Red Hat Security Advisory

RHSA-2015:0750

postgresql security update

Released 2015-03-30 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Enterprise Linux Client Optional (v. 7) postgresql-9.2.10-2.el7_1, postgresql-contrib-9.2.10-2.el7_1, postgresql-devel-9.2.10-2.el7_1 +8
Red Hat Enterprise Linux ComputeNode (v. 7) postgresql-9.2.10-2.el7_1, postgresql-libs-9.2.10-2.el7_1
Red Hat Enterprise Linux ComputeNode Optional (v. 7) postgresql-9.2.10-2.el7_1, postgresql-contrib-9.2.10-2.el7_1, postgresql-devel-9.2.10-2.el7_1 +7
Red Hat Enterprise Linux Desktop (v. 6) postgresql-8.4.20-2.el6_6, postgresql-libs-8.4.20-2.el6_6
Red Hat Enterprise Linux Desktop Optional (v. 6) postgresql-8.4.20-2.el6_6, postgresql-contrib-8.4.20-2.el6_6, postgresql-devel-8.4.20-2.el6_6 +6
Red Hat Enterprise Linux HPC Node (v. 6) postgresql-8.4.20-2.el6_6, postgresql-libs-8.4.20-2.el6_6
Red Hat Enterprise Linux HPC Node Optional (v. 6) postgresql-contrib-8.4.20-2.el6_6, postgresql-devel-8.4.20-2.el6_6, postgresql-docs-8.4.20-2.el6_6 +5
Red Hat Enterprise Linux Server (v. 6) postgresql-8.4.20-2.el6_6, postgresql-8.4.20-2.el6_6.ppc, postgresql-contrib-8.4.20-2.el6_6 +10
Red Hat Enterprise Linux Server (v. 7) postgresql-9.2.10-2.ael7b_1, postgresql-9.2.10-2.el7_1, postgresql-9.2.10-2.el7_1.ppc +20
Red Hat Enterprise Linux Server Optional (v. 7) postgresql-upgrade-9.2.10-2.ael7b_1, postgresql-upgrade-9.2.10-2.el7_1
Red Hat Enterprise Linux Workstation (v. 6) postgresql-8.4.20-2.el6_6, postgresql-contrib-8.4.20-2.el6_6, postgresql-devel-8.4.20-2.el6_6 +7
Red Hat Enterprise Linux Workstation (v. 7) postgresql-9.2.10-2.el7_1, postgresql-contrib-9.2.10-2.el7_1, postgresql-devel-9.2.10-2.el7_1 +7
Red Hat Enterprise Linux Workstation Optional (v. 7) postgresql-upgrade-9.2.10-2.el7_1

Fixes 4 records

TI-2015-00214 CVE-2015-0244 · GHSA-xvhg-pwg9-qp4r

SQL injection in PostgreSQL

MEDIUM 49

PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1 does not properly handle errors while reading a protocol message, which allows remote attackers to conduct SQ…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.04363 Published 2020-01-27 Partial fix · 9.0.19, 9.1.15 +3 CWE-89

TI-2015-00213 CVE-2015-0243 · GHSA-4c7q-44j3-76m6

Buffer overflow in PostgreSQL

MEDIUM 46

Multiple buffer overflows in contrib/pgcrypto in PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1 allow remote authenticated users to cause a denial of servic…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.05124 Published 2020-01-27 Partial fix · 9.0.19, 9.1.15 +3 CWE-120

TI-2015-00211 CVE-2015-0241 · GHSA-h47p-j4vf-9qhf

Buffer overflow in PostgreSQL

MEDIUM 46

The to_char function in PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1 allows remote authenticated users to cause a denial of service (crash) or possibly ex…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.05533 Published 2020-01-27 Partial fix · 9.0.19, 9.1.15 +3 CWE-120

TI-2014-06776 CVE-2014-8161 · GHSA-qxj3-8772-4f6w

Information disclosure through error messages in PostgreSQL

LOW 25

PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1 allows remote authenticated users to obtain sensitive column values by triggering constraint violation and th…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.0251 Published 2020-01-27 Partial fix · 9.0.19, 9.1.15 +3 CWE-209