Search CVE reports


Toggle filters

1 – 10 of 14 results


CVE-2018-1115

Low priority

Some fixes available 1 of 2

postgresql before versions 10.4, 9.6.9 is vulnerable in the adminpack extension, the pg_catalog.pg_logfile_rotate() function doesn't follow the same ACLs than pg_rorate_logfile. If the adminpack is added to a database, an attacker...

5 affected packages

postgresql-10, postgresql-9.1, postgresql-9.3, postgresql-9.5, postgresql-9.6

Package 24.04 LTS 22.04 LTS 20.04 LTS 18.04 LTS 16.04 LTS
postgresql-10 Fixed Not in release
postgresql-9.1 Not in release Not in release
postgresql-9.3 Not in release Not in release
postgresql-9.5 Not in release Not affected
postgresql-9.6 Not in release Not in release
Show less packages

CVE-2017-14798

Medium priority
Not affected

A race condition in the postgresql init script could be used by attackers able to access the postgresql account to escalate their privileges to root.

5 affected packages

postgresql-10, postgresql-9.1, postgresql-9.3, postgresql-9.5, postgresql-9.6

Package 24.04 LTS 22.04 LTS 20.04 LTS 18.04 LTS 16.04 LTS
postgresql-10 Not in release
postgresql-9.1 Not in release
postgresql-9.3 Not in release
postgresql-9.5 Not affected
postgresql-9.6 Not in release
Show less packages

CVE-2018-1058

Medium priority
Fixed

A flaw was found in the way Postgresql allowed a user to modify the behavior of a query for other users. An attacker with a user account could use this flaw to execute code with the permissions of superuser in the database....

5 affected packages

postgresql-10, postgresql-9.1, postgresql-9.3, postgresql-9.5, postgresql-9.6

Package 24.04 LTS 22.04 LTS 20.04 LTS 18.04 LTS 16.04 LTS
postgresql-10 Fixed Not in release
postgresql-9.1 Not in release Not in release
postgresql-9.3 Not in release Not in release
postgresql-9.5 Not in release Fixed
postgresql-9.6 Not in release Not in release
Show less packages

CVE-2018-1052

Medium priority
Not affected

Memory disclosure vulnerability in table partitioning was found in postgresql 10.x before 10.2, allowing an authenticated attacker to read arbitrary bytes of server memory via purpose-crafted insert to a partitioned table.

4 affected packages

postgresql-10, postgresql-9.1, postgresql-9.4, postgresql-9.6

Package 24.04 LTS 22.04 LTS 20.04 LTS 18.04 LTS 16.04 LTS
postgresql-10 Not in release
postgresql-9.1 Not in release
postgresql-9.4 Not in release
postgresql-9.6 Not in release
Show less packages

CVE-2018-1053

Low priority
Fixed

In postgresql 9.3.x before 9.3.21, 9.4.x before 9.4.16, 9.5.x before 9.5.11, 9.6.x before 9.6.7 and 10.x before 10.2, pg_upgrade creates file in current working directory containing the output of `pg_dumpall -g` under umask which...

6 affected packages

postgresql-10, postgresql-9.1, postgresql-9.3, postgresql-9.4, postgresql-9.5, postgresql-9.6

Package 24.04 LTS 22.04 LTS 20.04 LTS 18.04 LTS 16.04 LTS
postgresql-10 Not affected Not in release
postgresql-9.1 Not in release Not in release
postgresql-9.3 Not in release Not in release
postgresql-9.4 Not in release Not in release
postgresql-9.5 Not in release Fixed
postgresql-9.6 Not in release Not in release
Show less packages

CVE-2017-12172

Negligible priority
Not affected

PostgreSQL 10.x before 10.1, 9.6.x before 9.6.6, 9.5.x before 9.5.10, 9.4.x before 9.4.15, 9.3.x before 9.3.20, and 9.2.x before 9.2.24 runs under a non-root operating system account, and database superusers have effective ability...

4 affected packages

postgresql-9.1, postgresql-9.3, postgresql-9.5, postgresql-9.6

Package 24.04 LTS 22.04 LTS 20.04 LTS 18.04 LTS 16.04 LTS
postgresql-9.1 Not in release
postgresql-9.3 Not in release
postgresql-9.5 Not affected
postgresql-9.6 Not in release
Show less packages

CVE-2017-15099

Medium priority
Fixed

INSERT ... ON CONFLICT DO UPDATE commands in PostgreSQL 10.x before 10.1, 9.6.x before 9.6.6, and 9.5.x before 9.5.10 disclose table contents that the invoker lacks privilege to read. These exploits affect only tables where the...

5 affected packages

postgresql-10, postgresql-9.1, postgresql-9.3, postgresql-9.5, postgresql-9.6

Package 24.04 LTS 22.04 LTS 20.04 LTS 18.04 LTS 16.04 LTS
postgresql-10 Not in release
postgresql-9.1 Not in release
postgresql-9.3 Not in release
postgresql-9.5 Fixed
postgresql-9.6 Not in release
Show less packages

CVE-2017-15098

Medium priority
Fixed

Invalid json_populate_recordset or jsonb_populate_recordset function calls in PostgreSQL 10.x before 10.1, 9.6.x before 9.6.6, 9.5.x before 9.5.10, 9.4.x before 9.4.15, and 9.3.x before 9.3.20 can crash the server or disclose a...

5 affected packages

postgresql-10, postgresql-9.1, postgresql-9.3, postgresql-9.5, postgresql-9.6

Package 24.04 LTS 22.04 LTS 20.04 LTS 18.04 LTS 16.04 LTS
postgresql-10 Not affected Not in release
postgresql-9.1 Not in release Not in release
postgresql-9.3 Not in release Not in release
postgresql-9.5 Not in release Fixed
postgresql-9.6 Not in release Not in release
Show less packages

CVE-2017-7548

Medium priority
Fixed

PostgreSQL versions before 9.4.13, 9.5.8 and 9.6.4 are vulnerable to authorization flaw allowing remote authenticated attackers with no privileges on a large object to overwrite the entire contents of the object, resulting in a...

5 affected packages

postgresql-10, postgresql-9.1, postgresql-9.3, postgresql-9.5, postgresql-9.6

Package 24.04 LTS 22.04 LTS 20.04 LTS 18.04 LTS 16.04 LTS
postgresql-10 Not affected Not in release
postgresql-9.1 Not in release Not in release
postgresql-9.3 Not in release Not in release
postgresql-9.5 Not in release Fixed
postgresql-9.6 Not in release Not in release
Show less packages

CVE-2017-7547

Medium priority
Fixed

PostgreSQL versions before 9.2.22, 9.3.18, 9.4.13, 9.5.8 and 9.6.4 are vulnerable to authorization flaw allowing remote authenticated attackers to retrieve passwords from the user mappings defined by the foreign server owners...

5 affected packages

postgresql-10, postgresql-9.1, postgresql-9.3, postgresql-9.5, postgresql-9.6

Package 24.04 LTS 22.04 LTS 20.04 LTS 18.04 LTS 16.04 LTS
postgresql-10 Not affected Not in release
postgresql-9.1 Not in release Not in release
postgresql-9.3 Not in release Not in release
postgresql-9.5 Not in release Fixed
postgresql-9.6 Not in release Not in release
Show less packages