Search CVE reports
51 – 60 of 67 results
A flaw was found in the way Postgresql allowed a user to modify the behavior of a query for other users. An attacker with a user account could use this flaw to execute code with the permissions of superuser in the database....
5 affected packages
postgresql-10, postgresql-9.1, postgresql-9.3, postgresql-9.5, postgresql-9.6
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|
| postgresql-10 | — | — | — | Fixed |
| postgresql-9.1 | — | — | — | Not in release |
| postgresql-9.3 | — | — | — | Not in release |
| postgresql-9.5 | — | — | — | Not in release |
| postgresql-9.6 | — | — | — | Not in release |
In postgresql 9.3.x before 9.3.21, 9.4.x before 9.4.16, 9.5.x before 9.5.11, 9.6.x before 9.6.7 and 10.x before 10.2, pg_upgrade creates file in current working directory containing the output of `pg_dumpall -g` under umask which...
6 affected packages
postgresql-10, postgresql-9.1, postgresql-9.3, postgresql-9.4, postgresql-9.5, postgresql-9.6
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|
| postgresql-10 | — | — | — | Not affected |
| postgresql-9.1 | — | — | — | Not in release |
| postgresql-9.3 | — | — | — | Not in release |
| postgresql-9.4 | — | — | — | Not in release |
| postgresql-9.5 | — | — | — | Not in release |
| postgresql-9.6 | — | — | — | Not in release |
PostgreSQL 10.x before 10.1, 9.6.x before 9.6.6, 9.5.x before 9.5.10, 9.4.x before 9.4.15, 9.3.x before 9.3.20, and 9.2.x before 9.2.24 runs under a non-root operating system account, and database superusers have effective ability...
4 affected packages
postgresql-9.1, postgresql-9.3, postgresql-9.5, postgresql-9.6
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|
| postgresql-9.1 | — | — | — | — |
| postgresql-9.3 | — | — | — | — |
| postgresql-9.5 | — | — | — | — |
| postgresql-9.6 | — | — | — | — |
INSERT ... ON CONFLICT DO UPDATE commands in PostgreSQL 10.x before 10.1, 9.6.x before 9.6.6, and 9.5.x before 9.5.10 disclose table contents that the invoker lacks privilege to read. These exploits affect only tables where the...
5 affected packages
postgresql-9.1, postgresql-10, postgresql-9.3, postgresql-9.5, postgresql-9.6
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|
| postgresql-9.1 | — | — | — | — |
| postgresql-10 | — | — | — | — |
| postgresql-9.3 | — | — | — | — |
| postgresql-9.5 | — | — | — | — |
| postgresql-9.6 | — | — | — | — |
Invalid json_populate_recordset or jsonb_populate_recordset function calls in PostgreSQL 10.x before 10.1, 9.6.x before 9.6.6, 9.5.x before 9.5.10, 9.4.x before 9.4.15, and 9.3.x before 9.3.20 can crash the server or disclose a...
5 affected packages
postgresql-9.3, postgresql-9.5, postgresql-9.6, postgresql-10, postgresql-9.1
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|
| postgresql-9.3 | — | — | — | Not in release |
| postgresql-9.5 | — | — | — | Not in release |
| postgresql-9.6 | — | — | — | Not in release |
| postgresql-10 | — | — | — | Not affected |
| postgresql-9.1 | — | — | — | Not in release |
PostgreSQL versions before 9.4.13, 9.5.8 and 9.6.4 are vulnerable to authorization flaw allowing remote authenticated attackers with no privileges on a large object to overwrite the entire contents of the object, resulting in a...
5 affected packages
postgresql-10, postgresql-9.1, postgresql-9.3, postgresql-9.5, postgresql-9.6
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|
| postgresql-10 | — | — | — | Not affected |
| postgresql-9.1 | — | — | — | Not in release |
| postgresql-9.3 | — | — | — | Not in release |
| postgresql-9.5 | — | — | — | Not in release |
| postgresql-9.6 | — | — | — | Not in release |
PostgreSQL versions before 9.2.22, 9.3.18, 9.4.13, 9.5.8 and 9.6.4 are vulnerable to authorization flaw allowing remote authenticated attackers to retrieve passwords from the user mappings defined by the foreign server owners...
5 affected packages
postgresql-10, postgresql-9.5, postgresql-9.1, postgresql-9.3, postgresql-9.6
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|
| postgresql-10 | — | — | — | Not affected |
| postgresql-9.5 | — | — | — | Not in release |
| postgresql-9.1 | — | — | — | Not in release |
| postgresql-9.3 | — | — | — | Not in release |
| postgresql-9.6 | — | — | — | Not in release |
PostgreSQL versions before 9.2.22, 9.3.18, 9.4.13, 9.5.8 and 9.6.4 are vulnerable to incorrect authentication flaw allowing remote attackers to gain access to database accounts with an empty password.
5 affected packages
postgresql-10, postgresql-9.1, postgresql-9.3, postgresql-9.5, postgresql-9.6
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|
| postgresql-10 | — | — | — | Not affected |
| postgresql-9.1 | — | — | — | Not in release |
| postgresql-9.3 | — | — | — | Not in release |
| postgresql-9.5 | — | — | — | Not in release |
| postgresql-9.6 | — | — | — | Not in release |
Some fixes available 3 of 4
PostgreSQL versions 8.4 - 9.6 are vulnerable to information leak in pg_user_mappings view which discloses foreign server passwords to any user having USAGE privilege on the associated foreign server.
4 affected packages
postgresql-9.1, postgresql-9.3, postgresql-9.5, postgresql-9.6
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|
| postgresql-9.1 | — | — | — | — |
| postgresql-9.3 | — | — | — | — |
| postgresql-9.5 | — | — | — | — |
| postgresql-9.6 | — | — | — | — |
Some fixes available 3 of 4
In PostgreSQL 9.3.x before 9.3.17, 9.4.x before 9.4.12, 9.5.x before 9.5.7, and 9.6.x before 9.6.3, it was found that the PGREQUIRESSL environment variable was no longer enforcing a SSL/TLS connection to a PostgreSQL server. An...
4 affected packages
postgresql-9.1, postgresql-9.3, postgresql-9.5, postgresql-9.6
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|
| postgresql-9.1 | — | — | — | — |
| postgresql-9.3 | — | — | — | — |
| postgresql-9.5 | — | — | — | — |
| postgresql-9.6 | — | — | — | — |