optional (v. 7) unixODBC-devel-2.3.1-14.el7
- Red Hat Enterprise Linux ComputeNode (v. 7) unixODBC-2.3.1-14.el7
- Red Hat Enterprise Linux ComputeNode Optional (v. 7) unixODBC-devel-2.3.1-14.el7
- Red Hat Enterprise Linux Server (v. 7) unixODBC-2.3.1-14.el7, unixODBC-2.3.1-14.el7.ppc, unixODBC-devel-2.3.1-14.el7 +1
- Red Hat Enterprise Linux Workstation (v. 7) unixODBC-2.3.1-14.el7, unixODBC-devel-2.3.1-14.el7

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat Enterprise Linux 5	Affected	No fix planned: Will not fix
Red Hat Enterprise Linux 6	Affected	No fix planned: Will not fix
Red Hat Enterprise Linux Client (v. 7)	Fixed	RHSA-2019:2336
Red Hat Enterprise Linux Client Optional (v. 7)	Fixed	RHSA-2019:2336
Red Hat Enterprise Linux ComputeNode (v. 7)	Fixed	RHSA-2019:2336
Red Hat Enterprise Linux ComputeNode EUS (v. 7.6)	Fixed	RHSA-2020:4999
Red Hat Enterprise Linux ComputeNode Optional (v. 7)	Fixed	RHSA-2019:2336
Red Hat Enterprise Linux ComputeNode Optional EUS (v. 7.6)	Fixed	RHSA-2020:4999
Red Hat Enterprise Linux Server (v. 7)	Fixed	RHSA-2019:2336
Red Hat Enterprise Linux Server EUS (v. 7.6)	Fixed	RHSA-2020:4999
Red Hat Enterprise Linux Workstation (v. 7)	Fixed	RHSA-2019:2336
Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7)	Fixed	RHSA-2020:4999

Not affected: 1 product

Red Hat Enterprise Linux 8

Timeline

2026-10-02 Threatist record created from CVE-2018-7485
2026-10-03 Alias added: GHSA-2fc5-5jjf-fmx7

References

Patch 1

https://github.com/lurcher/unixODBC/commit/45ef78e037f578b15fc58938a3a3251655e71d6f#diff-d52750c7ba4e594410438569d8e2963aL24

Advisory 1

RHSA-2019:2336

TI-2018-05347 In unixODBC before 2.3.5, there is a buffer overflow in the unicode_to_ansi_copy() function in DriverManager/__info.c. CVSS 3.0CRITICAL 9.8
TI-2024-00936 Unixodbc: out of bounds stack write due to pointer-to-integer types conversion CVSS 3.1HIGH 7.8
TI-2011-00998 Buffer overflow in unixodbc CVSS 3.1HIGH 7.8
TI-2012-02296 Buffer overflow in the SQLDriverConnect function in unixODBC 2.3.1 allows local users to… CVSS 2.0LOW 2.1
TI-2012-02295 Buffer overflow in the SQLDriverConnect function in unixODBC 2.0.10, 2.3.1, and earlier… CVSS 2.0LOW 2.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences