CVE-2024-57654

What it actually does

The flaw in the qst_vec_get_int64 component allows crafted SQL statements to trigger a denial of service condition that crashes or hangs the database process.

Why it matters to the business

Service availability is lost until the affected database instance is restarted, interrupting dependent applications and potentially causing operational downtime.

How an attack unfolds

An attacker with database connectivity submits specially crafted SQL statements that reach the vulnerable qst_vec_get_int64 path, causing the server to terminate or become unresponsive.

How to fix it

Upgrade flashplugin-nonfree on Ubuntu 14.04 LTS to version 11.2.202.632ubuntu0.14.04.1 or later; apply equivalent updates for any downstream packages that embed the affected virtuoso-opensource component.

How to confirm the fix worked

Confirm the installed package version matches or exceeds the listed fixed releases, then execute test queries that previously triggered the issue to verify stability.

Typical attack path

1. Obtain network or local access to a database instance running the vulnerable version
2. Prepare and submit crafted SQL statements targeting the qst_vec_get_int64 component
3. Trigger repeated execution to sustain the denial of service

How to detect it

Review database error and crash logs for entries around the time of unexpected terminations, focusing on SQL statement execution failures in the qst_vec_get_int64 path.

What your security team should do

• Prioritize patching of all instances listed in the affected products within the next maintenance window
• Restrict direct SQL access from untrusted sources until patches are deployed
• Enable query logging and resource monitoring to detect anomalous statement patterns