CVE-2008-3389: Ingres

Medium severity, CVSS 4.6. EPSS: 0.4% chance of exploitation in the next 30 days.

Stack-based buffer overflow in the libbecompat library in Ingres 2.6, Ingres 2006 release 1 (aka 9.0.4), and Ingres 2006 release 2 (aka 9.1.0) on Linux and HP-UX allows local users to gain privileges by setting a long value of an environment variable before running (1) verifydb, (2) iimerge, or (3) csreport.

Affected products

• Ingres Ingres: version 2.6 only; version 2006 only

Published 2008-08-05. Last modified 2026-06-16.