CVE-2021-45926: Out-of-bounds Write (CWE-787)
value: MDB Tools (aka mdbtools) 0.9.2 has a stack-based buffer overflow (at 0x7ffd0c689be0) in mdb_numeric_to_string (called from mdb_xfer_bound_data and _mdb_attempt_bind).
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 7.8
Published: 2022-01-01T01:15Z
Repository: https://github.com/mdbtools/mdbtools
Language: Other
Files changed: NEWS, configure.ac
Commit date: 2021-05-01 07:03:58 -0400
Commit message: Version 0.9.3, final

Diff: diff --git a/NEWS b/NEWS
index 2944a21..648d1ca 100644
--- a/NEWS
+++ b/NEWS
@@ -1,47 +1,30 @@
-Version 0.9.3, Beta 4
-=============
-
-libmdb:
-* Fix build failure with emscripten #299
-
-Version 0.9.3, Beta 3
-=============
-
-libmdb / libmdbsql:
-* Fix build when _XOPEN_SOURCE was already defined on the platform #298
-
-Version 0.9.3, Beta 2
-=============
-
-libmdb:
-* Migrate to g_memdup2 #287 #288
-
-libmdbsql:
-* Allow double quoted (") database names #291
-* Allow spaces in database names #292 #293
-
-Docs:
-* Add JET version for access 2013/2016/2019 to docs #286
-
-Version 0.9.3, Beta 1
+Version 0.9.3
 =============
 
 libmdb:
 * Support files created with Access 2019 #260 #277
 * Fix a warning when reading in binary property values #262
 * Fix signed-unsigned comparison warning #269
+* Migrate to `g_memdup2` #287 #288
+* Fix build when `_XOPEN_SOURCE` was already defined on the platform #298
+* Fix build failure with emscripten #299
 
 libmdbsql:
 * Support negative floating point literals #274 #279
-* Comparison operators behaved incorrectly when the constant was on the left #283 #285
 * Improved support for file paths in `CONNECT TO` statements #275 #280 #282
+* Comparison operators behaved incorrectly when the constant was on the left #283 #285
+* Allow double quoted (") database names #291
+* Allow spaces in database names #292 #293
 
 ODBC:
 * unixODBC now uses the `--libdir` passed at configure-time #261
 * Fix a segfault in PyODBC when `SQLGetTypeInfo` is called on an unsupported data type #278
 
+Docs:
+* Add JET version for access 2013/2016/2019 to docs #286
+
 Version 0.9.2
 =============
 
 MDB Tools 0.9.2 is a security and bug-fix release. Due to a number of memory
 errors uncovered by OSS-Fuzz, all users who use MDB Tools to read data from
diff --git a/configure.ac b/configure.ac
index 063935e..c52c9f9 100644
--- a/configure.ac
+++ b/configure.ac
@@ -1,7 +1,7 @@
 dnl Process this file with autoconf to produce a configure script.
-AC_INIT([mdbtools],[0.9.3-beta4],[https://github.com/mdbtools/mdbtools/issues],[],[https://github.com/mdbtools/mdbtools])
+AC_INIT([mdbtools],[0.9.3],[https://github.com/mdbtools/mdbtools/issues],[],[https://github.com/mdbtools/mdbtools])
 AC_CONFIG_MACRO_DIR([m4])
 AC_CONFIG_AUX_DIR([build-aux])
 AC_CONFIG_SRCDIR(src/extras/mdb-dump.c)
 AM_INIT_AUTOMAKE([foreign dist-zip])
 

Vulnerable code: Version 0.9.3, Beta 4
=============

libmdb:
* Fix build failure with emscripten #299

Version 0.9.3, Beta 3
=============

libmdb / libmdbsql:
* Fix build when _XOPEN_SOURCE was already defined on the platform #298

Version 0.9.3, Beta 2
=============

libmdb:
* Migrate to g_memdup2 #287 #288

libmdbsql:
* Allow double quoted (") database names #291
* Allow spaces in database names #292 #293

Docs:
* Add JET version for access 2013/2016/2019 to docs #286

Version 0.9.3, Beta 1
* Comparison operators behaved incorrectly when the constant was on the left #283 #285
AC_INIT([mdbtools],[0.9.3-beta4],[https://github.com/mdbtools/mdbtools/issues],[],[https://github.com/mdbtools/mdbtools])
Fixed code: Version 0.9.3
* Migrate to `g_memdup2` #287 #288
* Fix build when `_XOPEN_SOURCE` was already defined on the platform #298
* Fix build failure with emscripten #299
* Comparison operators behaved incorrectly when the constant was on the left #283 #285
* Allow double quoted (") database names #291
* Allow spaces in database names #292 #293
Docs:
* Add JET version for access 2013/2016/2019 to docs #286

AC_INIT([mdbtools],[0.9.3],[https://github.com/mdbtools/mdbtools/issues],[],[https://github.com/mdbtools/mdbtools])