PT-2015-4537 · Postgresql+1 · Postgresql+1

Tom Lane · Published 2015-02-05 · Updated 2024-06-15 · CVE-2015-0242

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions PostgreSQL versions prior to 9.0.19 PostgreSQL versions 9.1.x prior to 9.1.15 PostgreSQL versions 9.2.x prior to 9.2.10 PostgreSQL versions 9.3.x prior to 9.3.6 PostgreSQL versions 9.4.x prior to 9.4.1

Description A stack-based buffer overflow in the *printf function implementations in PostgreSQL, when running on a Windows system, allows remote authenticated users to cause a denial of service (crash) and possibly execute arbitrary code via a floating point number with a large precision, as demonstrated by using the to char function.

Recommendations For PostgreSQL versions prior to 9.0.19, update to version 9.0.19 or later. For PostgreSQL versions 9.1.x prior to 9.1.15, update to version 9.1.15 or later. For PostgreSQL versions 9.2.x prior to 9.2.10, update to version 9.2.10 or later. For PostgreSQL versions 9.3.x prior to 9.3.6, update to version 9.3.6 or later. For PostgreSQL versions 9.4.x prior to 9.4.1, update to version 9.4.1 or later. As a temporary workaround, consider restricting the use of the to char function until a patch is available.

Fix

DoS

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2015-0242

MGASA-2015-0069

OPENSUSE-SU-2024:10256-1

Affected Products

Postgresql

Suse

References · 58

• http://postgresql.org/docs/current/static/release-9-3-6.html · Vendor Advisory
• http://postgresql.org/about/news/1569 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10256-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-0242 · Security Note
• http://postgresql.org/docs/9.4/static/release-9-4-1.html · Vendor Advisory
• https://advisories.mageia.org/MGASA-2015-0069.html · Security Note
• http://postgresql.org/docs/current/static/release-9-0-19.html · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2015-0069 · Vendor Advisory
• http://postgresql.org/docs/current/static/release-9-1-15.html · Vendor Advisory
• https://debian.org/security/2015/dsa-3155 · Vendor Advisory
• http://postgresql.org/docs/current/static/release-9-2-10.html · Vendor Advisory
• https://postgresql.org/support/security · Note
• https://suse.com/security/cve/CVE-2014-0063 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0242 · Note
• https://suse.com/security/cve/CVE-2015-3167 · Note