https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 06:06:37 +0000 https://vulnerability.circl.lu/vuln/cve-2017-15099 <p><strong>Affected:</strong> Red Hat, Inc. postgresql</p> <p>INSERT ... ON CONFLICT DO UPDATE commands in PostgreSQL 10.x before 10.1, 9.6.x before 9.6.6, and 9.5.x before 9.5.10 disclose table contents that the invoker lacks privilege to read. These exploits affect only tables where the attacker lacks full read access but has both INSERT and UPDATE privileges. Exploits bypass row level security policies and lack of SELECT privilege.</p> <p><strong>Affected:</strong> Red Hat, Inc. postgresql</p> <p>INSERT ... ON CONFLICT DO UPDATE commands in PostgreSQL 10.x before 10.1, 9.6.x before 9.6.6, and 9.5.x before 9.5.10 disclose table contents that the invoker lacks privilege to read. These exploits affect only tables where the attacker lacks full read access but has both INSERT and UPDATE privileges. Exploits bypass row level security policies and lack of SELECT privilege.</p> https://vulnerability.circl.lu/vuln/cve-2017-15099 https://vulnerability.circl.lu/vuln/usn-3479-1 <p><strong>Affected:</strong> Ubuntu:14.04:LTS: postgresql-9.3, Ubuntu:16.04:LTS: postgresql-9.5</p> <p>David Rowley discovered that PostgreSQL incorrectly handled memory when processing certain JSON functions. A remote attacker could possibly use this issue to obtain sensitive information. (CVE-2017-15098)</p> <p>Dean Rasheed discovered that PostgreSQL incorrectly enforced SELECT privileges when processing INSERT ... ON CONFLICT DO UPDATE commands. A remote attacker could possibly use this issue to obtain sensitive information. This issue only affected Ubuntu 16.04 LTS, Ubuntu 17.04 and Ubuntu 17.10.</p> <p><strong>Affected:</strong> Ubuntu:14.04:LTS: postgresql-9.3, Ubuntu:16.04:LTS: postgresql-9.5</p> <p>David Rowley discovered that PostgreSQL incorrectly handled memory when processing certain JSON functions. A remote attacker could possibly use this issue to obtain sensitive information. (CVE-2017-15098)</p> <p>Dean Rasheed discovered that PostgreSQL incorrectly enforced SELECT privileges when processing INSERT ... ON CONFLICT DO UPDATE commands. A remote attacker could possibly use this issue to obtain sensitive information. This issue only affected Ubuntu 16.04 LTS, Ubuntu 17.04 and Ubuntu 17.10.</p> https://vulnerability.circl.lu/vuln/usn-3479-1