PT-2026-32458

A flaw was found in postgresql. Using an INSERT ... ON CONFLICT ... DO UPDATE command on a purpose-crafted table, an authenticated database user could read arbitrary bytes of server memory. The highest threat from this vulnerability is to data confidentiality...

CVE-2018-10925: Incorrect Authorization

It was discovered that PostgreSQL versions before 10.5, 9.6.10, 9.5.14, 9.4.19, and 9.3.24 failed to properly check authorization on certain statements involved with "INSERT ... ON CONFLICT DO UPDATE". An attacker with "CREATE TABLE" privileges could exploit this to read arbitrary bytes server...

CVE-2017-15099: Exposure of Sensitive Information to an Unauthorized Actor

INSERT ... ON CONFLICT DO UPDATE commands in PostgreSQL 10.x before 10.1, 9.6.x before 9.6.6, and 9.5.x before 9.5.10 disclose table contents that the invoker lacks privilege to read. These exploits affect only tables where the attacker lacks full read access but has both INSERT and UPDATE...

Debian DSA-4028-1 : postgresql-9.6 - security update

Several vulnerabilities have been found in the PostgreSQL database system : - CVE-2017-15098 Denial of service and potential memory disclosure in the jsonpopulaterecordset and jsonbpopulaterecordset functions - CVE-2017-15099 Insufficient permissions checks in 'INSERT ... ON CONFLICT DO UPDATE'...