PT-2013-1001 · Postgresql+3 · Postgresql+3
Published
2013-02-13
·
Updated
2024-06-15
·
CVE-2013-0255
CVSS v2.0
6.8
Medium
| Vector | AV:N/AC:L/Au:S/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
PostgreSQL versions 8.3.x through 8.3.23
PostgreSQL versions 8.4.x through 8.4.16
PostgreSQL versions 9.0.x through 9.0.12
PostgreSQL versions 9.1.x through 9.1.8
PostgreSQL versions 9.2.x through 9.2.3
Description
The issue is related to the incorrect declaration of the
enum recv function in the backend/utils/adt/enum.c interface, which allows remote authenticated users to cause a denial of service or read sensitive process memory via a crafted SQL command. This command triggers an array index error and an out-of-bounds read, potentially crashing the server.Recommendations
For PostgreSQL versions 8.3.x through 8.3.23, update to a version later than 8.3.23 to resolve the issue.
For PostgreSQL versions 8.4.x through 8.4.16, update to a version later than 8.4.16 to resolve the issue.
For PostgreSQL versions 9.0.x through 9.0.12, update to a version later than 9.0.12 to resolve the issue.
For PostgreSQL versions 9.1.x through 9.1.8, update to a version later than 9.1.8 to resolve the issue.
For PostgreSQL versions 9.2.x through 9.2.3, update to a version later than 9.2.3 to resolve the issue.
Fix
DoS
RCE
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Centos
Postgresql
Red Hat
Suse