Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
18 vulnerabilities found for postgresql by PostgreSQL Global Development Group
CVE-2015-0241 (GCVE-0-2015-0241)
Vulnerability from cvelistv5 – Published: 2020-01-27 15:29 – Updated: 2024-08-06 04:03
VLAI
Summary
The to_char function in PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1 allows remote authenticated users to cause a denial of service (crash) or possibly execute arbitrary code via a (1) large number of digits when processing a numeric formatting template, which triggers a buffer over-read, or (2) crafted timestamp formatting template, which triggers a buffer overflow.
Severity
No CVSS data available.
CWE
- Other
Assigner
References
7 references
| URL | Tags |
|---|---|
| http://www.postgresql.org/docs/9.4/static/release… | x_refsource_CONFIRM |
| http://www.postgresql.org/docs/current/static/rel… | x_refsource_CONFIRM |
| http://www.postgresql.org/docs/current/static/rel… | x_refsource_CONFIRM |
| http://www.postgresql.org/docs/current/static/rel… | x_refsource_CONFIRM |
| http://www.postgresql.org/docs/current/static/rel… | x_refsource_CONFIRM |
| http://www.postgresql.org/about/news/1569/ | x_refsource_CONFIRM |
| http://www.debian.org/security/2015/dsa-3155 | x_refsource_CONFIRM |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| PostgreSQL Global Development Group | PostgreSQL |
Affected:
before 9.0.19
Affected: 9.1.x before 9.1.15 Affected: 9.2.x before 9.2.10 Affected: 9.3.x before 9.3.6 Affected: 9.4.x before 9.4.1 |
Date Public
2015-02-05 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T04:03:10.441Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.postgresql.org/docs/9.4/static/release-9-4-1.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.postgresql.org/docs/current/static/release-9-0-19.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.postgresql.org/docs/current/static/release-9-1-15.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.postgresql.org/docs/current/static/release-9-2-10.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.postgresql.org/docs/current/static/release-9-3-6.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.postgresql.org/about/news/1569/"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.debian.org/security/2015/dsa-3155"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "PostgreSQL",
"vendor": "PostgreSQL Global Development Group",
"versions": [
{
"status": "affected",
"version": "before 9.0.19"
},
{
"status": "affected",
"version": "9.1.x before 9.1.15"
},
{
"status": "affected",
"version": "9.2.x before 9.2.10"
},
{
"status": "affected",
"version": "9.3.x before 9.3.6"
},
{
"status": "affected",
"version": "9.4.x before 9.4.1"
}
]
}
],
"datePublic": "2015-02-05T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "The to_char function in PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1 allows remote authenticated users to cause a denial of service (crash) or possibly execute arbitrary code via a (1) large number of digits when processing a numeric formatting template, which triggers a buffer over-read, or (2) crafted timestamp formatting template, which triggers a buffer overflow."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Other",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-01-27T15:29:37.000Z",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.postgresql.org/docs/9.4/static/release-9-4-1.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.postgresql.org/docs/current/static/release-9-0-19.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.postgresql.org/docs/current/static/release-9-1-15.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.postgresql.org/docs/current/static/release-9-2-10.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.postgresql.org/docs/current/static/release-9-3-6.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.postgresql.org/about/news/1569/"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.debian.org/security/2015/dsa-3155"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "secalert@redhat.com",
"ID": "CVE-2015-0241",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "PostgreSQL",
"version": {
"version_data": [
{
"version_value": "before 9.0.19"
},
{
"version_value": "9.1.x before 9.1.15"
},
{
"version_value": "9.2.x before 9.2.10"
},
{
"version_value": "9.3.x before 9.3.6"
},
{
"version_value": "9.4.x before 9.4.1"
}
]
}
}
]
},
"vendor_name": "PostgreSQL Global Development Group"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The to_char function in PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1 allows remote authenticated users to cause a denial of service (crash) or possibly execute arbitrary code via a (1) large number of digits when processing a numeric formatting template, which triggers a buffer over-read, or (2) crafted timestamp formatting template, which triggers a buffer overflow."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Other"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.postgresql.org/docs/9.4/static/release-9-4-1.html",
"refsource": "CONFIRM",
"url": "http://www.postgresql.org/docs/9.4/static/release-9-4-1.html"
},
{
"name": "http://www.postgresql.org/docs/current/static/release-9-0-19.html",
"refsource": "CONFIRM",
"url": "http://www.postgresql.org/docs/current/static/release-9-0-19.html"
},
{
"name": "http://www.postgresql.org/docs/current/static/release-9-1-15.html",
"refsource": "CONFIRM",
"url": "http://www.postgresql.org/docs/current/static/release-9-1-15.html"
},
{
"name": "http://www.postgresql.org/docs/current/static/release-9-2-10.html",
"refsource": "CONFIRM",
"url": "http://www.postgresql.org/docs/current/static/release-9-2-10.html"
},
{
"name": "http://www.postgresql.org/docs/current/static/release-9-3-6.html",
"refsource": "CONFIRM",
"url": "http://www.postgresql.org/docs/current/static/release-9-3-6.html"
},
{
"name": "http://www.postgresql.org/about/news/1569/",
"refsource": "CONFIRM",
"url": "http://www.postgresql.org/about/news/1569/"
},
{
"name": "http://www.debian.org/security/2015/dsa-3155",
"refsource": "CONFIRM",
"url": "http://www.debian.org/security/2015/dsa-3155"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2015-0241",
"datePublished": "2020-01-27T15:29:37.000Z",
"dateReserved": "2014-11-18T00:00:00.000Z",
"dateUpdated": "2024-08-06T04:03:10.441Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2015-0242 (GCVE-0-2015-0242)
Vulnerability from cvelistv5 – Published: 2020-01-27 15:29 – Updated: 2024-08-06 04:03
VLAI
Summary
Stack-based buffer overflow in the *printf function implementations in PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1, when running on a Windows system, allows remote authenticated users to cause a denial of service (crash) and possibly execute arbitrary code via a floating point number with a large precision, as demonstrated by using the to_char function.
Severity
No CVSS data available.
CWE
- Buffer Overflow
Assigner
References
7 references
| URL | Tags |
|---|---|
| http://www.postgresql.org/docs/9.4/static/release… | x_refsource_CONFIRM |
| http://www.postgresql.org/docs/current/static/rel… | x_refsource_CONFIRM |
| http://www.postgresql.org/docs/current/static/rel… | x_refsource_CONFIRM |
| http://www.postgresql.org/docs/current/static/rel… | x_refsource_CONFIRM |
| http://www.postgresql.org/docs/current/static/rel… | x_refsource_CONFIRM |
| http://www.postgresql.org/about/news/1569/ | x_refsource_CONFIRM |
| http://www.debian.org/security/2015/dsa-3155 | x_refsource_CONFIRM |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| PostgreSQL Global Development Group | PostgreSQL |
Affected:
before 9.0.19
Affected: 9.1.x before 9.1.15 Affected: 9.2.x before 9.2.10 Affected: 9.3.x before 9.3.6 Affected: 9.4.x before 9.4.1 |
Date Public
2015-02-05 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T04:03:10.439Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.postgresql.org/docs/9.4/static/release-9-4-1.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.postgresql.org/docs/current/static/release-9-0-19.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.postgresql.org/docs/current/static/release-9-1-15.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.postgresql.org/docs/current/static/release-9-2-10.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.postgresql.org/docs/current/static/release-9-3-6.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.postgresql.org/about/news/1569/"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.debian.org/security/2015/dsa-3155"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "PostgreSQL",
"vendor": "PostgreSQL Global Development Group",
"versions": [
{
"status": "affected",
"version": "before 9.0.19"
},
{
"status": "affected",
"version": "9.1.x before 9.1.15"
},
{
"status": "affected",
"version": "9.2.x before 9.2.10"
},
{
"status": "affected",
"version": "9.3.x before 9.3.6"
},
{
"status": "affected",
"version": "9.4.x before 9.4.1"
}
]
}
],
"datePublic": "2015-02-05T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Stack-based buffer overflow in the *printf function implementations in PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1, when running on a Windows system, allows remote authenticated users to cause a denial of service (crash) and possibly execute arbitrary code via a floating point number with a large precision, as demonstrated by using the to_char function."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Buffer Overflow",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-01-27T15:29:33.000Z",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.postgresql.org/docs/9.4/static/release-9-4-1.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.postgresql.org/docs/current/static/release-9-0-19.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.postgresql.org/docs/current/static/release-9-1-15.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.postgresql.org/docs/current/static/release-9-2-10.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.postgresql.org/docs/current/static/release-9-3-6.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.postgresql.org/about/news/1569/"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.debian.org/security/2015/dsa-3155"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "secalert@redhat.com",
"ID": "CVE-2015-0242",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "PostgreSQL",
"version": {
"version_data": [
{
"version_value": "before 9.0.19"
},
{
"version_value": "9.1.x before 9.1.15"
},
{
"version_value": "9.2.x before 9.2.10"
},
{
"version_value": "9.3.x before 9.3.6"
},
{
"version_value": "9.4.x before 9.4.1"
}
]
}
}
]
},
"vendor_name": "PostgreSQL Global Development Group"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Stack-based buffer overflow in the *printf function implementations in PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1, when running on a Windows system, allows remote authenticated users to cause a denial of service (crash) and possibly execute arbitrary code via a floating point number with a large precision, as demonstrated by using the to_char function."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Buffer Overflow"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.postgresql.org/docs/9.4/static/release-9-4-1.html",
"refsource": "CONFIRM",
"url": "http://www.postgresql.org/docs/9.4/static/release-9-4-1.html"
},
{
"name": "http://www.postgresql.org/docs/current/static/release-9-0-19.html",
"refsource": "CONFIRM",
"url": "http://www.postgresql.org/docs/current/static/release-9-0-19.html"
},
{
"name": "http://www.postgresql.org/docs/current/static/release-9-1-15.html",
"refsource": "CONFIRM",
"url": "http://www.postgresql.org/docs/current/static/release-9-1-15.html"
},
{
"name": "http://www.postgresql.org/docs/current/static/release-9-2-10.html",
"refsource": "CONFIRM",
"url": "http://www.postgresql.org/docs/current/static/release-9-2-10.html"
},
{
"name": "http://www.postgresql.org/docs/current/static/release-9-3-6.html",
"refsource": "CONFIRM",
"url": "http://www.postgresql.org/docs/current/static/release-9-3-6.html"
},
{
"name": "http://www.postgresql.org/about/news/1569/",
"refsource": "CONFIRM",
"url": "http://www.postgresql.org/about/news/1569/"
},
{
"name": "http://www.debian.org/security/2015/dsa-3155",
"refsource": "CONFIRM",
"url": "http://www.debian.org/security/2015/dsa-3155"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2015-0242",
"datePublished": "2020-01-27T15:29:33.000Z",
"dateReserved": "2014-11-18T00:00:00.000Z",
"dateUpdated": "2024-08-06T04:03:10.439Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2015-0243 (GCVE-0-2015-0243)
Vulnerability from cvelistv5 – Published: 2020-01-27 15:29 – Updated: 2024-08-06 04:03
VLAI
Summary
Multiple buffer overflows in contrib/pgcrypto in PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1 allow remote authenticated users to cause a denial of service (crash) and possibly execute arbitrary code via unspecified vectors.
Severity
No CVSS data available.
CWE
- Buffer Overflow
Assigner
References
7 references
| URL | Tags |
|---|---|
| http://www.postgresql.org/docs/9.4/static/release… | x_refsource_CONFIRM |
| http://www.postgresql.org/docs/current/static/rel… | x_refsource_CONFIRM |
| http://www.postgresql.org/docs/current/static/rel… | x_refsource_CONFIRM |
| http://www.postgresql.org/docs/current/static/rel… | x_refsource_CONFIRM |
| http://www.postgresql.org/docs/current/static/rel… | x_refsource_CONFIRM |
| http://www.postgresql.org/about/news/1569/ | x_refsource_CONFIRM |
| http://www.debian.org/security/2015/dsa-3155 | x_refsource_CONFIRM |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| PostgreSQL Global Development Group | PostgreSQL |
Affected:
before 9.0.19
Affected: 9.1.x before 9.1.15 Affected: 9.2.x before 9.2.10 Affected: 9.3.x before 9.3.6 Affected: 9.4.x before 9.4.1 |
Date Public
2015-02-05 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T04:03:10.702Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.postgresql.org/docs/9.4/static/release-9-4-1.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.postgresql.org/docs/current/static/release-9-0-19.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.postgresql.org/docs/current/static/release-9-1-15.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.postgresql.org/docs/current/static/release-9-2-10.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.postgresql.org/docs/current/static/release-9-3-6.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.postgresql.org/about/news/1569/"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.debian.org/security/2015/dsa-3155"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "PostgreSQL",
"vendor": "PostgreSQL Global Development Group",
"versions": [
{
"status": "affected",
"version": "before 9.0.19"
},
{
"status": "affected",
"version": "9.1.x before 9.1.15"
},
{
"status": "affected",
"version": "9.2.x before 9.2.10"
},
{
"status": "affected",
"version": "9.3.x before 9.3.6"
},
{
"status": "affected",
"version": "9.4.x before 9.4.1"
}
]
}
],
"datePublic": "2015-02-05T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Multiple buffer overflows in contrib/pgcrypto in PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1 allow remote authenticated users to cause a denial of service (crash) and possibly execute arbitrary code via unspecified vectors."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Buffer Overflow",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-01-27T15:29:28.000Z",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.postgresql.org/docs/9.4/static/release-9-4-1.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.postgresql.org/docs/current/static/release-9-0-19.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.postgresql.org/docs/current/static/release-9-1-15.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.postgresql.org/docs/current/static/release-9-2-10.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.postgresql.org/docs/current/static/release-9-3-6.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.postgresql.org/about/news/1569/"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.debian.org/security/2015/dsa-3155"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "secalert@redhat.com",
"ID": "CVE-2015-0243",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "PostgreSQL",
"version": {
"version_data": [
{
"version_value": "before 9.0.19"
},
{
"version_value": "9.1.x before 9.1.15"
},
{
"version_value": "9.2.x before 9.2.10"
},
{
"version_value": "9.3.x before 9.3.6"
},
{
"version_value": "9.4.x before 9.4.1"
}
]
}
}
]
},
"vendor_name": "PostgreSQL Global Development Group"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple buffer overflows in contrib/pgcrypto in PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1 allow remote authenticated users to cause a denial of service (crash) and possibly execute arbitrary code via unspecified vectors."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Buffer Overflow"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.postgresql.org/docs/9.4/static/release-9-4-1.html",
"refsource": "CONFIRM",
"url": "http://www.postgresql.org/docs/9.4/static/release-9-4-1.html"
},
{
"name": "http://www.postgresql.org/docs/current/static/release-9-0-19.html",
"refsource": "CONFIRM",
"url": "http://www.postgresql.org/docs/current/static/release-9-0-19.html"
},
{
"name": "http://www.postgresql.org/docs/current/static/release-9-1-15.html",
"refsource": "CONFIRM",
"url": "http://www.postgresql.org/docs/current/static/release-9-1-15.html"
},
{
"name": "http://www.postgresql.org/docs/current/static/release-9-2-10.html",
"refsource": "CONFIRM",
"url": "http://www.postgresql.org/docs/current/static/release-9-2-10.html"
},
{
"name": "http://www.postgresql.org/docs/current/static/release-9-3-6.html",
"refsource": "CONFIRM",
"url": "http://www.postgresql.org/docs/current/static/release-9-3-6.html"
},
{
"name": "http://www.postgresql.org/about/news/1569/",
"refsource": "CONFIRM",
"url": "http://www.postgresql.org/about/news/1569/"
},
{
"name": "http://www.debian.org/security/2015/dsa-3155",
"refsource": "CONFIRM",
"url": "http://www.debian.org/security/2015/dsa-3155"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2015-0243",
"datePublished": "2020-01-27T15:29:28.000Z",
"dateReserved": "2014-11-18T00:00:00.000Z",
"dateUpdated": "2024-08-06T04:03:10.702Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2015-0244 (GCVE-0-2015-0244)
Vulnerability from cvelistv5 – Published: 2020-01-27 15:29 – Updated: 2024-08-06 04:03
VLAI
Summary
PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1 does not properly handle errors while reading a protocol message, which allows remote attackers to conduct SQL injection attacks via crafted binary data in a parameter and causing an error, which triggers the loss of synchronization and part of the protocol message to be treated as a new message, as demonstrated by causing a timeout or query cancellation.
Severity
No CVSS data available.
CWE
- Other
Assigner
References
7 references
| URL | Tags |
|---|---|
| http://www.postgresql.org/docs/9.4/static/release… | x_refsource_CONFIRM |
| http://www.postgresql.org/docs/current/static/rel… | x_refsource_CONFIRM |
| http://www.postgresql.org/docs/current/static/rel… | x_refsource_CONFIRM |
| http://www.postgresql.org/docs/current/static/rel… | x_refsource_CONFIRM |
| http://www.postgresql.org/docs/current/static/rel… | x_refsource_CONFIRM |
| http://www.postgresql.org/about/news/1569/ | x_refsource_CONFIRM |
| http://www.debian.org/security/2015/dsa-3155 | x_refsource_CONFIRM |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| PostgreSQL Global Development Group | PostgreSQL |
Affected:
before 9.0.19
Affected: 9.1.x before 9.1.15 Affected: 9.2.x before 9.2.10 Affected: 9.3.x before 9.3.6 Affected: 9.4.x before 9.4.1 |
Date Public
2015-02-05 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T04:03:10.495Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.postgresql.org/docs/9.4/static/release-9-4-1.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.postgresql.org/docs/current/static/release-9-0-19.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.postgresql.org/docs/current/static/release-9-1-15.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.postgresql.org/docs/current/static/release-9-2-10.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.postgresql.org/docs/current/static/release-9-3-6.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.postgresql.org/about/news/1569/"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.debian.org/security/2015/dsa-3155"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "PostgreSQL",
"vendor": "PostgreSQL Global Development Group",
"versions": [
{
"status": "affected",
"version": "before 9.0.19"
},
{
"status": "affected",
"version": "9.1.x before 9.1.15"
},
{
"status": "affected",
"version": "9.2.x before 9.2.10"
},
{
"status": "affected",
"version": "9.3.x before 9.3.6"
},
{
"status": "affected",
"version": "9.4.x before 9.4.1"
}
]
}
],
"datePublic": "2015-02-05T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1 does not properly handle errors while reading a protocol message, which allows remote attackers to conduct SQL injection attacks via crafted binary data in a parameter and causing an error, which triggers the loss of synchronization and part of the protocol message to be treated as a new message, as demonstrated by causing a timeout or query cancellation."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Other",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-01-27T15:29:25.000Z",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.postgresql.org/docs/9.4/static/release-9-4-1.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.postgresql.org/docs/current/static/release-9-0-19.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.postgresql.org/docs/current/static/release-9-1-15.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.postgresql.org/docs/current/static/release-9-2-10.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.postgresql.org/docs/current/static/release-9-3-6.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.postgresql.org/about/news/1569/"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.debian.org/security/2015/dsa-3155"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "secalert@redhat.com",
"ID": "CVE-2015-0244",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "PostgreSQL",
"version": {
"version_data": [
{
"version_value": "before 9.0.19"
},
{
"version_value": "9.1.x before 9.1.15"
},
{
"version_value": "9.2.x before 9.2.10"
},
{
"version_value": "9.3.x before 9.3.6"
},
{
"version_value": "9.4.x before 9.4.1"
}
]
}
}
]
},
"vendor_name": "PostgreSQL Global Development Group"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1 does not properly handle errors while reading a protocol message, which allows remote attackers to conduct SQL injection attacks via crafted binary data in a parameter and causing an error, which triggers the loss of synchronization and part of the protocol message to be treated as a new message, as demonstrated by causing a timeout or query cancellation."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Other"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.postgresql.org/docs/9.4/static/release-9-4-1.html",
"refsource": "CONFIRM",
"url": "http://www.postgresql.org/docs/9.4/static/release-9-4-1.html"
},
{
"name": "http://www.postgresql.org/docs/current/static/release-9-0-19.html",
"refsource": "CONFIRM",
"url": "http://www.postgresql.org/docs/current/static/release-9-0-19.html"
},
{
"name": "http://www.postgresql.org/docs/current/static/release-9-1-15.html",
"refsource": "CONFIRM",
"url": "http://www.postgresql.org/docs/current/static/release-9-1-15.html"
},
{
"name": "http://www.postgresql.org/docs/current/static/release-9-2-10.html",
"refsource": "CONFIRM",
"url": "http://www.postgresql.org/docs/current/static/release-9-2-10.html"
},
{
"name": "http://www.postgresql.org/docs/current/static/release-9-3-6.html",
"refsource": "CONFIRM",
"url": "http://www.postgresql.org/docs/current/static/release-9-3-6.html"
},
{
"name": "http://www.postgresql.org/about/news/1569/",
"refsource": "CONFIRM",
"url": "http://www.postgresql.org/about/news/1569/"
},
{
"name": "http://www.debian.org/security/2015/dsa-3155",
"refsource": "CONFIRM",
"url": "http://www.debian.org/security/2015/dsa-3155"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2015-0244",
"datePublished": "2020-01-27T15:29:25.000Z",
"dateReserved": "2014-11-18T00:00:00.000Z",
"dateUpdated": "2024-08-06T04:03:10.495Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2014-8161 (GCVE-0-2014-8161)
Vulnerability from cvelistv5 – Published: 2020-01-27 15:29 – Updated: 2024-08-06 13:10
VLAI
Summary
PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1 allows remote authenticated users to obtain sensitive column values by triggering constraint violation and then reading the error message.
Severity
No CVSS data available.
CWE
- Path Disclosure
Assigner
References
7 references
| URL | Tags |
|---|---|
| http://www.postgresql.org/docs/9.4/static/release… | x_refsource_CONFIRM |
| http://www.postgresql.org/docs/current/static/rel… | x_refsource_CONFIRM |
| http://www.postgresql.org/docs/current/static/rel… | x_refsource_CONFIRM |
| http://www.postgresql.org/docs/current/static/rel… | x_refsource_CONFIRM |
| http://www.postgresql.org/docs/current/static/rel… | x_refsource_CONFIRM |
| http://www.postgresql.org/about/news/1569/ | x_refsource_CONFIRM |
| http://www.debian.org/security/2015/dsa-3155 | x_refsource_CONFIRM |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| PostgreSQL Global Development Group | PostgreSQL |
Affected:
before 9.0.19
Affected: 9.1.x before 9.1.15 Affected: 9.2.x before 9.2.10 Affected: 9.3.x before 9.3.6 Affected: 9.4.x before 9.4.1 |
Date Public
2015-02-05 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T13:10:51.110Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.postgresql.org/docs/9.4/static/release-9-4-1.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.postgresql.org/docs/current/static/release-9-0-19.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.postgresql.org/docs/current/static/release-9-1-15.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.postgresql.org/docs/current/static/release-9-2-10.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.postgresql.org/docs/current/static/release-9-3-6.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.postgresql.org/about/news/1569/"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.debian.org/security/2015/dsa-3155"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "PostgreSQL",
"vendor": "PostgreSQL Global Development Group",
"versions": [
{
"status": "affected",
"version": "before 9.0.19"
},
{
"status": "affected",
"version": "9.1.x before 9.1.15"
},
{
"status": "affected",
"version": "9.2.x before 9.2.10"
},
{
"status": "affected",
"version": "9.3.x before 9.3.6"
},
{
"status": "affected",
"version": "9.4.x before 9.4.1"
}
]
}
],
"datePublic": "2015-02-05T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1 allows remote authenticated users to obtain sensitive column values by triggering constraint violation and then reading the error message."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Path Disclosure",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-01-27T15:29:21.000Z",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.postgresql.org/docs/9.4/static/release-9-4-1.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.postgresql.org/docs/current/static/release-9-0-19.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.postgresql.org/docs/current/static/release-9-1-15.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.postgresql.org/docs/current/static/release-9-2-10.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.postgresql.org/docs/current/static/release-9-3-6.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.postgresql.org/about/news/1569/"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.debian.org/security/2015/dsa-3155"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "secalert@redhat.com",
"ID": "CVE-2014-8161",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "PostgreSQL",
"version": {
"version_data": [
{
"version_value": "before 9.0.19"
},
{
"version_value": "9.1.x before 9.1.15"
},
{
"version_value": "9.2.x before 9.2.10"
},
{
"version_value": "9.3.x before 9.3.6"
},
{
"version_value": "9.4.x before 9.4.1"
}
]
}
}
]
},
"vendor_name": "PostgreSQL Global Development Group"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1 allows remote authenticated users to obtain sensitive column values by triggering constraint violation and then reading the error message."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Path Disclosure"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.postgresql.org/docs/9.4/static/release-9-4-1.html",
"refsource": "CONFIRM",
"url": "http://www.postgresql.org/docs/9.4/static/release-9-4-1.html"
},
{
"name": "http://www.postgresql.org/docs/current/static/release-9-0-19.html",
"refsource": "CONFIRM",
"url": "http://www.postgresql.org/docs/current/static/release-9-0-19.html"
},
{
"name": "http://www.postgresql.org/docs/current/static/release-9-1-15.html",
"refsource": "CONFIRM",
"url": "http://www.postgresql.org/docs/current/static/release-9-1-15.html"
},
{
"name": "http://www.postgresql.org/docs/current/static/release-9-2-10.html",
"refsource": "CONFIRM",
"url": "http://www.postgresql.org/docs/current/static/release-9-2-10.html"
},
{
"name": "http://www.postgresql.org/docs/current/static/release-9-3-6.html",
"refsource": "CONFIRM",
"url": "http://www.postgresql.org/docs/current/static/release-9-3-6.html"
},
{
"name": "http://www.postgresql.org/about/news/1569/",
"refsource": "CONFIRM",
"url": "http://www.postgresql.org/about/news/1569/"
},
{
"name": "http://www.debian.org/security/2015/dsa-3155",
"refsource": "CONFIRM",
"url": "http://www.debian.org/security/2015/dsa-3155"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2014-8161",
"datePublished": "2020-01-27T15:29:21.000Z",
"dateReserved": "2014-10-10T00:00:00.000Z",
"dateUpdated": "2024-08-06T13:10:51.110Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2015-3166 (GCVE-0-2015-3166)
Vulnerability from cvelistv5 – Published: 2019-11-20 20:50 – Updated: 2024-08-06 05:39
VLAI
Summary
The snprintf implementation in PostgreSQL before 9.0.20, 9.1.x before 9.1.16, 9.2.x before 9.2.11, 9.3.x before 9.3.7, and 9.4.x before 9.4.2 does not properly handle system-call errors, which allows attackers to obtain sensitive information or have other unspecified impact via unknown vectors, as demonstrated by an out-of-memory error.
Severity
No CVSS data available.
CWE
- Other
Assigner
References
9 references
| URL | Tags |
|---|---|
| http://www.postgresql.org/about/news/1587/ | x_refsource_MISC |
| http://www.postgresql.org/docs/9.0/static/release… | x_refsource_MISC |
| http://www.postgresql.org/docs/9.1/static/release… | x_refsource_MISC |
| http://www.postgresql.org/docs/9.2/static/release… | x_refsource_MISC |
| http://www.postgresql.org/docs/9.3/static/release… | x_refsource_MISC |
| http://www.postgresql.org/docs/9.4/static/release… | x_refsource_MISC |
| http://www.debian.org/security/2015/dsa-3269 | x_refsource_MISC |
| http://www.debian.org/security/2015/dsa-3270 | x_refsource_MISC |
| http://ubuntu.com/usn/usn-2621-1 | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| PostgreSQL Global Development Group | PostgreSQL |
Affected:
before 9.0.20
Affected: 9.1.x before 9.1.16 Affected: 9.2.x before 9.2.11 Affected: 9.3.x before 9.3.7 Affected: and 9.4.x before 9.4.2 |
Date Public
2015-05-22 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T05:39:31.938Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.postgresql.org/about/news/1587/"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.postgresql.org/docs/9.0/static/release-9-0-20.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.postgresql.org/docs/9.1/static/release-9-1-16.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.postgresql.org/docs/9.2/static/release-9-2-11.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.postgresql.org/docs/9.3/static/release-9-3-7.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.postgresql.org/docs/9.4/static/release-9-4-2.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.debian.org/security/2015/dsa-3269"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.debian.org/security/2015/dsa-3270"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://ubuntu.com/usn/usn-2621-1"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "PostgreSQL",
"vendor": "PostgreSQL Global Development Group",
"versions": [
{
"status": "affected",
"version": "before 9.0.20"
},
{
"status": "affected",
"version": "9.1.x before 9.1.16"
},
{
"status": "affected",
"version": "9.2.x before 9.2.11"
},
{
"status": "affected",
"version": "9.3.x before 9.3.7"
},
{
"status": "affected",
"version": "and 9.4.x before 9.4.2"
}
]
}
],
"datePublic": "2015-05-22T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "The snprintf implementation in PostgreSQL before 9.0.20, 9.1.x before 9.1.16, 9.2.x before 9.2.11, 9.3.x before 9.3.7, and 9.4.x before 9.4.2 does not properly handle system-call errors, which allows attackers to obtain sensitive information or have other unspecified impact via unknown vectors, as demonstrated by an out-of-memory error."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Other",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-11-20T20:50:16.000Z",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.postgresql.org/about/news/1587/"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.postgresql.org/docs/9.0/static/release-9-0-20.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.postgresql.org/docs/9.1/static/release-9-1-16.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.postgresql.org/docs/9.2/static/release-9-2-11.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.postgresql.org/docs/9.3/static/release-9-3-7.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.postgresql.org/docs/9.4/static/release-9-4-2.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.debian.org/security/2015/dsa-3269"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.debian.org/security/2015/dsa-3270"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://ubuntu.com/usn/usn-2621-1"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "secalert@redhat.com",
"ID": "CVE-2015-3166",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "PostgreSQL",
"version": {
"version_data": [
{
"version_value": "before 9.0.20"
},
{
"version_value": "9.1.x before 9.1.16"
},
{
"version_value": "9.2.x before 9.2.11"
},
{
"version_value": "9.3.x before 9.3.7"
},
{
"version_value": "and 9.4.x before 9.4.2"
}
]
}
}
]
},
"vendor_name": "PostgreSQL Global Development Group"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The snprintf implementation in PostgreSQL before 9.0.20, 9.1.x before 9.1.16, 9.2.x before 9.2.11, 9.3.x before 9.3.7, and 9.4.x before 9.4.2 does not properly handle system-call errors, which allows attackers to obtain sensitive information or have other unspecified impact via unknown vectors, as demonstrated by an out-of-memory error."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Other"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.postgresql.org/about/news/1587/",
"refsource": "MISC",
"url": "http://www.postgresql.org/about/news/1587/"
},
{
"name": "http://www.postgresql.org/docs/9.0/static/release-9-0-20.html",
"refsource": "MISC",
"url": "http://www.postgresql.org/docs/9.0/static/release-9-0-20.html"
},
{
"name": "http://www.postgresql.org/docs/9.1/static/release-9-1-16.html",
"refsource": "MISC",
"url": "http://www.postgresql.org/docs/9.1/static/release-9-1-16.html"
},
{
"name": "http://www.postgresql.org/docs/9.2/static/release-9-2-11.html",
"refsource": "MISC",
"url": "http://www.postgresql.org/docs/9.2/static/release-9-2-11.html"
},
{
"name": "http://www.postgresql.org/docs/9.3/static/release-9-3-7.html",
"refsource": "MISC",
"url": "http://www.postgresql.org/docs/9.3/static/release-9-3-7.html"
},
{
"name": "http://www.postgresql.org/docs/9.4/static/release-9-4-2.html",
"refsource": "MISC",
"url": "http://www.postgresql.org/docs/9.4/static/release-9-4-2.html"
},
{
"name": "http://www.debian.org/security/2015/dsa-3269",
"refsource": "MISC",
"url": "http://www.debian.org/security/2015/dsa-3269"
},
{
"name": "http://www.debian.org/security/2015/dsa-3270",
"refsource": "MISC",
"url": "http://www.debian.org/security/2015/dsa-3270"
},
{
"name": "http://ubuntu.com/usn/usn-2621-1",
"refsource": "MISC",
"url": "http://ubuntu.com/usn/usn-2621-1"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2015-3166",
"datePublished": "2019-11-20T20:50:16.000Z",
"dateReserved": "2015-04-10T00:00:00.000Z",
"dateUpdated": "2024-08-06T05:39:31.938Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2015-3167 (GCVE-0-2015-3167)
Vulnerability from cvelistv5 – Published: 2019-11-20 20:50 – Updated: 2024-08-06 05:39
VLAI
Summary
contrib/pgcrypto in PostgreSQL before 9.0.20, 9.1.x before 9.1.16, 9.2.x before 9.2.11, 9.3.x before 9.3.7, and 9.4.x before 9.4.2 uses different error responses when an incorrect key is used, which makes it easier for attackers to obtain the key via a brute force attack.
Severity
No CVSS data available.
CWE
- Other
Assigner
References
9 references
| URL | Tags |
|---|---|
| http://www.postgresql.org/about/news/1587/ | x_refsource_MISC |
| http://www.postgresql.org/docs/9.0/static/release… | x_refsource_MISC |
| http://www.postgresql.org/docs/9.1/static/release… | x_refsource_MISC |
| http://www.postgresql.org/docs/9.2/static/release… | x_refsource_MISC |
| http://www.postgresql.org/docs/9.3/static/release… | x_refsource_MISC |
| http://www.postgresql.org/docs/9.4/static/release… | x_refsource_MISC |
| http://www.debian.org/security/2015/dsa-3269 | x_refsource_MISC |
| http://www.debian.org/security/2015/dsa-3270 | x_refsource_MISC |
| http://ubuntu.com/usn/usn-2621-1 | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| PostgreSQL Global Development Group | PostgreSQL |
Affected:
before 9.0.20
Affected: 9.1.x before 9.1.16 Affected: 9.2.x before 9.2.11 Affected: 9.3.x before 9.3.7 Affected: and 9.4.x before 9.4.2 |
Date Public
2015-05-22 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T05:39:31.906Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.postgresql.org/about/news/1587/"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.postgresql.org/docs/9.0/static/release-9-0-20.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.postgresql.org/docs/9.1/static/release-9-1-16.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.postgresql.org/docs/9.2/static/release-9-2-11.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.postgresql.org/docs/9.3/static/release-9-3-7.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.postgresql.org/docs/9.4/static/release-9-4-2.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.debian.org/security/2015/dsa-3269"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.debian.org/security/2015/dsa-3270"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://ubuntu.com/usn/usn-2621-1"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "PostgreSQL",
"vendor": "PostgreSQL Global Development Group",
"versions": [
{
"status": "affected",
"version": "before 9.0.20"
},
{
"status": "affected",
"version": "9.1.x before 9.1.16"
},
{
"status": "affected",
"version": "9.2.x before 9.2.11"
},
{
"status": "affected",
"version": "9.3.x before 9.3.7"
},
{
"status": "affected",
"version": "and 9.4.x before 9.4.2"
}
]
}
],
"datePublic": "2015-05-22T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "contrib/pgcrypto in PostgreSQL before 9.0.20, 9.1.x before 9.1.16, 9.2.x before 9.2.11, 9.3.x before 9.3.7, and 9.4.x before 9.4.2 uses different error responses when an incorrect key is used, which makes it easier for attackers to obtain the key via a brute force attack."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Other",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-11-20T20:50:14.000Z",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.postgresql.org/about/news/1587/"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.postgresql.org/docs/9.0/static/release-9-0-20.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.postgresql.org/docs/9.1/static/release-9-1-16.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.postgresql.org/docs/9.2/static/release-9-2-11.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.postgresql.org/docs/9.3/static/release-9-3-7.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.postgresql.org/docs/9.4/static/release-9-4-2.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.debian.org/security/2015/dsa-3269"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.debian.org/security/2015/dsa-3270"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://ubuntu.com/usn/usn-2621-1"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "secalert@redhat.com",
"ID": "CVE-2015-3167",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "PostgreSQL",
"version": {
"version_data": [
{
"version_value": "before 9.0.20"
},
{
"version_value": "9.1.x before 9.1.16"
},
{
"version_value": "9.2.x before 9.2.11"
},
{
"version_value": "9.3.x before 9.3.7"
},
{
"version_value": "and 9.4.x before 9.4.2"
}
]
}
}
]
},
"vendor_name": "PostgreSQL Global Development Group"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "contrib/pgcrypto in PostgreSQL before 9.0.20, 9.1.x before 9.1.16, 9.2.x before 9.2.11, 9.3.x before 9.3.7, and 9.4.x before 9.4.2 uses different error responses when an incorrect key is used, which makes it easier for attackers to obtain the key via a brute force attack."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Other"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.postgresql.org/about/news/1587/",
"refsource": "MISC",
"url": "http://www.postgresql.org/about/news/1587/"
},
{
"name": "http://www.postgresql.org/docs/9.0/static/release-9-0-20.html",
"refsource": "MISC",
"url": "http://www.postgresql.org/docs/9.0/static/release-9-0-20.html"
},
{
"name": "http://www.postgresql.org/docs/9.1/static/release-9-1-16.html",
"refsource": "MISC",
"url": "http://www.postgresql.org/docs/9.1/static/release-9-1-16.html"
},
{
"name": "http://www.postgresql.org/docs/9.2/static/release-9-2-11.html",
"refsource": "MISC",
"url": "http://www.postgresql.org/docs/9.2/static/release-9-2-11.html"
},
{
"name": "http://www.postgresql.org/docs/9.3/static/release-9-3-7.html",
"refsource": "MISC",
"url": "http://www.postgresql.org/docs/9.3/static/release-9-3-7.html"
},
{
"name": "http://www.postgresql.org/docs/9.4/static/release-9-4-2.html",
"refsource": "MISC",
"url": "http://www.postgresql.org/docs/9.4/static/release-9-4-2.html"
},
{
"name": "http://www.debian.org/security/2015/dsa-3269",
"refsource": "MISC",
"url": "http://www.debian.org/security/2015/dsa-3269"
},
{
"name": "http://www.debian.org/security/2015/dsa-3270",
"refsource": "MISC",
"url": "http://www.debian.org/security/2015/dsa-3270"
},
{
"name": "http://ubuntu.com/usn/usn-2621-1",
"refsource": "MISC",
"url": "http://ubuntu.com/usn/usn-2621-1"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2015-3167",
"datePublished": "2019-11-20T20:50:14.000Z",
"dateReserved": "2015-04-10T00:00:00.000Z",
"dateUpdated": "2024-08-06T05:39:31.906Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2018-10925 (GCVE-0-2018-10925)
Vulnerability from cvelistv5 – Published: 2018-08-09 21:00 – Updated: 2024-08-05 07:54
VLAI
Summary
It was discovered that PostgreSQL versions before 10.5, 9.6.10, 9.5.14, 9.4.19, and 9.3.24 failed to properly check authorization on certain statements involved with "INSERT ... ON CONFLICT DO UPDATE". An attacker with "CREATE TABLE" privileges could exploit this to read arbitrary bytes server memory. If the attacker also had certain "INSERT" and limited "UPDATE" privileges to a particular table, they could exploit this to update other columns in the same table.
Severity
7.1 (High)
CWE
Assigner
References
12 references
| URL | Tags |
|---|---|
| https://security.gentoo.org/glsa/201810-08 | vendor-advisoryx_refsource_GENTOO |
| https://www.debian.org/security/2018/dsa-4269 | vendor-advisoryx_refsource_DEBIAN |
| http://www.securityfocus.com/bid/105052 | vdb-entryx_refsource_BID |
| https://access.redhat.com/errata/RHSA-2018:2511 | vendor-advisoryx_refsource_REDHAT |
| https://usn.ubuntu.com/3744-1/ | vendor-advisoryx_refsource_UBUNTU |
| https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2… | x_refsource_CONFIRM |
| https://access.redhat.com/errata/RHSA-2018:2566 | vendor-advisoryx_refsource_REDHAT |
| https://access.redhat.com/errata/RHSA-2018:2565 | vendor-advisoryx_refsource_REDHAT |
| https://access.redhat.com/errata/RHSA-2018:3816 | vendor-advisoryx_refsource_REDHAT |
| https://www.postgresql.org/about/news/1878/ | x_refsource_CONFIRM |
| http://www.securitytracker.com/id/1041446 | vdb-entryx_refsource_SECTRACK |
| http://lists.opensuse.org/opensuse-security-annou… | vendor-advisoryx_refsource_SUSE |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| PostgreSQL Global Development Group | postgresql |
Affected:
10.5
Affected: 9.6.10 Affected: 9.5.14 Affected: 9.4.19 Affected: 9.3.24 |
Date Public
2018-08-09 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T07:54:36.061Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "GLSA-201810-08",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/201810-08"
},
{
"name": "DSA-4269",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "https://www.debian.org/security/2018/dsa-4269"
},
{
"name": "105052",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/105052"
},
{
"name": "RHSA-2018:2511",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "https://access.redhat.com/errata/RHSA-2018:2511"
},
{
"name": "USN-3744-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU",
"x_transferred"
],
"url": "https://usn.ubuntu.com/3744-1/"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10925"
},
{
"name": "RHSA-2018:2566",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "https://access.redhat.com/errata/RHSA-2018:2566"
},
{
"name": "RHSA-2018:2565",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "https://access.redhat.com/errata/RHSA-2018:2565"
},
{
"name": "RHSA-2018:3816",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "https://access.redhat.com/errata/RHSA-2018:3816"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.postgresql.org/about/news/1878/"
},
{
"name": "1041446",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://www.securitytracker.com/id/1041446"
},
{
"name": "openSUSE-SU-2020:1227",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00043.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "postgresql",
"vendor": "PostgreSQL Global Development Group",
"versions": [
{
"status": "affected",
"version": "10.5"
},
{
"status": "affected",
"version": "9.6.10"
},
{
"status": "affected",
"version": "9.5.14"
},
{
"status": "affected",
"version": "9.4.19"
},
{
"status": "affected",
"version": "9.3.24"
}
]
}
],
"datePublic": "2018-08-09T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "It was discovered that PostgreSQL versions before 10.5, 9.6.10, 9.5.14, 9.4.19, and 9.3.24 failed to properly check authorization on certain statements involved with \"INSERT ... ON CONFLICT DO UPDATE\". An attacker with \"CREATE TABLE\" privileges could exploit this to read arbitrary bytes server memory. If the attacker also had certain \"INSERT\" and limited \"UPDATE\" privileges to a particular table, they could exploit this to update other columns in the same table."
}
],
"metrics": [
{
"cvssV3_0": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-08-17T17:06:15.000Z",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"name": "GLSA-201810-08",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "https://security.gentoo.org/glsa/201810-08"
},
{
"name": "DSA-4269",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "https://www.debian.org/security/2018/dsa-4269"
},
{
"name": "105052",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/105052"
},
{
"name": "RHSA-2018:2511",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2018:2511"
},
{
"name": "USN-3744-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU"
],
"url": "https://usn.ubuntu.com/3744-1/"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10925"
},
{
"name": "RHSA-2018:2566",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2018:2566"
},
{
"name": "RHSA-2018:2565",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2018:2565"
},
{
"name": "RHSA-2018:3816",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2018:3816"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.postgresql.org/about/news/1878/"
},
{
"name": "1041446",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://www.securitytracker.com/id/1041446"
},
{
"name": "openSUSE-SU-2020:1227",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00043.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "secalert@redhat.com",
"ID": "CVE-2018-10925",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "postgresql",
"version": {
"version_data": [
{
"version_value": "10.5"
},
{
"version_value": "9.6.10"
},
{
"version_value": "9.5.14"
},
{
"version_value": "9.4.19"
},
{
"version_value": "9.3.24"
}
]
}
}
]
},
"vendor_name": "PostgreSQL Global Development Group"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "It was discovered that PostgreSQL versions before 10.5, 9.6.10, 9.5.14, 9.4.19, and 9.3.24 failed to properly check authorization on certain statements involved with \"INSERT ... ON CONFLICT DO UPDATE\". An attacker with \"CREATE TABLE\" privileges could exploit this to read arbitrary bytes server memory. If the attacker also had certain \"INSERT\" and limited \"UPDATE\" privileges to a particular table, they could exploit this to update other columns in the same table."
}
]
},
"impact": {
"cvss": [
[
{
"vectorString": "7.1/CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
"version": "3.0"
}
]
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-863"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "GLSA-201810-08",
"refsource": "GENTOO",
"url": "https://security.gentoo.org/glsa/201810-08"
},
{
"name": "DSA-4269",
"refsource": "DEBIAN",
"url": "https://www.debian.org/security/2018/dsa-4269"
},
{
"name": "105052",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/105052"
},
{
"name": "RHSA-2018:2511",
"refsource": "REDHAT",
"url": "https://access.redhat.com/errata/RHSA-2018:2511"
},
{
"name": "USN-3744-1",
"refsource": "UBUNTU",
"url": "https://usn.ubuntu.com/3744-1/"
},
{
"name": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10925",
"refsource": "CONFIRM",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10925"
},
{
"name": "RHSA-2018:2566",
"refsource": "REDHAT",
"url": "https://access.redhat.com/errata/RHSA-2018:2566"
},
{
"name": "RHSA-2018:2565",
"refsource": "REDHAT",
"url": "https://access.redhat.com/errata/RHSA-2018:2565"
},
{
"name": "RHSA-2018:3816",
"refsource": "REDHAT",
"url": "https://access.redhat.com/errata/RHSA-2018:3816"
},
{
"name": "https://www.postgresql.org/about/news/1878/",
"refsource": "CONFIRM",
"url": "https://www.postgresql.org/about/news/1878/"
},
{
"name": "1041446",
"refsource": "SECTRACK",
"url": "http://www.securitytracker.com/id/1041446"
},
{
"name": "openSUSE-SU-2020:1227",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00043.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2018-10925",
"datePublished": "2018-08-09T21:00:00.000Z",
"dateReserved": "2018-05-09T00:00:00.000Z",
"dateUpdated": "2024-08-05T07:54:36.061Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2018-10915 (GCVE-0-2018-10915)
Vulnerability from cvelistv5 – Published: 2018-08-09 20:00 – Updated: 2024-08-05 07:54
VLAI
Summary
A vulnerability was found in libpq, the default PostgreSQL client library where libpq failed to properly reset its internal state between connections. If an affected version of libpq was used with "host" or "hostaddr" connection parameters from untrusted input, attackers could bypass client-side connection security features, obtain access to higher privileged connections or potentially cause other impact through SQL injection, by causing the PQescape() functions to malfunction. Postgresql versions before 10.5, 9.6.10, 9.5.14, 9.4.19, and 9.3.24 are affected.
Severity
8.5 (High)
Assigner
References
17 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| PostgreSQL Global Development Group | postgresql |
Affected:
10.5
Affected: 9.6.10 Affected: 9.5.14 Affected: 9.4.19 Affected: 9.3.24 |
Date Public
2018-08-09 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T07:54:36.359Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "GLSA-201810-08",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/201810-08"
},
{
"name": "RHSA-2018:2729",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "https://access.redhat.com/errata/RHSA-2018:2729"
},
{
"name": "DSA-4269",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "https://www.debian.org/security/2018/dsa-4269"
},
{
"name": "RHSA-2018:2643",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "https://access.redhat.com/errata/RHSA-2018:2643"
},
{
"name": "RHSA-2018:2721",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "https://access.redhat.com/errata/RHSA-2018:2721"
},
{
"name": "RHSA-2018:2511",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "https://access.redhat.com/errata/RHSA-2018:2511"
},
{
"name": "USN-3744-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU",
"x_transferred"
],
"url": "https://usn.ubuntu.com/3744-1/"
},
{
"name": "[debian-lts-announce] 20180815 [SECURITY] [DLA 1464-1] postgresql-9.4 security update",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2018/08/msg00012.html"
},
{
"name": "RHSA-2018:2566",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "https://access.redhat.com/errata/RHSA-2018:2566"
},
{
"name": "RHSA-2018:2565",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "https://access.redhat.com/errata/RHSA-2018:2565"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10915"
},
{
"name": "RHSA-2018:3816",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "https://access.redhat.com/errata/RHSA-2018:3816"
},
{
"name": "105054",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/105054"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.postgresql.org/about/news/1878/"
},
{
"name": "RHSA-2018:2557",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "https://access.redhat.com/errata/RHSA-2018:2557"
},
{
"name": "1041446",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://www.securitytracker.com/id/1041446"
},
{
"name": "openSUSE-SU-2020:1227",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00043.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "postgresql",
"vendor": "PostgreSQL Global Development Group",
"versions": [
{
"status": "affected",
"version": "10.5"
},
{
"status": "affected",
"version": "9.6.10"
},
{
"status": "affected",
"version": "9.5.14"
},
{
"status": "affected",
"version": "9.4.19"
},
{
"status": "affected",
"version": "9.3.24"
}
]
}
],
"datePublic": "2018-08-09T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was found in libpq, the default PostgreSQL client library where libpq failed to properly reset its internal state between connections. If an affected version of libpq was used with \"host\" or \"hostaddr\" connection parameters from untrusted input, attackers could bypass client-side connection security features, obtain access to higher privileged connections or potentially cause other impact through SQL injection, by causing the PQescape() functions to malfunction. Postgresql versions before 10.5, 9.6.10, 9.5.14, 9.4.19, and 9.3.24 are affected."
}
],
"metrics": [
{
"cvssV3_0": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-665",
"description": "CWE-665",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-08-17T17:06:12.000Z",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"name": "GLSA-201810-08",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "https://security.gentoo.org/glsa/201810-08"
},
{
"name": "RHSA-2018:2729",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2018:2729"
},
{
"name": "DSA-4269",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "https://www.debian.org/security/2018/dsa-4269"
},
{
"name": "RHSA-2018:2643",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2018:2643"
},
{
"name": "RHSA-2018:2721",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2018:2721"
},
{
"name": "RHSA-2018:2511",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2018:2511"
},
{
"name": "USN-3744-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU"
],
"url": "https://usn.ubuntu.com/3744-1/"
},
{
"name": "[debian-lts-announce] 20180815 [SECURITY] [DLA 1464-1] postgresql-9.4 security update",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.debian.org/debian-lts-announce/2018/08/msg00012.html"
},
{
"name": "RHSA-2018:2566",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2018:2566"
},
{
"name": "RHSA-2018:2565",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2018:2565"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10915"
},
{
"name": "RHSA-2018:3816",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2018:3816"
},
{
"name": "105054",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/105054"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.postgresql.org/about/news/1878/"
},
{
"name": "RHSA-2018:2557",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2018:2557"
},
{
"name": "1041446",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://www.securitytracker.com/id/1041446"
},
{
"name": "openSUSE-SU-2020:1227",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00043.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "secalert@redhat.com",
"ID": "CVE-2018-10915",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "postgresql",
"version": {
"version_data": [
{
"version_value": "10.5"
},
{
"version_value": "9.6.10"
},
{
"version_value": "9.5.14"
},
{
"version_value": "9.4.19"
},
{
"version_value": "9.3.24"
}
]
}
}
]
},
"vendor_name": "PostgreSQL Global Development Group"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A vulnerability was found in libpq, the default PostgreSQL client library where libpq failed to properly reset its internal state between connections. If an affected version of libpq was used with \"host\" or \"hostaddr\" connection parameters from untrusted input, attackers could bypass client-side connection security features, obtain access to higher privileged connections or potentially cause other impact through SQL injection, by causing the PQescape() functions to malfunction. Postgresql versions before 10.5, 9.6.10, 9.5.14, 9.4.19, and 9.3.24 are affected."
}
]
},
"impact": {
"cvss": [
[
{
"vectorString": "8.5/CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.0"
}
]
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-665"
}
]
},
{
"description": [
{
"lang": "eng",
"value": "CWE-200"
}
]
},
{
"description": [
{
"lang": "eng",
"value": "CWE-89"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "GLSA-201810-08",
"refsource": "GENTOO",
"url": "https://security.gentoo.org/glsa/201810-08"
},
{
"name": "RHSA-2018:2729",
"refsource": "REDHAT",
"url": "https://access.redhat.com/errata/RHSA-2018:2729"
},
{
"name": "DSA-4269",
"refsource": "DEBIAN",
"url": "https://www.debian.org/security/2018/dsa-4269"
},
{
"name": "RHSA-2018:2643",
"refsource": "REDHAT",
"url": "https://access.redhat.com/errata/RHSA-2018:2643"
},
{
"name": "RHSA-2018:2721",
"refsource": "REDHAT",
"url": "https://access.redhat.com/errata/RHSA-2018:2721"
},
{
"name": "RHSA-2018:2511",
"refsource": "REDHAT",
"url": "https://access.redhat.com/errata/RHSA-2018:2511"
},
{
"name": "USN-3744-1",
"refsource": "UBUNTU",
"url": "https://usn.ubuntu.com/3744-1/"
},
{
"name": "[debian-lts-announce] 20180815 [SECURITY] [DLA 1464-1] postgresql-9.4 security update",
"refsource": "MLIST",
"url": "https://lists.debian.org/debian-lts-announce/2018/08/msg00012.html"
},
{
"name": "RHSA-2018:2566",
"refsource": "REDHAT",
"url": "https://access.redhat.com/errata/RHSA-2018:2566"
},
{
"name": "RHSA-2018:2565",
"refsource": "REDHAT",
"url": "https://access.redhat.com/errata/RHSA-2018:2565"
},
{
"name": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10915",
"refsource": "CONFIRM",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10915"
},
{
"name": "RHSA-2018:3816",
"refsource": "REDHAT",
"url": "https://access.redhat.com/errata/RHSA-2018:3816"
},
{
"name": "105054",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/105054"
},
{
"name": "https://www.postgresql.org/about/news/1878/",
"refsource": "CONFIRM",
"url": "https://www.postgresql.org/about/news/1878/"
},
{
"name": "RHSA-2018:2557",
"refsource": "REDHAT",
"url": "https://access.redhat.com/errata/RHSA-2018:2557"
},
{
"name": "1041446",
"refsource": "SECTRACK",
"url": "http://www.securitytracker.com/id/1041446"
},
{
"name": "openSUSE-SU-2020:1227",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00043.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2018-10915",
"datePublished": "2018-08-09T20:00:00.000Z",
"dateReserved": "2018-05-09T00:00:00.000Z",
"dateUpdated": "2024-08-05T07:54:36.359Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2015-0241 (GCVE-0-2015-0241)
Vulnerability from nvd – Published: 2020-01-27 15:29 – Updated: 2024-08-06 04:03
VLAI
Summary
The to_char function in PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1 allows remote authenticated users to cause a denial of service (crash) or possibly execute arbitrary code via a (1) large number of digits when processing a numeric formatting template, which triggers a buffer over-read, or (2) crafted timestamp formatting template, which triggers a buffer overflow.
Severity
No CVSS data available.
CWE
- Other
Assigner
References
7 references
| URL | Tags |
|---|---|
| http://www.postgresql.org/docs/9.4/static/release… | x_refsource_CONFIRM |
| http://www.postgresql.org/docs/current/static/rel… | x_refsource_CONFIRM |
| http://www.postgresql.org/docs/current/static/rel… | x_refsource_CONFIRM |
| http://www.postgresql.org/docs/current/static/rel… | x_refsource_CONFIRM |
| http://www.postgresql.org/docs/current/static/rel… | x_refsource_CONFIRM |
| http://www.postgresql.org/about/news/1569/ | x_refsource_CONFIRM |
| http://www.debian.org/security/2015/dsa-3155 | x_refsource_CONFIRM |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| PostgreSQL Global Development Group | PostgreSQL |
Affected:
before 9.0.19
Affected: 9.1.x before 9.1.15 Affected: 9.2.x before 9.2.10 Affected: 9.3.x before 9.3.6 Affected: 9.4.x before 9.4.1 |
Date Public
2015-02-05 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T04:03:10.441Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.postgresql.org/docs/9.4/static/release-9-4-1.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.postgresql.org/docs/current/static/release-9-0-19.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.postgresql.org/docs/current/static/release-9-1-15.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.postgresql.org/docs/current/static/release-9-2-10.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.postgresql.org/docs/current/static/release-9-3-6.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.postgresql.org/about/news/1569/"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.debian.org/security/2015/dsa-3155"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "PostgreSQL",
"vendor": "PostgreSQL Global Development Group",
"versions": [
{
"status": "affected",
"version": "before 9.0.19"
},
{
"status": "affected",
"version": "9.1.x before 9.1.15"
},
{
"status": "affected",
"version": "9.2.x before 9.2.10"
},
{
"status": "affected",
"version": "9.3.x before 9.3.6"
},
{
"status": "affected",
"version": "9.4.x before 9.4.1"
}
]
}
],
"datePublic": "2015-02-05T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "The to_char function in PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1 allows remote authenticated users to cause a denial of service (crash) or possibly execute arbitrary code via a (1) large number of digits when processing a numeric formatting template, which triggers a buffer over-read, or (2) crafted timestamp formatting template, which triggers a buffer overflow."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Other",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-01-27T15:29:37.000Z",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.postgresql.org/docs/9.4/static/release-9-4-1.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.postgresql.org/docs/current/static/release-9-0-19.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.postgresql.org/docs/current/static/release-9-1-15.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.postgresql.org/docs/current/static/release-9-2-10.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.postgresql.org/docs/current/static/release-9-3-6.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.postgresql.org/about/news/1569/"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.debian.org/security/2015/dsa-3155"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "secalert@redhat.com",
"ID": "CVE-2015-0241",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "PostgreSQL",
"version": {
"version_data": [
{
"version_value": "before 9.0.19"
},
{
"version_value": "9.1.x before 9.1.15"
},
{
"version_value": "9.2.x before 9.2.10"
},
{
"version_value": "9.3.x before 9.3.6"
},
{
"version_value": "9.4.x before 9.4.1"
}
]
}
}
]
},
"vendor_name": "PostgreSQL Global Development Group"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The to_char function in PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1 allows remote authenticated users to cause a denial of service (crash) or possibly execute arbitrary code via a (1) large number of digits when processing a numeric formatting template, which triggers a buffer over-read, or (2) crafted timestamp formatting template, which triggers a buffer overflow."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Other"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.postgresql.org/docs/9.4/static/release-9-4-1.html",
"refsource": "CONFIRM",
"url": "http://www.postgresql.org/docs/9.4/static/release-9-4-1.html"
},
{
"name": "http://www.postgresql.org/docs/current/static/release-9-0-19.html",
"refsource": "CONFIRM",
"url": "http://www.postgresql.org/docs/current/static/release-9-0-19.html"
},
{
"name": "http://www.postgresql.org/docs/current/static/release-9-1-15.html",
"refsource": "CONFIRM",
"url": "http://www.postgresql.org/docs/current/static/release-9-1-15.html"
},
{
"name": "http://www.postgresql.org/docs/current/static/release-9-2-10.html",
"refsource": "CONFIRM",
"url": "http://www.postgresql.org/docs/current/static/release-9-2-10.html"
},
{
"name": "http://www.postgresql.org/docs/current/static/release-9-3-6.html",
"refsource": "CONFIRM",
"url": "http://www.postgresql.org/docs/current/static/release-9-3-6.html"
},
{
"name": "http://www.postgresql.org/about/news/1569/",
"refsource": "CONFIRM",
"url": "http://www.postgresql.org/about/news/1569/"
},
{
"name": "http://www.debian.org/security/2015/dsa-3155",
"refsource": "CONFIRM",
"url": "http://www.debian.org/security/2015/dsa-3155"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2015-0241",
"datePublished": "2020-01-27T15:29:37.000Z",
"dateReserved": "2014-11-18T00:00:00.000Z",
"dateUpdated": "2024-08-06T04:03:10.441Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2015-0242 (GCVE-0-2015-0242)
Vulnerability from nvd – Published: 2020-01-27 15:29 – Updated: 2024-08-06 04:03
VLAI
Summary
Stack-based buffer overflow in the *printf function implementations in PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1, when running on a Windows system, allows remote authenticated users to cause a denial of service (crash) and possibly execute arbitrary code via a floating point number with a large precision, as demonstrated by using the to_char function.
Severity
No CVSS data available.
CWE
- Buffer Overflow
Assigner
References
7 references
| URL | Tags |
|---|---|
| http://www.postgresql.org/docs/9.4/static/release… | x_refsource_CONFIRM |
| http://www.postgresql.org/docs/current/static/rel… | x_refsource_CONFIRM |
| http://www.postgresql.org/docs/current/static/rel… | x_refsource_CONFIRM |
| http://www.postgresql.org/docs/current/static/rel… | x_refsource_CONFIRM |
| http://www.postgresql.org/docs/current/static/rel… | x_refsource_CONFIRM |
| http://www.postgresql.org/about/news/1569/ | x_refsource_CONFIRM |
| http://www.debian.org/security/2015/dsa-3155 | x_refsource_CONFIRM |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| PostgreSQL Global Development Group | PostgreSQL |
Affected:
before 9.0.19
Affected: 9.1.x before 9.1.15 Affected: 9.2.x before 9.2.10 Affected: 9.3.x before 9.3.6 Affected: 9.4.x before 9.4.1 |
Date Public
2015-02-05 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T04:03:10.439Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.postgresql.org/docs/9.4/static/release-9-4-1.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.postgresql.org/docs/current/static/release-9-0-19.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.postgresql.org/docs/current/static/release-9-1-15.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.postgresql.org/docs/current/static/release-9-2-10.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.postgresql.org/docs/current/static/release-9-3-6.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.postgresql.org/about/news/1569/"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.debian.org/security/2015/dsa-3155"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "PostgreSQL",
"vendor": "PostgreSQL Global Development Group",
"versions": [
{
"status": "affected",
"version": "before 9.0.19"
},
{
"status": "affected",
"version": "9.1.x before 9.1.15"
},
{
"status": "affected",
"version": "9.2.x before 9.2.10"
},
{
"status": "affected",
"version": "9.3.x before 9.3.6"
},
{
"status": "affected",
"version": "9.4.x before 9.4.1"
}
]
}
],
"datePublic": "2015-02-05T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Stack-based buffer overflow in the *printf function implementations in PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1, when running on a Windows system, allows remote authenticated users to cause a denial of service (crash) and possibly execute arbitrary code via a floating point number with a large precision, as demonstrated by using the to_char function."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Buffer Overflow",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-01-27T15:29:33.000Z",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.postgresql.org/docs/9.4/static/release-9-4-1.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.postgresql.org/docs/current/static/release-9-0-19.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.postgresql.org/docs/current/static/release-9-1-15.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.postgresql.org/docs/current/static/release-9-2-10.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.postgresql.org/docs/current/static/release-9-3-6.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.postgresql.org/about/news/1569/"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.debian.org/security/2015/dsa-3155"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "secalert@redhat.com",
"ID": "CVE-2015-0242",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "PostgreSQL",
"version": {
"version_data": [
{
"version_value": "before 9.0.19"
},
{
"version_value": "9.1.x before 9.1.15"
},
{
"version_value": "9.2.x before 9.2.10"
},
{
"version_value": "9.3.x before 9.3.6"
},
{
"version_value": "9.4.x before 9.4.1"
}
]
}
}
]
},
"vendor_name": "PostgreSQL Global Development Group"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Stack-based buffer overflow in the *printf function implementations in PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1, when running on a Windows system, allows remote authenticated users to cause a denial of service (crash) and possibly execute arbitrary code via a floating point number with a large precision, as demonstrated by using the to_char function."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Buffer Overflow"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.postgresql.org/docs/9.4/static/release-9-4-1.html",
"refsource": "CONFIRM",
"url": "http://www.postgresql.org/docs/9.4/static/release-9-4-1.html"
},
{
"name": "http://www.postgresql.org/docs/current/static/release-9-0-19.html",
"refsource": "CONFIRM",
"url": "http://www.postgresql.org/docs/current/static/release-9-0-19.html"
},
{
"name": "http://www.postgresql.org/docs/current/static/release-9-1-15.html",
"refsource": "CONFIRM",
"url": "http://www.postgresql.org/docs/current/static/release-9-1-15.html"
},
{
"name": "http://www.postgresql.org/docs/current/static/release-9-2-10.html",
"refsource": "CONFIRM",
"url": "http://www.postgresql.org/docs/current/static/release-9-2-10.html"
},
{
"name": "http://www.postgresql.org/docs/current/static/release-9-3-6.html",
"refsource": "CONFIRM",
"url": "http://www.postgresql.org/docs/current/static/release-9-3-6.html"
},
{
"name": "http://www.postgresql.org/about/news/1569/",
"refsource": "CONFIRM",
"url": "http://www.postgresql.org/about/news/1569/"
},
{
"name": "http://www.debian.org/security/2015/dsa-3155",
"refsource": "CONFIRM",
"url": "http://www.debian.org/security/2015/dsa-3155"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2015-0242",
"datePublished": "2020-01-27T15:29:33.000Z",
"dateReserved": "2014-11-18T00:00:00.000Z",
"dateUpdated": "2024-08-06T04:03:10.439Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2015-0243 (GCVE-0-2015-0243)
Vulnerability from nvd – Published: 2020-01-27 15:29 – Updated: 2024-08-06 04:03
VLAI
Summary
Multiple buffer overflows in contrib/pgcrypto in PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1 allow remote authenticated users to cause a denial of service (crash) and possibly execute arbitrary code via unspecified vectors.
Severity
No CVSS data available.
CWE
- Buffer Overflow
Assigner
References
7 references
| URL | Tags |
|---|---|
| http://www.postgresql.org/docs/9.4/static/release… | x_refsource_CONFIRM |
| http://www.postgresql.org/docs/current/static/rel… | x_refsource_CONFIRM |
| http://www.postgresql.org/docs/current/static/rel… | x_refsource_CONFIRM |
| http://www.postgresql.org/docs/current/static/rel… | x_refsource_CONFIRM |
| http://www.postgresql.org/docs/current/static/rel… | x_refsource_CONFIRM |
| http://www.postgresql.org/about/news/1569/ | x_refsource_CONFIRM |
| http://www.debian.org/security/2015/dsa-3155 | x_refsource_CONFIRM |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| PostgreSQL Global Development Group | PostgreSQL |
Affected:
before 9.0.19
Affected: 9.1.x before 9.1.15 Affected: 9.2.x before 9.2.10 Affected: 9.3.x before 9.3.6 Affected: 9.4.x before 9.4.1 |
Date Public
2015-02-05 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T04:03:10.702Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.postgresql.org/docs/9.4/static/release-9-4-1.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.postgresql.org/docs/current/static/release-9-0-19.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.postgresql.org/docs/current/static/release-9-1-15.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.postgresql.org/docs/current/static/release-9-2-10.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.postgresql.org/docs/current/static/release-9-3-6.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.postgresql.org/about/news/1569/"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.debian.org/security/2015/dsa-3155"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "PostgreSQL",
"vendor": "PostgreSQL Global Development Group",
"versions": [
{
"status": "affected",
"version": "before 9.0.19"
},
{
"status": "affected",
"version": "9.1.x before 9.1.15"
},
{
"status": "affected",
"version": "9.2.x before 9.2.10"
},
{
"status": "affected",
"version": "9.3.x before 9.3.6"
},
{
"status": "affected",
"version": "9.4.x before 9.4.1"
}
]
}
],
"datePublic": "2015-02-05T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Multiple buffer overflows in contrib/pgcrypto in PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1 allow remote authenticated users to cause a denial of service (crash) and possibly execute arbitrary code via unspecified vectors."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Buffer Overflow",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-01-27T15:29:28.000Z",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.postgresql.org/docs/9.4/static/release-9-4-1.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.postgresql.org/docs/current/static/release-9-0-19.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.postgresql.org/docs/current/static/release-9-1-15.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.postgresql.org/docs/current/static/release-9-2-10.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.postgresql.org/docs/current/static/release-9-3-6.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.postgresql.org/about/news/1569/"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.debian.org/security/2015/dsa-3155"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "secalert@redhat.com",
"ID": "CVE-2015-0243",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "PostgreSQL",
"version": {
"version_data": [
{
"version_value": "before 9.0.19"
},
{
"version_value": "9.1.x before 9.1.15"
},
{
"version_value": "9.2.x before 9.2.10"
},
{
"version_value": "9.3.x before 9.3.6"
},
{
"version_value": "9.4.x before 9.4.1"
}
]
}
}
]
},
"vendor_name": "PostgreSQL Global Development Group"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple buffer overflows in contrib/pgcrypto in PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1 allow remote authenticated users to cause a denial of service (crash) and possibly execute arbitrary code via unspecified vectors."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Buffer Overflow"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.postgresql.org/docs/9.4/static/release-9-4-1.html",
"refsource": "CONFIRM",
"url": "http://www.postgresql.org/docs/9.4/static/release-9-4-1.html"
},
{
"name": "http://www.postgresql.org/docs/current/static/release-9-0-19.html",
"refsource": "CONFIRM",
"url": "http://www.postgresql.org/docs/current/static/release-9-0-19.html"
},
{
"name": "http://www.postgresql.org/docs/current/static/release-9-1-15.html",
"refsource": "CONFIRM",
"url": "http://www.postgresql.org/docs/current/static/release-9-1-15.html"
},
{
"name": "http://www.postgresql.org/docs/current/static/release-9-2-10.html",
"refsource": "CONFIRM",
"url": "http://www.postgresql.org/docs/current/static/release-9-2-10.html"
},
{
"name": "http://www.postgresql.org/docs/current/static/release-9-3-6.html",
"refsource": "CONFIRM",
"url": "http://www.postgresql.org/docs/current/static/release-9-3-6.html"
},
{
"name": "http://www.postgresql.org/about/news/1569/",
"refsource": "CONFIRM",
"url": "http://www.postgresql.org/about/news/1569/"
},
{
"name": "http://www.debian.org/security/2015/dsa-3155",
"refsource": "CONFIRM",
"url": "http://www.debian.org/security/2015/dsa-3155"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2015-0243",
"datePublished": "2020-01-27T15:29:28.000Z",
"dateReserved": "2014-11-18T00:00:00.000Z",
"dateUpdated": "2024-08-06T04:03:10.702Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2015-0244 (GCVE-0-2015-0244)
Vulnerability from nvd – Published: 2020-01-27 15:29 – Updated: 2024-08-06 04:03
VLAI
Summary
PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1 does not properly handle errors while reading a protocol message, which allows remote attackers to conduct SQL injection attacks via crafted binary data in a parameter and causing an error, which triggers the loss of synchronization and part of the protocol message to be treated as a new message, as demonstrated by causing a timeout or query cancellation.
Severity
No CVSS data available.
CWE
- Other
Assigner
References
7 references
| URL | Tags |
|---|---|
| http://www.postgresql.org/docs/9.4/static/release… | x_refsource_CONFIRM |
| http://www.postgresql.org/docs/current/static/rel… | x_refsource_CONFIRM |
| http://www.postgresql.org/docs/current/static/rel… | x_refsource_CONFIRM |
| http://www.postgresql.org/docs/current/static/rel… | x_refsource_CONFIRM |
| http://www.postgresql.org/docs/current/static/rel… | x_refsource_CONFIRM |
| http://www.postgresql.org/about/news/1569/ | x_refsource_CONFIRM |
| http://www.debian.org/security/2015/dsa-3155 | x_refsource_CONFIRM |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| PostgreSQL Global Development Group | PostgreSQL |
Affected:
before 9.0.19
Affected: 9.1.x before 9.1.15 Affected: 9.2.x before 9.2.10 Affected: 9.3.x before 9.3.6 Affected: 9.4.x before 9.4.1 |
Date Public
2015-02-05 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T04:03:10.495Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.postgresql.org/docs/9.4/static/release-9-4-1.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.postgresql.org/docs/current/static/release-9-0-19.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.postgresql.org/docs/current/static/release-9-1-15.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.postgresql.org/docs/current/static/release-9-2-10.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.postgresql.org/docs/current/static/release-9-3-6.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.postgresql.org/about/news/1569/"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.debian.org/security/2015/dsa-3155"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "PostgreSQL",
"vendor": "PostgreSQL Global Development Group",
"versions": [
{
"status": "affected",
"version": "before 9.0.19"
},
{
"status": "affected",
"version": "9.1.x before 9.1.15"
},
{
"status": "affected",
"version": "9.2.x before 9.2.10"
},
{
"status": "affected",
"version": "9.3.x before 9.3.6"
},
{
"status": "affected",
"version": "9.4.x before 9.4.1"
}
]
}
],
"datePublic": "2015-02-05T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1 does not properly handle errors while reading a protocol message, which allows remote attackers to conduct SQL injection attacks via crafted binary data in a parameter and causing an error, which triggers the loss of synchronization and part of the protocol message to be treated as a new message, as demonstrated by causing a timeout or query cancellation."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Other",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-01-27T15:29:25.000Z",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.postgresql.org/docs/9.4/static/release-9-4-1.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.postgresql.org/docs/current/static/release-9-0-19.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.postgresql.org/docs/current/static/release-9-1-15.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.postgresql.org/docs/current/static/release-9-2-10.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.postgresql.org/docs/current/static/release-9-3-6.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.postgresql.org/about/news/1569/"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.debian.org/security/2015/dsa-3155"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "secalert@redhat.com",
"ID": "CVE-2015-0244",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "PostgreSQL",
"version": {
"version_data": [
{
"version_value": "before 9.0.19"
},
{
"version_value": "9.1.x before 9.1.15"
},
{
"version_value": "9.2.x before 9.2.10"
},
{
"version_value": "9.3.x before 9.3.6"
},
{
"version_value": "9.4.x before 9.4.1"
}
]
}
}
]
},
"vendor_name": "PostgreSQL Global Development Group"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1 does not properly handle errors while reading a protocol message, which allows remote attackers to conduct SQL injection attacks via crafted binary data in a parameter and causing an error, which triggers the loss of synchronization and part of the protocol message to be treated as a new message, as demonstrated by causing a timeout or query cancellation."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Other"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.postgresql.org/docs/9.4/static/release-9-4-1.html",
"refsource": "CONFIRM",
"url": "http://www.postgresql.org/docs/9.4/static/release-9-4-1.html"
},
{
"name": "http://www.postgresql.org/docs/current/static/release-9-0-19.html",
"refsource": "CONFIRM",
"url": "http://www.postgresql.org/docs/current/static/release-9-0-19.html"
},
{
"name": "http://www.postgresql.org/docs/current/static/release-9-1-15.html",
"refsource": "CONFIRM",
"url": "http://www.postgresql.org/docs/current/static/release-9-1-15.html"
},
{
"name": "http://www.postgresql.org/docs/current/static/release-9-2-10.html",
"refsource": "CONFIRM",
"url": "http://www.postgresql.org/docs/current/static/release-9-2-10.html"
},
{
"name": "http://www.postgresql.org/docs/current/static/release-9-3-6.html",
"refsource": "CONFIRM",
"url": "http://www.postgresql.org/docs/current/static/release-9-3-6.html"
},
{
"name": "http://www.postgresql.org/about/news/1569/",
"refsource": "CONFIRM",
"url": "http://www.postgresql.org/about/news/1569/"
},
{
"name": "http://www.debian.org/security/2015/dsa-3155",
"refsource": "CONFIRM",
"url": "http://www.debian.org/security/2015/dsa-3155"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2015-0244",
"datePublished": "2020-01-27T15:29:25.000Z",
"dateReserved": "2014-11-18T00:00:00.000Z",
"dateUpdated": "2024-08-06T04:03:10.495Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2014-8161 (GCVE-0-2014-8161)
Vulnerability from nvd – Published: 2020-01-27 15:29 – Updated: 2024-08-06 13:10
VLAI
Summary
PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1 allows remote authenticated users to obtain sensitive column values by triggering constraint violation and then reading the error message.
Severity
No CVSS data available.
CWE
- Path Disclosure
Assigner
References
7 references
| URL | Tags |
|---|---|
| http://www.postgresql.org/docs/9.4/static/release… | x_refsource_CONFIRM |
| http://www.postgresql.org/docs/current/static/rel… | x_refsource_CONFIRM |
| http://www.postgresql.org/docs/current/static/rel… | x_refsource_CONFIRM |
| http://www.postgresql.org/docs/current/static/rel… | x_refsource_CONFIRM |
| http://www.postgresql.org/docs/current/static/rel… | x_refsource_CONFIRM |
| http://www.postgresql.org/about/news/1569/ | x_refsource_CONFIRM |
| http://www.debian.org/security/2015/dsa-3155 | x_refsource_CONFIRM |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| PostgreSQL Global Development Group | PostgreSQL |
Affected:
before 9.0.19
Affected: 9.1.x before 9.1.15 Affected: 9.2.x before 9.2.10 Affected: 9.3.x before 9.3.6 Affected: 9.4.x before 9.4.1 |
Date Public
2015-02-05 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T13:10:51.110Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.postgresql.org/docs/9.4/static/release-9-4-1.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.postgresql.org/docs/current/static/release-9-0-19.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.postgresql.org/docs/current/static/release-9-1-15.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.postgresql.org/docs/current/static/release-9-2-10.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.postgresql.org/docs/current/static/release-9-3-6.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.postgresql.org/about/news/1569/"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.debian.org/security/2015/dsa-3155"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "PostgreSQL",
"vendor": "PostgreSQL Global Development Group",
"versions": [
{
"status": "affected",
"version": "before 9.0.19"
},
{
"status": "affected",
"version": "9.1.x before 9.1.15"
},
{
"status": "affected",
"version": "9.2.x before 9.2.10"
},
{
"status": "affected",
"version": "9.3.x before 9.3.6"
},
{
"status": "affected",
"version": "9.4.x before 9.4.1"
}
]
}
],
"datePublic": "2015-02-05T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1 allows remote authenticated users to obtain sensitive column values by triggering constraint violation and then reading the error message."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Path Disclosure",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-01-27T15:29:21.000Z",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.postgresql.org/docs/9.4/static/release-9-4-1.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.postgresql.org/docs/current/static/release-9-0-19.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.postgresql.org/docs/current/static/release-9-1-15.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.postgresql.org/docs/current/static/release-9-2-10.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.postgresql.org/docs/current/static/release-9-3-6.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.postgresql.org/about/news/1569/"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.debian.org/security/2015/dsa-3155"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "secalert@redhat.com",
"ID": "CVE-2014-8161",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "PostgreSQL",
"version": {
"version_data": [
{
"version_value": "before 9.0.19"
},
{
"version_value": "9.1.x before 9.1.15"
},
{
"version_value": "9.2.x before 9.2.10"
},
{
"version_value": "9.3.x before 9.3.6"
},
{
"version_value": "9.4.x before 9.4.1"
}
]
}
}
]
},
"vendor_name": "PostgreSQL Global Development Group"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1 allows remote authenticated users to obtain sensitive column values by triggering constraint violation and then reading the error message."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Path Disclosure"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.postgresql.org/docs/9.4/static/release-9-4-1.html",
"refsource": "CONFIRM",
"url": "http://www.postgresql.org/docs/9.4/static/release-9-4-1.html"
},
{
"name": "http://www.postgresql.org/docs/current/static/release-9-0-19.html",
"refsource": "CONFIRM",
"url": "http://www.postgresql.org/docs/current/static/release-9-0-19.html"
},
{
"name": "http://www.postgresql.org/docs/current/static/release-9-1-15.html",
"refsource": "CONFIRM",
"url": "http://www.postgresql.org/docs/current/static/release-9-1-15.html"
},
{
"name": "http://www.postgresql.org/docs/current/static/release-9-2-10.html",
"refsource": "CONFIRM",
"url": "http://www.postgresql.org/docs/current/static/release-9-2-10.html"
},
{
"name": "http://www.postgresql.org/docs/current/static/release-9-3-6.html",
"refsource": "CONFIRM",
"url": "http://www.postgresql.org/docs/current/static/release-9-3-6.html"
},
{
"name": "http://www.postgresql.org/about/news/1569/",
"refsource": "CONFIRM",
"url": "http://www.postgresql.org/about/news/1569/"
},
{
"name": "http://www.debian.org/security/2015/dsa-3155",
"refsource": "CONFIRM",
"url": "http://www.debian.org/security/2015/dsa-3155"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2014-8161",
"datePublished": "2020-01-27T15:29:21.000Z",
"dateReserved": "2014-10-10T00:00:00.000Z",
"dateUpdated": "2024-08-06T13:10:51.110Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2015-3166 (GCVE-0-2015-3166)
Vulnerability from nvd – Published: 2019-11-20 20:50 – Updated: 2024-08-06 05:39
VLAI
Summary
The snprintf implementation in PostgreSQL before 9.0.20, 9.1.x before 9.1.16, 9.2.x before 9.2.11, 9.3.x before 9.3.7, and 9.4.x before 9.4.2 does not properly handle system-call errors, which allows attackers to obtain sensitive information or have other unspecified impact via unknown vectors, as demonstrated by an out-of-memory error.
Severity
No CVSS data available.
CWE
- Other
Assigner
References
9 references
| URL | Tags |
|---|---|
| http://www.postgresql.org/about/news/1587/ | x_refsource_MISC |
| http://www.postgresql.org/docs/9.0/static/release… | x_refsource_MISC |
| http://www.postgresql.org/docs/9.1/static/release… | x_refsource_MISC |
| http://www.postgresql.org/docs/9.2/static/release… | x_refsource_MISC |
| http://www.postgresql.org/docs/9.3/static/release… | x_refsource_MISC |
| http://www.postgresql.org/docs/9.4/static/release… | x_refsource_MISC |
| http://www.debian.org/security/2015/dsa-3269 | x_refsource_MISC |
| http://www.debian.org/security/2015/dsa-3270 | x_refsource_MISC |
| http://ubuntu.com/usn/usn-2621-1 | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| PostgreSQL Global Development Group | PostgreSQL |
Affected:
before 9.0.20
Affected: 9.1.x before 9.1.16 Affected: 9.2.x before 9.2.11 Affected: 9.3.x before 9.3.7 Affected: and 9.4.x before 9.4.2 |
Date Public
2015-05-22 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T05:39:31.938Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.postgresql.org/about/news/1587/"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.postgresql.org/docs/9.0/static/release-9-0-20.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.postgresql.org/docs/9.1/static/release-9-1-16.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.postgresql.org/docs/9.2/static/release-9-2-11.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.postgresql.org/docs/9.3/static/release-9-3-7.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.postgresql.org/docs/9.4/static/release-9-4-2.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.debian.org/security/2015/dsa-3269"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.debian.org/security/2015/dsa-3270"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://ubuntu.com/usn/usn-2621-1"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "PostgreSQL",
"vendor": "PostgreSQL Global Development Group",
"versions": [
{
"status": "affected",
"version": "before 9.0.20"
},
{
"status": "affected",
"version": "9.1.x before 9.1.16"
},
{
"status": "affected",
"version": "9.2.x before 9.2.11"
},
{
"status": "affected",
"version": "9.3.x before 9.3.7"
},
{
"status": "affected",
"version": "and 9.4.x before 9.4.2"
}
]
}
],
"datePublic": "2015-05-22T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "The snprintf implementation in PostgreSQL before 9.0.20, 9.1.x before 9.1.16, 9.2.x before 9.2.11, 9.3.x before 9.3.7, and 9.4.x before 9.4.2 does not properly handle system-call errors, which allows attackers to obtain sensitive information or have other unspecified impact via unknown vectors, as demonstrated by an out-of-memory error."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Other",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-11-20T20:50:16.000Z",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.postgresql.org/about/news/1587/"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.postgresql.org/docs/9.0/static/release-9-0-20.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.postgresql.org/docs/9.1/static/release-9-1-16.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.postgresql.org/docs/9.2/static/release-9-2-11.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.postgresql.org/docs/9.3/static/release-9-3-7.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.postgresql.org/docs/9.4/static/release-9-4-2.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.debian.org/security/2015/dsa-3269"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.debian.org/security/2015/dsa-3270"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://ubuntu.com/usn/usn-2621-1"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "secalert@redhat.com",
"ID": "CVE-2015-3166",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "PostgreSQL",
"version": {
"version_data": [
{
"version_value": "before 9.0.20"
},
{
"version_value": "9.1.x before 9.1.16"
},
{
"version_value": "9.2.x before 9.2.11"
},
{
"version_value": "9.3.x before 9.3.7"
},
{
"version_value": "and 9.4.x before 9.4.2"
}
]
}
}
]
},
"vendor_name": "PostgreSQL Global Development Group"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The snprintf implementation in PostgreSQL before 9.0.20, 9.1.x before 9.1.16, 9.2.x before 9.2.11, 9.3.x before 9.3.7, and 9.4.x before 9.4.2 does not properly handle system-call errors, which allows attackers to obtain sensitive information or have other unspecified impact via unknown vectors, as demonstrated by an out-of-memory error."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Other"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.postgresql.org/about/news/1587/",
"refsource": "MISC",
"url": "http://www.postgresql.org/about/news/1587/"
},
{
"name": "http://www.postgresql.org/docs/9.0/static/release-9-0-20.html",
"refsource": "MISC",
"url": "http://www.postgresql.org/docs/9.0/static/release-9-0-20.html"
},
{
"name": "http://www.postgresql.org/docs/9.1/static/release-9-1-16.html",
"refsource": "MISC",
"url": "http://www.postgresql.org/docs/9.1/static/release-9-1-16.html"
},
{
"name": "http://www.postgresql.org/docs/9.2/static/release-9-2-11.html",
"refsource": "MISC",
"url": "http://www.postgresql.org/docs/9.2/static/release-9-2-11.html"
},
{
"name": "http://www.postgresql.org/docs/9.3/static/release-9-3-7.html",
"refsource": "MISC",
"url": "http://www.postgresql.org/docs/9.3/static/release-9-3-7.html"
},
{
"name": "http://www.postgresql.org/docs/9.4/static/release-9-4-2.html",
"refsource": "MISC",
"url": "http://www.postgresql.org/docs/9.4/static/release-9-4-2.html"
},
{
"name": "http://www.debian.org/security/2015/dsa-3269",
"refsource": "MISC",
"url": "http://www.debian.org/security/2015/dsa-3269"
},
{
"name": "http://www.debian.org/security/2015/dsa-3270",
"refsource": "MISC",
"url": "http://www.debian.org/security/2015/dsa-3270"
},
{
"name": "http://ubuntu.com/usn/usn-2621-1",
"refsource": "MISC",
"url": "http://ubuntu.com/usn/usn-2621-1"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2015-3166",
"datePublished": "2019-11-20T20:50:16.000Z",
"dateReserved": "2015-04-10T00:00:00.000Z",
"dateUpdated": "2024-08-06T05:39:31.938Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2015-3167 (GCVE-0-2015-3167)
Vulnerability from nvd – Published: 2019-11-20 20:50 – Updated: 2024-08-06 05:39
VLAI
Summary
contrib/pgcrypto in PostgreSQL before 9.0.20, 9.1.x before 9.1.16, 9.2.x before 9.2.11, 9.3.x before 9.3.7, and 9.4.x before 9.4.2 uses different error responses when an incorrect key is used, which makes it easier for attackers to obtain the key via a brute force attack.
Severity
No CVSS data available.
CWE
- Other
Assigner
References
9 references
| URL | Tags |
|---|---|
| http://www.postgresql.org/about/news/1587/ | x_refsource_MISC |
| http://www.postgresql.org/docs/9.0/static/release… | x_refsource_MISC |
| http://www.postgresql.org/docs/9.1/static/release… | x_refsource_MISC |
| http://www.postgresql.org/docs/9.2/static/release… | x_refsource_MISC |
| http://www.postgresql.org/docs/9.3/static/release… | x_refsource_MISC |
| http://www.postgresql.org/docs/9.4/static/release… | x_refsource_MISC |
| http://www.debian.org/security/2015/dsa-3269 | x_refsource_MISC |
| http://www.debian.org/security/2015/dsa-3270 | x_refsource_MISC |
| http://ubuntu.com/usn/usn-2621-1 | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| PostgreSQL Global Development Group | PostgreSQL |
Affected:
before 9.0.20
Affected: 9.1.x before 9.1.16 Affected: 9.2.x before 9.2.11 Affected: 9.3.x before 9.3.7 Affected: and 9.4.x before 9.4.2 |
Date Public
2015-05-22 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T05:39:31.906Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.postgresql.org/about/news/1587/"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.postgresql.org/docs/9.0/static/release-9-0-20.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.postgresql.org/docs/9.1/static/release-9-1-16.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.postgresql.org/docs/9.2/static/release-9-2-11.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.postgresql.org/docs/9.3/static/release-9-3-7.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.postgresql.org/docs/9.4/static/release-9-4-2.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.debian.org/security/2015/dsa-3269"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.debian.org/security/2015/dsa-3270"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://ubuntu.com/usn/usn-2621-1"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "PostgreSQL",
"vendor": "PostgreSQL Global Development Group",
"versions": [
{
"status": "affected",
"version": "before 9.0.20"
},
{
"status": "affected",
"version": "9.1.x before 9.1.16"
},
{
"status": "affected",
"version": "9.2.x before 9.2.11"
},
{
"status": "affected",
"version": "9.3.x before 9.3.7"
},
{
"status": "affected",
"version": "and 9.4.x before 9.4.2"
}
]
}
],
"datePublic": "2015-05-22T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "contrib/pgcrypto in PostgreSQL before 9.0.20, 9.1.x before 9.1.16, 9.2.x before 9.2.11, 9.3.x before 9.3.7, and 9.4.x before 9.4.2 uses different error responses when an incorrect key is used, which makes it easier for attackers to obtain the key via a brute force attack."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Other",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-11-20T20:50:14.000Z",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.postgresql.org/about/news/1587/"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.postgresql.org/docs/9.0/static/release-9-0-20.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.postgresql.org/docs/9.1/static/release-9-1-16.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.postgresql.org/docs/9.2/static/release-9-2-11.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.postgresql.org/docs/9.3/static/release-9-3-7.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.postgresql.org/docs/9.4/static/release-9-4-2.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.debian.org/security/2015/dsa-3269"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.debian.org/security/2015/dsa-3270"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://ubuntu.com/usn/usn-2621-1"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "secalert@redhat.com",
"ID": "CVE-2015-3167",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "PostgreSQL",
"version": {
"version_data": [
{
"version_value": "before 9.0.20"
},
{
"version_value": "9.1.x before 9.1.16"
},
{
"version_value": "9.2.x before 9.2.11"
},
{
"version_value": "9.3.x before 9.3.7"
},
{
"version_value": "and 9.4.x before 9.4.2"
}
]
}
}
]
},
"vendor_name": "PostgreSQL Global Development Group"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "contrib/pgcrypto in PostgreSQL before 9.0.20, 9.1.x before 9.1.16, 9.2.x before 9.2.11, 9.3.x before 9.3.7, and 9.4.x before 9.4.2 uses different error responses when an incorrect key is used, which makes it easier for attackers to obtain the key via a brute force attack."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Other"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.postgresql.org/about/news/1587/",
"refsource": "MISC",
"url": "http://www.postgresql.org/about/news/1587/"
},
{
"name": "http://www.postgresql.org/docs/9.0/static/release-9-0-20.html",
"refsource": "MISC",
"url": "http://www.postgresql.org/docs/9.0/static/release-9-0-20.html"
},
{
"name": "http://www.postgresql.org/docs/9.1/static/release-9-1-16.html",
"refsource": "MISC",
"url": "http://www.postgresql.org/docs/9.1/static/release-9-1-16.html"
},
{
"name": "http://www.postgresql.org/docs/9.2/static/release-9-2-11.html",
"refsource": "MISC",
"url": "http://www.postgresql.org/docs/9.2/static/release-9-2-11.html"
},
{
"name": "http://www.postgresql.org/docs/9.3/static/release-9-3-7.html",
"refsource": "MISC",
"url": "http://www.postgresql.org/docs/9.3/static/release-9-3-7.html"
},
{
"name": "http://www.postgresql.org/docs/9.4/static/release-9-4-2.html",
"refsource": "MISC",
"url": "http://www.postgresql.org/docs/9.4/static/release-9-4-2.html"
},
{
"name": "http://www.debian.org/security/2015/dsa-3269",
"refsource": "MISC",
"url": "http://www.debian.org/security/2015/dsa-3269"
},
{
"name": "http://www.debian.org/security/2015/dsa-3270",
"refsource": "MISC",
"url": "http://www.debian.org/security/2015/dsa-3270"
},
{
"name": "http://ubuntu.com/usn/usn-2621-1",
"refsource": "MISC",
"url": "http://ubuntu.com/usn/usn-2621-1"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2015-3167",
"datePublished": "2019-11-20T20:50:14.000Z",
"dateReserved": "2015-04-10T00:00:00.000Z",
"dateUpdated": "2024-08-06T05:39:31.906Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2018-10925 (GCVE-0-2018-10925)
Vulnerability from nvd – Published: 2018-08-09 21:00 – Updated: 2024-08-05 07:54
VLAI
Summary
It was discovered that PostgreSQL versions before 10.5, 9.6.10, 9.5.14, 9.4.19, and 9.3.24 failed to properly check authorization on certain statements involved with "INSERT ... ON CONFLICT DO UPDATE". An attacker with "CREATE TABLE" privileges could exploit this to read arbitrary bytes server memory. If the attacker also had certain "INSERT" and limited "UPDATE" privileges to a particular table, they could exploit this to update other columns in the same table.
Severity
7.1 (High)
CWE
Assigner
References
12 references
| URL | Tags |
|---|---|
| https://security.gentoo.org/glsa/201810-08 | vendor-advisoryx_refsource_GENTOO |
| https://www.debian.org/security/2018/dsa-4269 | vendor-advisoryx_refsource_DEBIAN |
| http://www.securityfocus.com/bid/105052 | vdb-entryx_refsource_BID |
| https://access.redhat.com/errata/RHSA-2018:2511 | vendor-advisoryx_refsource_REDHAT |
| https://usn.ubuntu.com/3744-1/ | vendor-advisoryx_refsource_UBUNTU |
| https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2… | x_refsource_CONFIRM |
| https://access.redhat.com/errata/RHSA-2018:2566 | vendor-advisoryx_refsource_REDHAT |
| https://access.redhat.com/errata/RHSA-2018:2565 | vendor-advisoryx_refsource_REDHAT |
| https://access.redhat.com/errata/RHSA-2018:3816 | vendor-advisoryx_refsource_REDHAT |
| https://www.postgresql.org/about/news/1878/ | x_refsource_CONFIRM |
| http://www.securitytracker.com/id/1041446 | vdb-entryx_refsource_SECTRACK |
| http://lists.opensuse.org/opensuse-security-annou… | vendor-advisoryx_refsource_SUSE |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| PostgreSQL Global Development Group | postgresql |
Affected:
10.5
Affected: 9.6.10 Affected: 9.5.14 Affected: 9.4.19 Affected: 9.3.24 |
Date Public
2018-08-09 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T07:54:36.061Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "GLSA-201810-08",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/201810-08"
},
{
"name": "DSA-4269",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "https://www.debian.org/security/2018/dsa-4269"
},
{
"name": "105052",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/105052"
},
{
"name": "RHSA-2018:2511",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "https://access.redhat.com/errata/RHSA-2018:2511"
},
{
"name": "USN-3744-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU",
"x_transferred"
],
"url": "https://usn.ubuntu.com/3744-1/"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10925"
},
{
"name": "RHSA-2018:2566",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "https://access.redhat.com/errata/RHSA-2018:2566"
},
{
"name": "RHSA-2018:2565",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "https://access.redhat.com/errata/RHSA-2018:2565"
},
{
"name": "RHSA-2018:3816",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "https://access.redhat.com/errata/RHSA-2018:3816"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.postgresql.org/about/news/1878/"
},
{
"name": "1041446",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://www.securitytracker.com/id/1041446"
},
{
"name": "openSUSE-SU-2020:1227",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00043.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "postgresql",
"vendor": "PostgreSQL Global Development Group",
"versions": [
{
"status": "affected",
"version": "10.5"
},
{
"status": "affected",
"version": "9.6.10"
},
{
"status": "affected",
"version": "9.5.14"
},
{
"status": "affected",
"version": "9.4.19"
},
{
"status": "affected",
"version": "9.3.24"
}
]
}
],
"datePublic": "2018-08-09T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "It was discovered that PostgreSQL versions before 10.5, 9.6.10, 9.5.14, 9.4.19, and 9.3.24 failed to properly check authorization on certain statements involved with \"INSERT ... ON CONFLICT DO UPDATE\". An attacker with \"CREATE TABLE\" privileges could exploit this to read arbitrary bytes server memory. If the attacker also had certain \"INSERT\" and limited \"UPDATE\" privileges to a particular table, they could exploit this to update other columns in the same table."
}
],
"metrics": [
{
"cvssV3_0": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-08-17T17:06:15.000Z",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"name": "GLSA-201810-08",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "https://security.gentoo.org/glsa/201810-08"
},
{
"name": "DSA-4269",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "https://www.debian.org/security/2018/dsa-4269"
},
{
"name": "105052",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/105052"
},
{
"name": "RHSA-2018:2511",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2018:2511"
},
{
"name": "USN-3744-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU"
],
"url": "https://usn.ubuntu.com/3744-1/"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10925"
},
{
"name": "RHSA-2018:2566",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2018:2566"
},
{
"name": "RHSA-2018:2565",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2018:2565"
},
{
"name": "RHSA-2018:3816",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2018:3816"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.postgresql.org/about/news/1878/"
},
{
"name": "1041446",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://www.securitytracker.com/id/1041446"
},
{
"name": "openSUSE-SU-2020:1227",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00043.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "secalert@redhat.com",
"ID": "CVE-2018-10925",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "postgresql",
"version": {
"version_data": [
{
"version_value": "10.5"
},
{
"version_value": "9.6.10"
},
{
"version_value": "9.5.14"
},
{
"version_value": "9.4.19"
},
{
"version_value": "9.3.24"
}
]
}
}
]
},
"vendor_name": "PostgreSQL Global Development Group"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "It was discovered that PostgreSQL versions before 10.5, 9.6.10, 9.5.14, 9.4.19, and 9.3.24 failed to properly check authorization on certain statements involved with \"INSERT ... ON CONFLICT DO UPDATE\". An attacker with \"CREATE TABLE\" privileges could exploit this to read arbitrary bytes server memory. If the attacker also had certain \"INSERT\" and limited \"UPDATE\" privileges to a particular table, they could exploit this to update other columns in the same table."
}
]
},
"impact": {
"cvss": [
[
{
"vectorString": "7.1/CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
"version": "3.0"
}
]
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-863"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "GLSA-201810-08",
"refsource": "GENTOO",
"url": "https://security.gentoo.org/glsa/201810-08"
},
{
"name": "DSA-4269",
"refsource": "DEBIAN",
"url": "https://www.debian.org/security/2018/dsa-4269"
},
{
"name": "105052",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/105052"
},
{
"name": "RHSA-2018:2511",
"refsource": "REDHAT",
"url": "https://access.redhat.com/errata/RHSA-2018:2511"
},
{
"name": "USN-3744-1",
"refsource": "UBUNTU",
"url": "https://usn.ubuntu.com/3744-1/"
},
{
"name": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10925",
"refsource": "CONFIRM",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10925"
},
{
"name": "RHSA-2018:2566",
"refsource": "REDHAT",
"url": "https://access.redhat.com/errata/RHSA-2018:2566"
},
{
"name": "RHSA-2018:2565",
"refsource": "REDHAT",
"url": "https://access.redhat.com/errata/RHSA-2018:2565"
},
{
"name": "RHSA-2018:3816",
"refsource": "REDHAT",
"url": "https://access.redhat.com/errata/RHSA-2018:3816"
},
{
"name": "https://www.postgresql.org/about/news/1878/",
"refsource": "CONFIRM",
"url": "https://www.postgresql.org/about/news/1878/"
},
{
"name": "1041446",
"refsource": "SECTRACK",
"url": "http://www.securitytracker.com/id/1041446"
},
{
"name": "openSUSE-SU-2020:1227",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00043.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2018-10925",
"datePublished": "2018-08-09T21:00:00.000Z",
"dateReserved": "2018-05-09T00:00:00.000Z",
"dateUpdated": "2024-08-05T07:54:36.061Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2018-10915 (GCVE-0-2018-10915)
Vulnerability from nvd – Published: 2018-08-09 20:00 – Updated: 2024-08-05 07:54
VLAI
Summary
A vulnerability was found in libpq, the default PostgreSQL client library where libpq failed to properly reset its internal state between connections. If an affected version of libpq was used with "host" or "hostaddr" connection parameters from untrusted input, attackers could bypass client-side connection security features, obtain access to higher privileged connections or potentially cause other impact through SQL injection, by causing the PQescape() functions to malfunction. Postgresql versions before 10.5, 9.6.10, 9.5.14, 9.4.19, and 9.3.24 are affected.
Severity
8.5 (High)
Assigner
References
17 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| PostgreSQL Global Development Group | postgresql |
Affected:
10.5
Affected: 9.6.10 Affected: 9.5.14 Affected: 9.4.19 Affected: 9.3.24 |
Date Public
2018-08-09 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T07:54:36.359Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "GLSA-201810-08",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/201810-08"
},
{
"name": "RHSA-2018:2729",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "https://access.redhat.com/errata/RHSA-2018:2729"
},
{
"name": "DSA-4269",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "https://www.debian.org/security/2018/dsa-4269"
},
{
"name": "RHSA-2018:2643",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "https://access.redhat.com/errata/RHSA-2018:2643"
},
{
"name": "RHSA-2018:2721",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "https://access.redhat.com/errata/RHSA-2018:2721"
},
{
"name": "RHSA-2018:2511",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "https://access.redhat.com/errata/RHSA-2018:2511"
},
{
"name": "USN-3744-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU",
"x_transferred"
],
"url": "https://usn.ubuntu.com/3744-1/"
},
{
"name": "[debian-lts-announce] 20180815 [SECURITY] [DLA 1464-1] postgresql-9.4 security update",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2018/08/msg00012.html"
},
{
"name": "RHSA-2018:2566",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "https://access.redhat.com/errata/RHSA-2018:2566"
},
{
"name": "RHSA-2018:2565",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "https://access.redhat.com/errata/RHSA-2018:2565"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10915"
},
{
"name": "RHSA-2018:3816",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "https://access.redhat.com/errata/RHSA-2018:3816"
},
{
"name": "105054",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/105054"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.postgresql.org/about/news/1878/"
},
{
"name": "RHSA-2018:2557",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "https://access.redhat.com/errata/RHSA-2018:2557"
},
{
"name": "1041446",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://www.securitytracker.com/id/1041446"
},
{
"name": "openSUSE-SU-2020:1227",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00043.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "postgresql",
"vendor": "PostgreSQL Global Development Group",
"versions": [
{
"status": "affected",
"version": "10.5"
},
{
"status": "affected",
"version": "9.6.10"
},
{
"status": "affected",
"version": "9.5.14"
},
{
"status": "affected",
"version": "9.4.19"
},
{
"status": "affected",
"version": "9.3.24"
}
]
}
],
"datePublic": "2018-08-09T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was found in libpq, the default PostgreSQL client library where libpq failed to properly reset its internal state between connections. If an affected version of libpq was used with \"host\" or \"hostaddr\" connection parameters from untrusted input, attackers could bypass client-side connection security features, obtain access to higher privileged connections or potentially cause other impact through SQL injection, by causing the PQescape() functions to malfunction. Postgresql versions before 10.5, 9.6.10, 9.5.14, 9.4.19, and 9.3.24 are affected."
}
],
"metrics": [
{
"cvssV3_0": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-665",
"description": "CWE-665",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-08-17T17:06:12.000Z",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"name": "GLSA-201810-08",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "https://security.gentoo.org/glsa/201810-08"
},
{
"name": "RHSA-2018:2729",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2018:2729"
},
{
"name": "DSA-4269",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "https://www.debian.org/security/2018/dsa-4269"
},
{
"name": "RHSA-2018:2643",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2018:2643"
},
{
"name": "RHSA-2018:2721",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2018:2721"
},
{
"name": "RHSA-2018:2511",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2018:2511"
},
{
"name": "USN-3744-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU"
],
"url": "https://usn.ubuntu.com/3744-1/"
},
{
"name": "[debian-lts-announce] 20180815 [SECURITY] [DLA 1464-1] postgresql-9.4 security update",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.debian.org/debian-lts-announce/2018/08/msg00012.html"
},
{
"name": "RHSA-2018:2566",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2018:2566"
},
{
"name": "RHSA-2018:2565",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2018:2565"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10915"
},
{
"name": "RHSA-2018:3816",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2018:3816"
},
{
"name": "105054",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/105054"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.postgresql.org/about/news/1878/"
},
{
"name": "RHSA-2018:2557",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2018:2557"
},
{
"name": "1041446",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://www.securitytracker.com/id/1041446"
},
{
"name": "openSUSE-SU-2020:1227",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00043.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "secalert@redhat.com",
"ID": "CVE-2018-10915",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "postgresql",
"version": {
"version_data": [
{
"version_value": "10.5"
},
{
"version_value": "9.6.10"
},
{
"version_value": "9.5.14"
},
{
"version_value": "9.4.19"
},
{
"version_value": "9.3.24"
}
]
}
}
]
},
"vendor_name": "PostgreSQL Global Development Group"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A vulnerability was found in libpq, the default PostgreSQL client library where libpq failed to properly reset its internal state between connections. If an affected version of libpq was used with \"host\" or \"hostaddr\" connection parameters from untrusted input, attackers could bypass client-side connection security features, obtain access to higher privileged connections or potentially cause other impact through SQL injection, by causing the PQescape() functions to malfunction. Postgresql versions before 10.5, 9.6.10, 9.5.14, 9.4.19, and 9.3.24 are affected."
}
]
},
"impact": {
"cvss": [
[
{
"vectorString": "8.5/CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.0"
}
]
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-665"
}
]
},
{
"description": [
{
"lang": "eng",
"value": "CWE-200"
}
]
},
{
"description": [
{
"lang": "eng",
"value": "CWE-89"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "GLSA-201810-08",
"refsource": "GENTOO",
"url": "https://security.gentoo.org/glsa/201810-08"
},
{
"name": "RHSA-2018:2729",
"refsource": "REDHAT",
"url": "https://access.redhat.com/errata/RHSA-2018:2729"
},
{
"name": "DSA-4269",
"refsource": "DEBIAN",
"url": "https://www.debian.org/security/2018/dsa-4269"
},
{
"name": "RHSA-2018:2643",
"refsource": "REDHAT",
"url": "https://access.redhat.com/errata/RHSA-2018:2643"
},
{
"name": "RHSA-2018:2721",
"refsource": "REDHAT",
"url": "https://access.redhat.com/errata/RHSA-2018:2721"
},
{
"name": "RHSA-2018:2511",
"refsource": "REDHAT",
"url": "https://access.redhat.com/errata/RHSA-2018:2511"
},
{
"name": "USN-3744-1",
"refsource": "UBUNTU",
"url": "https://usn.ubuntu.com/3744-1/"
},
{
"name": "[debian-lts-announce] 20180815 [SECURITY] [DLA 1464-1] postgresql-9.4 security update",
"refsource": "MLIST",
"url": "https://lists.debian.org/debian-lts-announce/2018/08/msg00012.html"
},
{
"name": "RHSA-2018:2566",
"refsource": "REDHAT",
"url": "https://access.redhat.com/errata/RHSA-2018:2566"
},
{
"name": "RHSA-2018:2565",
"refsource": "REDHAT",
"url": "https://access.redhat.com/errata/RHSA-2018:2565"
},
{
"name": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10915",
"refsource": "CONFIRM",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10915"
},
{
"name": "RHSA-2018:3816",
"refsource": "REDHAT",
"url": "https://access.redhat.com/errata/RHSA-2018:3816"
},
{
"name": "105054",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/105054"
},
{
"name": "https://www.postgresql.org/about/news/1878/",
"refsource": "CONFIRM",
"url": "https://www.postgresql.org/about/news/1878/"
},
{
"name": "RHSA-2018:2557",
"refsource": "REDHAT",
"url": "https://access.redhat.com/errata/RHSA-2018:2557"
},
{
"name": "1041446",
"refsource": "SECTRACK",
"url": "http://www.securitytracker.com/id/1041446"
},
{
"name": "openSUSE-SU-2020:1227",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00043.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2018-10915",
"datePublished": "2018-08-09T20:00:00.000Z",
"dateReserved": "2018-05-09T00:00:00.000Z",
"dateUpdated": "2024-08-05T07:54:36.359Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}