370 matches found
PostgreSQL -- SQL injection in pg_upgrade and pg_dump
The PostgreSQL project reports: CVE-2018-16850: SQL injection in pgupgrade and pgdump, via CREATE TRIGGER ... REFERENCING. Using a purpose-crafted trigger definition, an attacker can run arbitrary SQL statements with superuser privileges when a superuser runs pgupgrade on the database or during a...
Kcapifony gem for Ruby places database user passwords on the command line
lib/ksymfony1.rb in the kcapifony gem 2.1.6 for Ruby places database user passwords on the 1 mysqldump, 2 pgdump, 3 mysql, and 4 psql command lines, which allows local users to obtain sensitive information by listing the processes...
SUSE SLED12 / SLES12 Security Update : postgresql94 (SUSE-SU-2018:0876-1)
This update for postgresql94 fixes the following issues: Security issues fixed : - CVE-2018-1058: Fixed uncontrolled search path element in pgdump and other client applications bsc1081925. Bug fixes : - See release notes for details : - https://www.postgresql.org/docs/9.4/static/release-9-4-17.ht...
Medium: postgresql93, postgresql94, postgresql95, postgresql96
Issue Overview: Uncontrolled search path element in pgdump and other client applications A flaw was found in the way Postgresql allowed a user to modify the behavior of a query for other users. An attacker with a user account could use this flaw to execute code with the permissions of superuser i...
Vulnerability in client (CVE-2018-1058)
Uncontrolled search path element in pgdump and other client applications...
PostgreSQL vulnerabilities
The PostgreSQL project reports: CVE-2018-1058: Uncontrolled search path element in pgdump and other client applications...
CVE-2014-5001
lib/ksymfony1.rb in the kcapifony gem 2.1.6 for Ruby places database user passwords on the 1 mysqldump, 2 pgdump, 3 mysql, and 4 psql command lines, which allows local users to obtain sensitive information by listing the processes...
SUSE SLED11 / SLES11 Security Update : postgresql94 (SUSE-SU-2016:0677-1)
This update for postgresql94 fixes the following issues : - Security and bugfix release 9.4.6 : - IMPORTANT Users of version 9.4 will need to reindex any jsonbpathops indexes they have created, in order to fix a persistent issue with missing index entries. - Fix infinite loops and buffer-overrun...
openSUSE Security Update : postgresql94 (openSUSE-2016-271)
This update for postgresql94 fixes the following issues : - Security and bugfix release 9.4.6 : - IMPORTANT Users of version 9.4 will need to reindex any jsonbpathops indexes they have created, in order to fix a persistent issue with missing index entries. - Fix infinite loops and buffer-overrun...
Security update for postgresql94 (important)
This update for postgresql94 fixes the following issues: - Security and bugfix release 9.4.6: IMPORTANT Users of version 9.4 will need to reindex any jsonbpathops indexes they have created, in order to fix a persistent issue with missing index entries. Fix infinite loops and buffer-overrun proble...
openSUSE Security Update : postgresql93 (openSUSE-2016-253)
This update for postgresql93 fixes the following issues : - Security and bugfix release 9.3.11 : - Fix infinite loops and buffer-overrun problems in regular expressions CVE-2016-0773, boo966436. - Fix regular-expression compiler to handle loops of constraint arcs CVE-2007-4772. - Prevent certain...
SUSE SLED12 / SLES12 Security Update : postgresql93 (SUSE-SU-2016:0539-1)
This update for postgresql93 fixes the following issues : - Security and bugfix release 9.3.11 : - Fix infinite loops and buffer-overrun problems in regular expressions CVE-2016-0773, bsc966436. - Fix regular-expression compiler to handle loops of constraint arcs CVE-2007-4772. - Prevent certain...
Security update for postgresql93 (important)
This update for postgresql93 fixes the following issues: - Security and bugfix release 9.3.11: Fix infinite loops and buffer-overrun problems in regular expressions CVE-2016-0773, boo966436. Fix regular-expression compiler to handle loops of constraint arcs CVE-2007-4772. Prevent certain PL/Java...
openSUSE Security Update : postgresql (openSUSE-SU-2012:1173-1)
Postgresql was updated to the security and bugfix release 9.1.3 : - Require execute permission on the trigger function for 'CREATE TRIGGER' CVE-2012-0866, bnc749299. - Remove arbitrary limitation on length of common name in SSL certificates CVE-2012-0867, bnc749301. - Convert newlines to spaces i...
CentOS Update for postgresql84 CESA-2012:0678 centos5
Check for the Version of postgresql84 OpenVAS Vulnerability Test CentOS Update for postgresql84 CESA-2012:0678 centos5 Authors: System Generated Check Copyright: Copyright c 2012 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify...
CVE-2012-0868
CRLF injection vulnerability in pgdump in PostgreSQL 8.3.x before 8.3.18, 8.4.x before 8.4.11, 9.0.x before 9.0.7, and 9.1.x before 9.1.3 allows user-assisted remote attackers to execute arbitrary SQL commands via a crafted file containing object names with newlines, which are inserted into an SQ...
Vulnerability in core server (CVE-2012-0868)
Line breaks in object names can be exploited to execute arbitrary SQL when reloading a pgdump file...
CVE-2012-0868
CVE-2012-0868 describes a CRLF injection in pg_dump for PostgreSQL. Vulnerable are PostgreSQL branches 8.3.x < 8.3.18, 8.4.x < 8.4.11, 9.0.x < 9.0.7, and 9.1.x
CVE-2012-0868: Improper Neutralization of Special Elements used in an SQL Command
CRLF injection vulnerability in pgdump in PostgreSQL 8.3.x before 8.3.18, 8.4.x before 8.4.11, 9.0.x before 9.0.7, and 9.1.x before 9.1.3 allows user-assisted remote attackers to execute arbitrary SQL commands via a crafted file containing object names with newlines, which are inserted into an SQ...
Medium: postgresql8
Issue Overview: The pgdump utility inserted object names literally into comments in the SQL script it produces. An unprivileged database user could create an object whose name includes a newline followed by an SQL command. This SQL command might then be executed by a privileged user during later...