PostgreSQL vulnerabilities

2007-02-0600:00:00

ubuntu.com

8.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:C/I:N/A:C

6.5 Medium

AI Score

Confidence

Low

0.013 Low

EPSS

Percentile

85.7%

JSON

Releases

Ubuntu 6.10
Ubuntu 6.06
Ubuntu 5.10

Details

Jeff Trout discovered that the PostgreSQL server did not sufficiently
check data types of SQL function arguments in some cases. An
authenticated attacker could exploit this to crash the database server
or read out arbitrary locations in the server’s memory, which could
allow retrieving database content the attacker should not be able to
see. (CVE-2007-0555)

Jeff Trout reported that the query planner did not verify that a table
was still compatible with a previously made query plan. By using ALTER
COLUMN TYPE during query execution, an attacker could exploit this to
read out arbitrary locations in the server’s memory, which could allow
retrieving database content the attacker should not be able to see.
(CVE-2007-0556)

OSVersionArchitecturePackageVersionFilename
Ubuntu6.10noarchpostgresql-8.1< 8.1.4-7ubuntu0.2UNKNOWN
Ubuntu6.06noarchpostgresql-8.1< 8.1.4-0ubuntu1.2UNKNOWN
Ubuntu5.10noarchpostgresql-7.4< 1:7.4.8-17ubuntu1.4UNKNOWN
Ubuntu5.10noarchpostgresql-8.0< 8.0.3-15ubuntu2.3UNKNOWN

OS	Version	Architecture	Package	Version	Filename
Ubuntu	6.10	noarch	postgresql-8.1	< 8.1.4-7ubuntu0.2	UNKNOWN
Ubuntu	6.06	noarch	postgresql-8.1	< 8.1.4-0ubuntu1.2	UNKNOWN
Ubuntu	5.10	noarch	postgresql-7.4	< 1:7.4.8-17ubuntu1.4	UNKNOWN
Ubuntu	5.10	noarch	postgresql-8.0	< 8.0.3-15ubuntu2.3	UNKNOWN