Red Hat Security Advisory

RHSA-2014:0221

postgresql92-postgresql security update

Released 2014-02-27 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Software Collections 1 for Red Hat Enterprise Linux Server (v. 6) postgresql92-postgresql-9.2.7-1.1.el6, postgresql92-postgresql-contrib-9.2.7-1.1.el6, postgresql92-postgresql-devel-9.2.7-1.1.el6 +8
Red Hat Software Collections 1 for Red Hat Enterprise Linux Workstation (v. 6) postgresql92-postgresql-9.2.7-1.1.el6, postgresql92-postgresql-contrib-9.2.7-1.1.el6, postgresql92-postgresql-devel-9.2.7-1.1.el6 +8

Fixes 8 records

TI-2014-00059 CVE-2014-0063 · GHSA-6xcv-h2c9-qr78

Multiple stack-based buffer overflows in PostgreSQL before 8.4.20, 9.0.x before 9.0.16…

LOW 38

Multiple stack-based buffer overflows in PostgreSQL before 8.4.20, 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 allow remote authenticated users to cause a denial of service (crash…

CVSS 2.0MEDIUM 6.5 Network Low privileges Interaction — EPSS 0.06666 Published 2014-03-28 Partial fix CWE-119

TI-2014-00061 CVE-2014-0065 · GHSA-3g6c-x989-62xg

Multiple buffer overflows in PostgreSQL before 8.4.20, 9.0.x before 9.0.16, 9.1.x before…

LOW 37

Multiple buffer overflows in PostgreSQL before 8.4.20, 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 allow remote authenticated users to have unspecified impact and attack vectors,…

CVSS 2.0MEDIUM 6.5 Network Low privileges Interaction — EPSS 0.05046 Published 2014-03-28 Partial fix CWE-119

TI-2014-00060 CVE-2014-0064 · GHSA-qp79-hqwr-wfrw

Multiple integer overflows in the path_in and other unspecified functions in PostgreSQL…

LOW 37

Multiple integer overflows in the path_in and other unspecified functions in PostgreSQL before 8.4.20, 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 allow remote authenticated users…

CVSS 2.0MEDIUM 6.5 Network Low privileges Interaction — EPSS 0.05353 Published 2014-03-28 Partial fix CWE-189

TI-2014-00057 CVE-2014-0061 · GHSA-vmvq-ph3r-696r

The validator functions for the procedural languages (PLs) in PostgreSQL before 8.4.20…

LOW 37

The validator functions for the procedural languages (PLs) in PostgreSQL before 8.4.20, 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 allow remote authenticated users to gain privil…

CVSS 2.0MEDIUM 6.5 Network Low privileges Interaction — EPSS 0.0493 Published 2014-03-28 Partial fix CWE-264

TI-2014-02146 CVE-2014-2669 · GHSA-mjx6-524j-mf72

Multiple integer overflows in contrib/hstore/hstore_io.c in PostgreSQL 9.0.x before…

LOW 35

Multiple integer overflows in contrib/hstore/hstore_io.c in PostgreSQL 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 allow remote authenticated users to have unspecified impact via…

CVSS 2.0MEDIUM 6.5 Network Low privileges Interaction — EPSS 0.03503 Published 2014-03-28 Partial fix CWE-189

TI-2014-00058 CVE-2014-0062 · GHSA-v5fw-6c5r-3rm6

Race condition in the (1) CREATE INDEX and (2) unspecified ALTER TABLE commands in…

LOW 28

Race condition in the (1) CREATE INDEX and (2) unspecified ALTER TABLE commands in PostgreSQL before 8.4.20, 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 allows remote authenticate…

CVSS 2.0MEDIUM 4.9 Network Low privileges Interaction — EPSS 0.03043 Published 2014-03-28 Partial fix CWE-362

TI-2014-00062 CVE-2014-0066 · GHSA-jx7w-rgrh-vh3q

The chkpass extension in PostgreSQL before 8.4.20, 9.0.x before 9.0.16, 9.1.x before…

LOW 26

The chkpass extension in PostgreSQL before 8.4.20, 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 does not properly check the return value of the crypt library function, which allows…

CVSS 2.0MEDIUM 4.0 Network Low privileges Interaction — EPSS 0.04682 Published 2014-03-28 Partial fix CWE-20

TI-2014-00056 CVE-2014-0060 · GHSA-w7xc-5vvv-rvqf

PostgreSQL before 8.4.20, 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7…

LOW 26

PostgreSQL before 8.4.20, 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 does not properly enforce the ADMIN OPTION restriction, which allows remote authenticated members of a role t…

CVSS 2.0MEDIUM 4.0 Network Low privileges Interaction — EPSS 0.04124 Published 2014-03-28 Partial fix CWE-264