Ubuntu 8.04 LTS / 10.04 LTS / 10.10 / 11.04 / 11.10 : postgresql-8.3, postgresql-8.4, postgresql-9.1 vulnerabilities (USN-1378-1)

It was discovered that PostgreSQL incorrectly checked permissions on functions called by a trigger. An attacker could attach a trigger to a table they owned and possibly escalate privileges. CVE-2012-0866 It was discovered that PostgreSQL incorrectly truncated SSL certificate name checks to 32...

PostgreSQL 8.x/9.x 存在多个安全漏洞

CVE-2012-0866 CVE-2012-0867 CVE-2012-0868 PostgreSQL是一款对象关系型数据库管理系统，支持扩展的SQL标准子集 PostgreSQL存在多个安全漏洞，允许恶意用户绕过部分安全限制，进行伪造攻击或操作某些数据 -在触发函数上没有对CREATE TRIGGER进行正确的权限检查，可利用此漏洞标记触发函数为SECURITY DEFINER，可授权EXECUTE权限 -在校验SSL证书的公用名时不正确把名称截断为32个字符，可导致不正确校验伪造证书...

USN-1378-1: PostgreSQL vulnerabilities

It was discovered that PostgreSQL incorrectly checked permissions on functions called by a trigger. An attacker could attach a trigger to a table they owned and possibly escalate privileges. CVE-2012-0866 It was discovered that PostgreSQL incorrectly truncated SSL certificate name checks to 32...

Debian DSA-2418-1 : postgresql-8.4 - several vulnerabilities

Several local vulnerabilities have been discovered in PostgreSQL, an object-relational SQL database. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2012-0866 It was discovered that the permissions of a function called by a trigger are not checked. This...

[SECURITY] [DSA 2418-1] postgresql-8.4 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-2418-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff February 27, 2012 http://www.debian.org/security/faq -...

databases/postgresql*-client -- multiple vulnerabilities

The PostgreSQL Global Development Group reports: These vulnerabilities could allow users to define triggers that execute functions on which the user does not have EXECUTE permission, allow SSL certificate spoofing and allow line breaks in object names to be exploited to execute code when loading ...