FreshPorts - VuXML

The PL/PgSQL parser in postgresql is vulnerable to several buffer overflows. These could be exploited by a remote attacker to execute arbitrary code with the permissions of the postgresql server by running a specially crafted query.

< 7.3.9_1

gt 7.4.* lt 7.4.7_1

gt 8.* lt 8.0.1_1

The postgresql development team reports:

The more severe of the two errors is that the functions that support client-to-server character set conversion can be called from SQL commands by unprivileged users, but these functions are not designed to be safe against malicious choices of argument values. This problem exists in PostgreSQL 7.3.* through 8.0.*. The recommended fix is to disable public EXECUTE access for these functions. This does not affect normal usage of the functions for character set conversion, but it will prevent misuse.

The other error is that the contrib/tsearch2 module misdeclares several functions as returning type "internal" when they do not have any "internal" argument. This breaks the type safety of "internal" by allowing users to construct SQL commands that invoke other functions accepting "internal" arguments. The consequences of this have not been investigated in detail, but it is certainly at least possible to crash the backend.

ge 7.2.0 lt 7.2.8

ge 7.3.0 lt 7.3.10

ge 7.4.0 lt 7.4.8

ge 8.0.0 lt 8.0.3

Multiple vulnerabilities had been reported in various versions of PostgreSQL:

• The EXECUTE restrictions can be bypassed by using the AGGREGATE function, which is missing a permissions check.
• A buffer overflow exists in gram.y which could allow an attacker to execute arbitrary code by sending a large number of arguments to a refcursor function, found in gram.y
• The intagg contributed module allows an attacker to crash the server (Denial of Service) by constructing a malicious crafted array.

ge 7.2 lt 7.2.7

ge 7.3 lt 7.3.9

ge 7.4 lt 7.4.7

ge 8.0.0 lt 8.0.1

John Heasman and others disovered that non-privileged users could use the LOAD extension to load arbitrary libraries into the postgres server process space. This could be used by non-privileged local users to execute arbitrary code with the privileges of the postgresql server.

< 7.3.9

gt 7.4.* lt 7.4.7

gt 8.* lt 8.0.1

le 8.0.1,1