Red Hat Security Advisory

RHSA-2010:0429

postgresql security update

Released 2010-05-19 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Enterprise Linux (v. 5 server) postgresql-8.1.21-1.el5_5.1, postgresql-8.1.21-1.el5_5.1.i386, postgresql-8.1.21-1.el5_5.1.ia64 +37
Red Hat Enterprise Linux Desktop (v. 5 client) postgresql-8.1.21-1.el5_5.1, postgresql-8.1.21-1.el5_5.1.i386, postgresql-contrib-8.1.21-1.el5_5.1 +13
Red Hat Enterprise Linux Desktop Workstation (v. 5 client) postgresql-8.1.21-1.el5_5.1, postgresql-devel-8.1.21-1.el5_5.1, postgresql-devel-8.1.21-1.el5_5.1.i386 +6

Fixes 6 records

TI-2010-01125 CVE-2010-1169 · GHSA-cjg9-jpjg-2p4r

PostgreSQL 7.4 before 7.4.29, 8.0 before 8.0.25, 8.1 before 8.1.21, 8.2 before 8.2.17…

MEDIUM 44

PostgreSQL 7.4 before 7.4.29, 8.0 before 8.0.25, 8.1 before 8.1.21, 8.2 before 8.2.17, 8.3 before 8.3.11, 8.4 before 8.4.4, and 9.0 Beta before 9.0 Beta 2 does not properly restrict PL/perl procedures, which allows remot…

CVSS 2.0HIGH 8.5 Network Low privileges Interaction — EPSS 0.04081 Published 2010-05-19 Partial fix CWE-94

TI-2010-00420 CVE-2010-0442 · GHSA-gv9m-x3m7-x4g8

The bitsubstr function in backend/utils/adt/varbit.c in PostgreSQL 8.0.23, 8.1.11, and…

MEDIUM 43

The bitsubstr function in backend/utils/adt/varbit.c in PostgreSQL 8.0.23, 8.1.11, and 8.3.8 allows remote authenticated users to cause a denial of service (daemon crash) or have unspecified other impact via vectors invo…

CVSS 2.0MEDIUM 6.5 Network Low privileges Interaction — EPSS 0.13255 Published 2010-02-02 Fixed CWE-189

TI-2009-03921 CVE-2009-4136 · GHSA-p8jm-5754-gqxq

PostgreSQL 7.4.x before 7.4.27, 8.0.x before 8.0.23, 8.1.x before 8.1.19, 8.2.x before…

LOW 35

PostgreSQL 7.4.x before 7.4.27, 8.0.x before 8.0.23, 8.1.x before 8.1.19, 8.2.x before 8.2.15, 8.3.x before 8.3.9, and 8.4.x before 8.4.2 does not properly manage session-local state during execution of an index function…

CVSS 2.0MEDIUM 6.5 Network Low privileges Interaction — EPSS 0.03644 Published 2009-12-15 Fixed

TI-2010-01126 CVE-2010-1170 · GHSA-8gjp-4m59-38hv

The PL/Tcl implementation in PostgreSQL 7.4 before 7.4.29, 8.0 before 8.0.25, 8.1 before…

LOW 32

The PL/Tcl implementation in PostgreSQL 7.4 before 7.4.29, 8.0 before 8.0.25, 8.1 before 8.1.21, 8.2 before 8.2.17, 8.3 before 8.3.11, 8.4 before 8.4.4, and 9.0 Beta before 9.0 Beta 2 loads Tcl code from the pltcl_module…

CVSS 2.0MEDIUM 6.0 Network Low privileges Interaction — EPSS 0.02888 Published 2010-05-19 Partial fix CWE-264

TI-2010-01891 CVE-2010-1975 · GHSA-q6wf-wh6m-ch8f

PostgreSQL 7.4 before 7.4.29, 8.0 before 8.0.25, 8.1 before 8.1.21, 8.2 before 8.2.17…

LOW 30

PostgreSQL 7.4 before 7.4.29, 8.0 before 8.0.25, 8.1 before 8.1.21, 8.2 before 8.2.17, 8.3 before 8.3.11, and 8.4 before 8.4.4 does not properly check privileges during certain RESET ALL operations, which allows remote a…

CVSS 2.0MEDIUM 5.5 Network Low privileges Interaction — EPSS 0.02658 Published 2010-05-19 Fixed CWE-264

TI-2010-00701 CVE-2010-0733 · GHSA-qxf5-r3fp-g7w9

Integer overflow in src/backend/executor/nodeHash.c in PostgreSQL 8.4.1 and earlier, and…

LOW 27

Integer overflow in src/backend/executor/nodeHash.c in PostgreSQL 8.4.1 and earlier, and 8.5 through 8.5alpha2, allows remote authenticated users to cause a denial of service (daemon crash) via a SELECT statement with ma…

CVSS 2.0LOW 3.5 Network Low privileges Interaction — EPSS 0.06846 Published 2010-03-19 Fixed CWE-189