PT-2014-4862 · Postgresql+1 · Postgresql+1

Published 2014-02-28 · Updated 2017-12-16 · CVE-2014-2669

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions PostgreSQL versions 9.0.x through 9.0.15 PostgreSQL versions 9.1.x through 9.1.11 PostgreSQL versions 9.2.x through 9.2.6 PostgreSQL versions 9.3.x through 9.3.2

Description The issue is caused by multiple integer overflows in the contrib/hstore/hstore io.c file, which can be exploited by remote authenticated users. The overflows are related to the hstore recv, hstore from arrays, and hstore from array functions in contrib/hstore/hstore io.c, as well as the hstoreArrayToPairs function in contrib/hstore/hstore op.c. This can trigger a buffer overflow, allowing attackers to have an unspecified impact.

Recommendations For PostgreSQL versions 9.0.x through 9.0.15, update to version 9.0.16 or later. For PostgreSQL versions 9.1.x through 9.1.11, update to version 9.1.12 or later. For PostgreSQL versions 9.2.x through 9.2.6, update to version 9.2.7 or later. For PostgreSQL versions 9.3.x through 9.3.2, update to version 9.3.3 or later.

Fix

Weakness Enumeration

CWE-189

Related Identifiers

CESA-2014_0221

CVE-2014-2669

DSA-2865-1

RHSA-2014:0221

RHSA-2014:0469

Affected Products

Centos

Postgresql

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2014-2669 · Security Note
• http://rhn.redhat.com/errata/RHSA-2014-0221.html · Vendor Advisory
• http://debian.org/security/2014/dsa-2864 · Vendor Advisory
• http://postgresql.org/about/news/1506 · Vendor Advisory
• http://wiki.postgresql.org/wiki/20140220securityrelease · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2014-2669 · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2014-0469.html · Vendor Advisory
• http://debian.org/security/2014/dsa-2865 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2014-2669 · Security Note
• https://ubuntu.com/security/CVE-2014-2669 · Vendor Advisory
• https://github.com/postgres/postgres/commit/31400a673325147e1205326008e32135a78b4d8a · Note
• http://postgresql.org/support/security · Note