USN-6656-2: PostgreSQL vulnerability
12 March 2024
PostgreSQL could be made to run arbitrary SQL.
Releases
Packages
- postgresql-9.5 - Object-relational SQL database
Details
USN-6656-1 fixed several vulnerabilities in PostgreSQL. This update provides
the corresponding updates for Ubuntu 16.04 LTS
Original advisory details:
It was discovered that PostgreSQL incorrectly handled dropping privileges
when handling REFRESH MATERIALIZED VIEW CONCURRENTLY commands. If a user or
automatic system were tricked into running a specially crafted command, a
remote attacker could possibly use this issue to execute arbitrary SQL
functions.
Update instructions
The problem can be corrected by updating your system to the following package versions:
Ubuntu 16.04
-
postgresql-9.5
-
9.5.25-0ubuntu0.16.04.1+esm7
Available with Ubuntu Pro
-
postgresql-client-9.5
-
9.5.25-0ubuntu0.16.04.1+esm7
Available with Ubuntu Pro
After a standard system update you need to restart PostgreSQL to make all
the necessary changes.