CVE search results

1 – 10 of 14 results

Detailed view

Sort by:

CVE-2018-1115

Low priority

Some fixes available 1 of 2

postgresql before versions 10.4, 9.6.9 is vulnerable in the adminpack extension, the pg_catalog.pg_logfile_rotate() function doesn’t follow the same ACLs than pg_rorate_logfile. If the adminpack is added to a database, an attacker...

5 affected packages

postgresql-10, postgresql-9.1, postgresql-9.3, postgresql-9.5, postgresql-9.6

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS
postgresql-10	—	—	—	Fixed
postgresql-9.1	—	—	—	Not in release
postgresql-9.3	—	—	—	Not in release
postgresql-9.5	—	—	—	Not in release
postgresql-9.6	—	—	—	Not in release

CVE-2018-1058

Medium priority

Fixed

A flaw was found in the way Postgresql allowed a user to modify the behavior of a query for other users. An attacker with a user account could use this flaw to execute code with the permissions of superuser in the database....

5 affected packages

postgresql-10, postgresql-9.1, postgresql-9.3, postgresql-9.5, postgresql-9.6

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS
postgresql-10	—	—	—	Fixed
postgresql-9.1	—	—	—	Not in release
postgresql-9.3	—	—	—	Not in release
postgresql-9.5	—	—	—	Not in release
postgresql-9.6	—	—	—	Not in release

CVE-2018-1053

Low priority

Fixed

In postgresql 9.3.x before 9.3.21, 9.4.x before 9.4.16, 9.5.x before 9.5.11, 9.6.x before 9.6.7 and 10.x before 10.2, pg_upgrade creates file in current working directory containing the output of `pg_dumpall -g` under umask which...

6 affected packages

postgresql-10, postgresql-9.1, postgresql-9.3, postgresql-9.4, postgresql-9.5, postgresql-9.6

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS
postgresql-10	—	—	—	Not affected
postgresql-9.1	—	—	—	Not in release
postgresql-9.3	—	—	—	Not in release
postgresql-9.4	—	—	—	Not in release
postgresql-9.5	—	—	—	Not in release
postgresql-9.6	—	—	—	Not in release

CVE-2018-1052

Medium priority

Not affected

Memory disclosure vulnerability in table partitioning was found in postgresql 10.x before 10.2, allowing an authenticated attacker to read arbitrary bytes of server memory via purpose-crafted insert to a partitioned table.

4 affected packages

postgresql-10, postgresql-9.1, postgresql-9.4, postgresql-9.6

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS
postgresql-10	—	—	—	—
postgresql-9.1	—	—	—	—
postgresql-9.4	—	—	—	—
postgresql-9.6	—	—	—	—

CVE-2017-7548

Medium priority

Fixed

PostgreSQL versions before 9.4.13, 9.5.8 and 9.6.4 are vulnerable to authorization flaw allowing remote authenticated attackers with no privileges on a large object to overwrite the entire contents of the object, resulting in a...

5 affected packages

postgresql-10, postgresql-9.1, postgresql-9.3, postgresql-9.5, postgresql-9.6

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS
postgresql-10	—	—	—	Not affected
postgresql-9.1	—	—	—	Not in release
postgresql-9.3	—	—	—	Not in release
postgresql-9.5	—	—	—	Not in release
postgresql-9.6	—	—	—	Not in release

CVE-2017-7547

Medium priority

Fixed

PostgreSQL versions before 9.2.22, 9.3.18, 9.4.13, 9.5.8 and 9.6.4 are vulnerable to authorization flaw allowing remote authenticated attackers to retrieve passwords from the user mappings defined by the foreign server owners...

5 affected packages

postgresql-10, postgresql-9.5, postgresql-9.1, postgresql-9.3, postgresql-9.6

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS
postgresql-10	—	—	—	Not affected
postgresql-9.5	—	—	—	Not in release
postgresql-9.1	—	—	—	Not in release
postgresql-9.3	—	—	—	Not in release
postgresql-9.6	—	—	—	Not in release

CVE-2017-7546

Low priority

Fixed

PostgreSQL versions before 9.2.22, 9.3.18, 9.4.13, 9.5.8 and 9.6.4 are vulnerable to incorrect authentication flaw allowing remote attackers to gain access to database accounts with an empty password.

5 affected packages

postgresql-10, postgresql-9.1, postgresql-9.3, postgresql-9.5, postgresql-9.6

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS
postgresql-10	—	—	—	Not affected
postgresql-9.1	—	—	—	Not in release
postgresql-9.3	—	—	—	Not in release
postgresql-9.5	—	—	—	Not in release
postgresql-9.6	—	—	—	Not in release

CVE-2017-7486

Low priority

Some fixes available 3 of 4

PostgreSQL versions 8.4 - 9.6 are vulnerable to information leak in pg_user_mappings view which discloses foreign server passwords to any user having USAGE privilege on the associated foreign server.

4 affected packages

postgresql-9.1, postgresql-9.3, postgresql-9.5, postgresql-9.6

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS
postgresql-9.1	—	—	—	—
postgresql-9.3	—	—	—	—
postgresql-9.5	—	—	—	—
postgresql-9.6	—	—	—	—

CVE-2017-7485

Low priority

Some fixes available 3 of 4

In PostgreSQL 9.3.x before 9.3.17, 9.4.x before 9.4.12, 9.5.x before 9.5.7, and 9.6.x before 9.6.3, it was found that the PGREQUIRESSL environment variable was no longer enforcing a SSL/TLS connection to a PostgreSQL server. An...

4 affected packages

postgresql-9.1, postgresql-9.3, postgresql-9.5, postgresql-9.6

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS
postgresql-9.1	—	—	—	—
postgresql-9.3	—	—	—	—
postgresql-9.5	—	—	—	—
postgresql-9.6	—	—	—	—

CVE-2017-7484

Low priority

Some fixes available 3 of 4

It was found that some selectivity estimation functions in PostgreSQL before 9.2.21, 9.3.x before 9.3.17, 9.4.x before 9.4.12, 9.5.x before 9.5.7, and 9.6.x before 9.6.3 did not check user privileges before providing information...

5 affected packages

postgresql-9.1, postgresql-9.3, postgresql-10, postgresql-9.5, postgresql-9.6

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS
postgresql-9.1	—	—	—	Not in release
postgresql-9.3	—	—	—	Not in release
postgresql-10	—	—	—	Not affected
postgresql-9.5	—	—	—	Not in release
postgresql-9.6	—	—	—	Not in release

Export to JSON

Results by page:

Search CVE reports