Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
ubuntuUbuntuUSN-2499-1
HistoryFeb 11, 2015 - 12:00 a.m.

PostgreSQL vulnerabilities

2015-02-1100:00:00
ubuntu.com
35

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

8.6 High

AI Score

Confidence

Low

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.005 Low

EPSS

Percentile

76.3%

JSON

Releases

  • Ubuntu 14.10
  • Ubuntu 14.04 ESM
  • Ubuntu 12.04
  • Ubuntu 10.04

Packages

  • postgresql-8.4 - Object-relational SQL database
  • postgresql-9.1 - Object-relational SQL database
  • postgresql-9.3 - Object-relational SQL database
  • postgresql-9.4 - Object-relational SQL database

Details

Stephen Frost discovered that PostgreSQL incorrectly displayed certain
values in error messages. An authenticated user could gain access to seeing
certain values, contrary to expected permissions. (CVE-2014-8161)

Andres Freund, Peter Geoghegan and Noah Misch discovered that PostgreSQL
incorrectly handled buffers in to_char functions. An authenticated attacker
could possibly use this issue to cause PostgreSQL to crash, resulting in a
denial of service, or possibly execute arbitrary code. (CVE-2015-0241)

It was discovered that PostgreSQL incorrectly handled memory in the
pgcrypto extension. An authenticated attacker could possibly use this issue
to cause PostgreSQL to crash, resulting in a denial of service, or possibly
execute arbitrary code. (CVE-2015-0243)

Emil Lenngren discovered that PostgreSQL incorrectly handled extended
protocol message reading. An authenticated attacker could possibly use this
issue to cause PostgreSQL to crash, resulting in a denial of service, or
possibly inject query messages. (CVE-2015-0244)

OSVersionArchitecturePackageVersionFilename
Ubuntu14.10noarchpostgresql-9.4< 9.4.1-0ubuntu0.14.10UNKNOWN
Ubuntu14.10noarchlibecpg-compat3< 9.4.1-0ubuntu0.14.10UNKNOWN
Ubuntu14.10noarchlibecpg-dev< 9.4.1-0ubuntu0.14.10UNKNOWN
Ubuntu14.10noarchlibecpg6< 9.4.1-0ubuntu0.14.10UNKNOWN
Ubuntu14.10noarchlibpgtypes3< 9.4.1-0ubuntu0.14.10UNKNOWN
Ubuntu14.10noarchlibpq-dev< 9.4.1-0ubuntu0.14.10UNKNOWN
Ubuntu14.10noarchlibpq5< 9.4.1-0ubuntu0.14.10UNKNOWN
Ubuntu14.10noarchpostgresql-9.4-dbg< 9.4.1-0ubuntu0.14.10UNKNOWN
Ubuntu14.10noarchpostgresql-client-9.4< 9.4.1-0ubuntu0.14.10UNKNOWN
Ubuntu14.10noarchpostgresql-contrib-9.4< 9.4.1-0ubuntu0.14.10UNKNOWN
Rows per page:
1-10 of 581

Related

nessus 26
securityvulns 4
redhat 3
openvas 17
osv 2
oraclelinux 1
debian 2
ibm 1
amazon 3
veracode 4
archlinux 2
centos 1
mageia 1
freebsd 1
gentoo 1
fedora 2
ubuntucve 4
postgresql 4
prion 4
cve 4
huawei 1
nessus
nessus
Mandriva Linux Security Advisory : postgresql (MDVSA-2015:048)
2015-02-13 00:00:00
RHEL 6 : postgresql92-postgresql (RHSA-2015:0856)
2015-04-21 00:00:00
RHEL 6 / 7 : postgresql (RHSA-2015:0750)
2015-03-31 00:00:00
securityvulns
securityvulns
PostgreSQL multiple security vulnerabilities
2015-02-11 00:00:00
[SECURITY] [DSA 3155-1] postgresql-9.1 security update
2015-02-11 00:00:00
APPLE-SA-2015-08-13-2 OS X Yosemite v10.10.5 and Security Update 2015-006
2015-08-17 00:00:00
redhat
redhat
(RHSA-2015:0750) Moderate: postgresql security update
2015-03-30 00:00:00
(RHSA-2015:0856) Moderate: postgresql92-postgresql security update
2015-04-20 00:00:00
(RHSA-2015:0699) Moderate: postgresql92-postgresql security update
2015-03-18 00:00:00
openvas
openvas
Debian Security Advisory DSA 3155-1 (postgresql-9.1 - security update)
2015-02-06 00:00:00
SUSE: Security Advisory (SUSE-SU-2015:0478-1)
2021-04-19 00:00:00
CentOS Update for postgresql CESA-2015:0750 centos6
2015-03-31 00:00:00
osv
osv
postgresql-9.1 - security update
2015-02-06 00:00:00
postgresql-8.4 - new minor release
2015-02-12 00:00:00
oraclelinux
oraclelinux
postgresql security update
2015-03-30 00:00:00
debian
debian
[SECURITY] [DLA-152-1] postgresql-8.4 update
2015-02-12 11:10:32
[SECURITY] [DSA 3155-1] postgresql-9.1 security update
2015-02-06 13:30:32
ibm
ibm
Security Bulletin: PostgreSQL 9.2.8 as used in IBM QRadar SIEM 7.2.4 and IBM QRadar SIEM 7.1 MR2 is vulnerable to allow a remote authenticated attacker to obtain sensitive information. (CVE-2014-8161, CVE-2015-0241, CVE-2015-0243, CVE-2015-0244)
2018-06-16 21:25:51
amazon
amazon
Medium: postgresql8
2015-04-15 21:47:00
Medium: postgresql92
2015-03-13 02:37:00
Medium: postgresql93
2015-02-25 20:34:00
veracode
veracode
Buffer Overflow
2019-05-02 05:12:40
SQL Injection
2019-05-02 05:12:40
Information Disclosure
2019-01-15 09:05:07
archlinux
archlinux
postgresql: multiple issues
2015-02-06 00:00:00
[ASA-202102-31] postgresql: information disclosure
2021-02-20 00:00:00
centos
centos
postgresql security update
2015-03-30 13:25:17
mageia
mageia
Updated postgresql packages fix security vulnerabilities
2015-02-17 21:38:13
freebsd
freebsd
PostgreSQL -- multiple buffer overflows and memory issues
2015-02-05 00:00:00
gentoo
gentoo
PostgreSQL: Multiple vulnerabilities
2015-07-18 00:00:00
fedora
fedora
[SECURITY] Fedora 21 Update: postgresql-9.3.6-1.fc21
2015-02-08 08:58:19
[SECURITY] Fedora 20 Update: postgresql-9.3.6-1.fc20
2015-02-15 02:58:37
ubuntucve
ubuntucve
CVE-2014-8161
2015-02-06 00:00:00
CVE-2015-0243
2015-02-06 00:00:00
CVE-2015-0241
2015-02-06 00:00:00
postgresql
postgresql
Vulnerability in core server (CVE-2014-8161)
2020-01-27 16:15:00
Vulnerability in core server (CVE-2015-0241)
2020-01-27 16:15:00
Vulnerability in contrib module (CVE-2015-0243)
2020-01-27 16:15:00
prion
prion
Code injection
2020-01-27 16:15:00
Buffer overflow
2020-01-27 16:15:00
Buffer overflow
2020-01-27 16:15:00
cve
cve
CVE-2014-8161
2020-01-27 16:15:00
CVE-2015-0243
2020-01-27 16:15:00
CVE-2015-0241
2020-01-27 16:15:00
huawei
huawei
Security Advisory - SQL Injection Vulnerability in the GaussDB
2017-06-07 00:00:00

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

8.6 High

AI Score

Confidence

Low

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.005 Low

EPSS

Percentile

76.3%

JSON
Related for USN-2499-1
nessus26securityvulns4redhat3openvas17osv2oraclelinux1debian2ibm1amazon3veracode4archlinux2centos1mageia1freebsd1gentoo1fedora2ubuntucve4postgresql4prion4cve4huawei1