Posted by Daniel Owens via Fulldisclosure on Nov 04
unixODBC versions <=2.3.14 contain a rude truncation of a 64-bit `SQLLEN` `buffer_length` to a 32-bit `int` without
verifying that it produces a valid, positive value. The result is later passed to `memcpy`, causing the information
system to crash or, if carefully chosen, enabling attackers to write adjacent memory under certain circumstances (e.g.,
a buffer length that wraps to a small positive integer or triggers an undersized allocation…
Source: Full Disclosure (seclists.org) · 2026-11-05