Search CVE reports
41 – 50 of 96 results
CVE-2019-9193
Medium priority** DISPUTED ** In PostgreSQL 9.3 through 11.2, the "COPY TO/FROM PROGRAM" function allows superusers and users in the 'pg_execute_server_program' group to execute arbitrary code in the context of the database's operating system...
5 affected packages
postgresql-10, postgresql-11, postgresql-9.1, postgresql-9.3, postgresql-9.5
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS | 16.04 LTS |
|---|---|---|---|---|---|
| postgresql-10 | — | — | — | Not affected | Not in release |
| postgresql-11 | — | — | — | Not in release | Not in release |
| postgresql-9.1 | — | — | — | Not in release | Not in release |
| postgresql-9.3 | — | — | — | Not in release | Not in release |
| postgresql-9.5 | — | — | — | Not in release | Not affected |
CVE-2018-16850
Medium prioritypostgresql before versions 11.1, 10.6 is vulnerable to a to SQL injection in pg_upgrade and pg_dump via CREATE TRIGGER ... REFERENCING. Using a purpose-crafted trigger definition, an attacker can cause arbitrary SQL statements to...
4 affected packages
postgresql-10, postgresql-9.1, postgresql-9.3, postgresql-9.5
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS | 16.04 LTS |
|---|---|---|---|---|---|
| postgresql-10 | — | — | — | Fixed | Not in release |
| postgresql-9.1 | — | — | — | Not in release | Not in release |
| postgresql-9.3 | — | — | — | Not in release | Not in release |
| postgresql-9.5 | — | — | — | Not in release | Not affected |
CVE-2018-10925
Medium priorityIt was discovered that PostgreSQL versions before 10.5, 9.6.10, 9.5.14, 9.4.19, and 9.3.24 failed to properly check authorization on certain statements involved with "INSERT ... ON CONFLICT DO UPDATE". An attacker with "CREATE...
4 affected packages
postgresql-10, postgresql-9.1, postgresql-9.3, postgresql-9.5
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS | 16.04 LTS |
|---|---|---|---|---|---|
| postgresql-10 | — | — | — | Fixed | Not in release |
| postgresql-9.1 | — | — | — | Not in release | Not in release |
| postgresql-9.3 | — | — | — | Not in release | Not in release |
| postgresql-9.5 | — | — | — | Not in release | Fixed |
CVE-2018-10915
Medium priorityA vulnerability was found in libpq, the default PostgreSQL client library where libpq failed to properly reset its internal state between connections. If an affected version of libpq was used with "host" or "hostaddr" connection...
4 affected packages
postgresql-10, postgresql-9.1, postgresql-9.3, postgresql-9.5
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS | 16.04 LTS |
|---|---|---|---|---|---|
| postgresql-10 | — | — | — | Fixed | Not in release |
| postgresql-9.1 | — | — | — | Not in release | Not in release |
| postgresql-9.3 | — | — | — | Not in release | Not in release |
| postgresql-9.5 | — | — | — | Not in release | Fixed |
CVE-2018-1115
Low prioritySome fixes available 1 of 2
postgresql before versions 10.4, 9.6.9 is vulnerable in the adminpack extension, the pg_catalog.pg_logfile_rotate() function doesn't follow the same ACLs than pg_rorate_logfile. If the adminpack is added to a database, an attacker...
5 affected packages
postgresql-10, postgresql-9.1, postgresql-9.3, postgresql-9.5, postgresql-9.6
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS | 16.04 LTS |
|---|---|---|---|---|---|
| postgresql-10 | — | — | — | Fixed | Not in release |
| postgresql-9.1 | — | — | — | Not in release | Not in release |
| postgresql-9.3 | — | — | — | Not in release | Not in release |
| postgresql-9.5 | — | — | — | Not in release | Not affected |
| postgresql-9.6 | — | — | — | Not in release | Not in release |
CVE-2017-14798
Medium priorityA race condition in the postgresql init script could be used by attackers able to access the postgresql account to escalate their privileges to root.
5 affected packages
postgresql-10, postgresql-9.1, postgresql-9.3, postgresql-9.5, postgresql-9.6
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS | 16.04 LTS |
|---|---|---|---|---|---|
| postgresql-10 | — | — | — | — | Not in release |
| postgresql-9.1 | — | — | — | — | Not in release |
| postgresql-9.3 | — | — | — | — | Not in release |
| postgresql-9.5 | — | — | — | — | Not affected |
| postgresql-9.6 | — | — | — | — | Not in release |
CVE-2018-1058
Medium priorityA flaw was found in the way Postgresql allowed a user to modify the behavior of a query for other users. An attacker with a user account could use this flaw to execute code with the permissions of superuser in the database....
5 affected packages
postgresql-10, postgresql-9.1, postgresql-9.3, postgresql-9.5, postgresql-9.6
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS | 16.04 LTS |
|---|---|---|---|---|---|
| postgresql-10 | — | — | — | Fixed | Not in release |
| postgresql-9.1 | — | — | — | Not in release | Not in release |
| postgresql-9.3 | — | — | — | Not in release | Not in release |
| postgresql-9.5 | — | — | — | Not in release | Fixed |
| postgresql-9.6 | — | — | — | Not in release | Not in release |
CVE-2018-1052
Medium priorityMemory disclosure vulnerability in table partitioning was found in postgresql 10.x before 10.2, allowing an authenticated attacker to read arbitrary bytes of server memory via purpose-crafted insert to a partitioned table.
4 affected packages
postgresql-10, postgresql-9.1, postgresql-9.4, postgresql-9.6
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS | 16.04 LTS |
|---|---|---|---|---|---|
| postgresql-10 | — | — | — | — | Not in release |
| postgresql-9.1 | — | — | — | — | Not in release |
| postgresql-9.4 | — | — | — | — | Not in release |
| postgresql-9.6 | — | — | — | — | Not in release |
CVE-2018-1053
Low priorityIn postgresql 9.3.x before 9.3.21, 9.4.x before 9.4.16, 9.5.x before 9.5.11, 9.6.x before 9.6.7 and 10.x before 10.2, pg_upgrade creates file in current working directory containing the output of `pg_dumpall -g` under umask which...
6 affected packages
postgresql-10, postgresql-9.1, postgresql-9.3, postgresql-9.4, postgresql-9.5, postgresql-9.6
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS | 16.04 LTS |
|---|---|---|---|---|---|
| postgresql-10 | — | — | — | Not affected | Not in release |
| postgresql-9.1 | — | — | — | Not in release | Not in release |
| postgresql-9.3 | — | — | — | Not in release | Not in release |
| postgresql-9.4 | — | — | — | Not in release | Not in release |
| postgresql-9.5 | — | — | — | Not in release | Fixed |
| postgresql-9.6 | — | — | — | Not in release | Not in release |
CVE-2017-12172
Negligible priorityPostgreSQL 10.x before 10.1, 9.6.x before 9.6.6, 9.5.x before 9.5.10, 9.4.x before 9.4.15, 9.3.x before 9.3.20, and 9.2.x before 9.2.24 runs under a non-root operating system account, and database superusers have effective ability...
4 affected packages
postgresql-9.1, postgresql-9.3, postgresql-9.5, postgresql-9.6
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS | 16.04 LTS |
|---|---|---|---|---|---|
| postgresql-9.1 | — | — | — | — | Not in release |
| postgresql-9.3 | — | — | — | — | Not in release |
| postgresql-9.5 | — | — | — | — | Not affected |
| postgresql-9.6 | — | — | — | — | Not in release |