PT-2015-1387 · Postgresql+4 · Postgresql+4

Benkocs Norbert Attila · Published 2015-05-22 · Updated 2024-06-15 · CVE-2015-3165

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions PostgreSQL versions 9.0.x through 9.0.19 PostgreSQL versions 9.1.x through 9.1.15 PostgreSQL versions 9.2.x through 9.2.10 PostgreSQL versions 9.3.x through 9.3.6 PostgreSQL versions 9.4.x through 9.4.1

Description The issue is related to a double free vulnerability that allows remote attackers to cause a denial of service by closing an SSL session at a specific time during the session shutdown sequence. This can lead to a crash. The estimated number of potentially affected devices and details about real-world incidents are not provided.

Recommendations For PostgreSQL versions 9.0.x through 9.0.19, update to version 9.0.20 or later. For PostgreSQL versions 9.1.x through 9.1.15, update to version 9.1.16 or later. For PostgreSQL versions 9.2.x through 9.2.10, update to version 9.2.11 or later. For PostgreSQL versions 9.3.x through 9.3.6, update to version 9.3.7 or later. For PostgreSQL versions 9.4.x through 9.4.1, update to version 9.4.2 or later.

Fix

Double Free

Weakness Enumeration

CWE-415

Related Identifiers

BDU:2015-10480

BDU:2015-10482

BDU:2015-10483

CESA-2015_1194

CVE-2015-3165

DLA-227-1

DSA-3269-1

DSA-3269-2

DSA-3270-1

MGASA-2015-0250

OPENSUSE-SU-2024:10030-1

OPENSUSE-SU-2024:10256-1

OPENSUSE-SU-2024:10273-1

RHSA-2015:1194

RHSA-2015:1195

RHSA-2015:1196

RHSA-2015_1194

SUSE-SU-2015:1264-1

SUSE-SU-2015_1091-1

SUSE-SU-2015_1264-1

USN-2621-1

Affected Products

Centos

Postgresql

Red Hat

Suse

Ubuntu

References · 125

• https://bdu.fstec.ru/vul/2015-10480 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3167 · Security Note
• http://postgresql.org/about/news/1587 · Vendor Advisory
• https://security-tracker.debian.org/tracker/source-package/postgresql-9.1 · Vendor Advisory
• https://osv.dev/vulnerability/USN-2621-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-2621-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2015-3165 · Vendor Advisory
• http://ubuntu.com/usn/USN-2621-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10273-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2015-3167 · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2015-1195.html · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2015-3165 · Security Note
• http://debian.org/security/2015/dsa-3269 · Vendor Advisory
• https://security-tracker.debian.org/tracker/DSA-3269-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-10482 · Security Note