PT-2016-5351 · Postgresql · Postgresql

Andreas Seltenreich · Published 2016-03-31 · Updated 2024-06-15 · CVE-2016-3065

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions PostgreSQL versions prior to 9.5.2

Description The issue allows attackers to bypass intended access restrictions, potentially obtaining sensitive server memory information or causing a denial of service (server crash) via a crafted bytea value in a BRIN index page. This is due to the lack of permission checks for BRIN indexes in the pageinspect extension.

Recommendations For versions prior to 9.5.2, update to version 9.5.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the pageinspect extension to minimize the risk of exploitation.

Fix

DoS

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2016-3065

MGASA-2016-0136

OPENSUSE-SU-2024:10273-1

Affected Products

Postgresql

References · 53

• https://nvd.nist.gov/vuln/detail/CVE-2016-3065 · Security Note
• http://postgresql.org/about/news/1656 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2016-0136.html · Security Note
• https://osv.dev/vulnerability/CVE-2016-3065 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2016-0136 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10273-1 · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3065 · Note
• https://suse.com/security/cve/CVE-2014-0063 · Note
• https://bugs.mageia.org/show_bug.cgi?id=18103 · Note
• https://suse.com/security/cve/CVE-2007-6600 · Note
• https://suse.com/security/cve/CVE-2014-0062 · Note
• https://postgresql.org/support/security/CVE-2016-3065 · Note
• https://suse.com/security/cve/CVE-2016-3065 · Note
• https://suse.com/security/cve/CVE-2016-0766 · Note
• https://suse.com/security/cve/CVE-2016-5423 · Note