PT-2016-5351 · Postgresql · Postgresql

Andreas Seltenreich · Publicado 2016-03-31 · Atualizado 2024-06-15 · CVE-2016-3065

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions PostgreSQL versions prior to 9.5.2

Description The issue allows attackers to bypass intended access restrictions, potentially obtaining sensitive server memory information or causing a denial of service (server crash) via a crafted bytea value in a BRIN index page. This is due to the lack of permission checks for BRIN indexes in the pageinspect extension.

Recommendations For versions prior to 9.5.2, update to version 9.5.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the pageinspect extension to minimize the risk of exploitation.

Correção

DoS

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2016-3065

MGASA-2016-0136

OPENSUSE-SU-2024:10273-1

Produtos afetados

Postgresql

Referências · 53

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3065 · Nota
• https://suse.com/security/cve/CVE-2014-0063 · Nota
• https://bugs.mageia.org/show_bug.cgi?id=18103 · Nota
• https://suse.com/security/cve/CVE-2007-6600 · Nota
• https://suse.com/security/cve/CVE-2014-0062 · Nota
• https://postgresql.org/support/security/CVE-2016-3065 · Nota
• https://suse.com/security/cve/CVE-2016-3065 · Nota
• https://suse.com/security/cve/CVE-2016-0766 · Nota
• https://suse.com/security/cve/CVE-2016-5423 · Nota
• https://suse.com/security/cve/CVE-2013-1899 · Nota
• https://suse.com/security/cve/CVE-2014-0065 · Nota
• https://suse.com/security/cve/CVE-2012-0867 · Nota
• https://suse.com/security/cve/CVE-2010-1169 · Nota
• https://suse.com/security/cve/CVE-2013-1901 · Nota
• https://suse.com/security/cve/CVE-2014-0060 · Nota