Security Advisory - Three Vulnerabilities in Huawei GaussDB

There is a information leak vulnerability in libevent of Huawei GaussDB. Due to insufficient input validation, a remote attacker could exploit this vulnerability by sending a forged DNS response to an application using libevent. Successful exploit of the vulnerability could lead to reading data o...

Security Advisory - SQL Injection Vulnerability in the GaussDB

The GaussDB has a SQL injection vulnerability. An attacker with low privilege may inject some specific SQL to query or modify database files, causing database service abnormal. Vulnerability ID: HWPSIRT-2017-05017 This vulnerability has been assigned a Common Vulnerabilities and Exposures CVE ID:...

Security Advisory - Two Buffer Overflow Vulnerabilities in the GaussDB

GaussDB has a buffer overflow vulnerability. An authenticated, remote attacker could use a specially crafted string in an SQL query to cause the database to crash, or lead to privilege escalation. Vulnerability ID: HWPSIRT-2017-05016 This vulnerability has been assigned a Common Vulnerabilities a...

Security Advisory - Two Privilege Escalation Vulnerabilities in the GaussDB

There is a privilege escalation vulnerability in the validator functions of the GaussDB. An attacker may log in to the system as a low-privilege user and execute the high-privilege functions. Then, the attacker may obtain the high-privilege of the GaussDB and crash the system. Vulnerability ID:...

Security Advisory - Buffer Overflow Vulnerability in The GaussDB

There is a buffer overflow vulnerability in the handling code for regular expressions on GaussDB. An authenticated, remote attacker could use a specially crafted regular expression to cause GaussDB to crash or possibly execute arbitrary code. Vulnerability ID: HWPSIRT-2017-05046 This vulnerabilit...

Security Advisory - Two Buffer Overflow Vulnerabilities in the GaussDB

There is a buffer overflow vulnerability in the type conversion function of the GaussDB. An attacker logs in to the system as a common user and craft malformed packets, which could be exploited to perform a denial of service attack or possibly remote code execution on the GaussDB. Vulnerability I...

Security Advisory - Command Injection Vulnerability in the GaussDB

The GaussDB has a command injection vulnerability. Due to the lack of input validation on some parameters, an attacker with low privilege may inject some specific command to modify database files, causing database service abnormal. Vulnerability ID: HWPSIRT-2017-05043 This vulnerability has been...

Security Advisory - Authentication Bypass Vulnerability in the Backup Function of GaussDB

The backup function of GaussDB has an authentication bypass vulnerability. An attacker with low privilege may bypass the authentication of the backup function of database to start or stop the backup function, causing the backup function abnormal. Vulnerability ID: HWPSIRT-2017-05044 This...

Security Advisory - Buffer Overflow vulnerability in the GaussDB

The GaussDB has a buffer overflow vulnerability due to the lack of input validation on some parameters. An authenticated attacker on the LAN can exploit this vulnerability to execute arbitrary code or cause a denial of service DoS condition in the affected system. Vulnerability ID:...