Multiple vulnerabilities in PostgreSQL



| Updated: 2025-06-21
Risk Medium
Patch available YES
Number of vulnerabilities 4
CVE-ID CVE-2005-0227
CVE-2005-0244
CVE-2005-0245
CVE-2005-0246
CWE-ID CWE-749
CWE-264
CWE-122
CWE-20
Exploitation vector Network
Public exploit Public exploit code for vulnerability #3 is available.
Vulnerable software
 PostgreSQL
Server applications / Database software

Vendor PostgreSQL Global Development Group

Security Bulletin

This security bulletin contains information about 4 vulnerabilities.

1) Exposed dangerous method or function

EUVDB-ID: #VU111737

Risk: Medium

CVSSv4.0: 6.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2005-0227

CWE-ID: CWE-749 - Exposed Dangerous Method or Function

Exploit availability: No

Description

The vulnerability allows a remote user to compromise the affected system.

The vulnerability exists due to application allows using the LOAD command to load and execute arbitrary binaries. A remote user can execute arbitrary code on the server. 

Mitigation

Install updates from vendor's website.

Vulnerable software versions

PostgreSQL: 7.2 - 8.0.0

CPE2.3 External links

https://archives.postgresql.org/pgsql-bugs/2005-01/msg00269.php
https://archives.postgresql.org/pgsql-announce/2005-02/msg00000.php
https://www.debian.org/security/2005/dsa-668
https://security.gentoo.org/glsa/glsa-200502-08.xml
https://www.redhat.com/support/errata/RHSA-2005-138.html
https://www.redhat.com/support/errata/RHSA-2005-150.html
https://www.trustix.org/errata/2005/0003/
https://secunia.com/advisories/12948
https://www.novell.com/linux/security/advisories/2005_36_sudo.html
https://www.securityfocus.com/bid/12411
https://www.mandriva.com/security/advisories?name=MDKSA-2005:040
https://marc.info/?l=bugtraq&m=110726899107148&w=2
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10234


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU111738

Risk: Medium

CVSSv4.0: 6.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2005-0244

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a remote user to escalate privileges on the system.

The vulnerability exists due to application does not properly impose security restrictions. A remote user can bypass the EXECUTE permission check for functions by using the CREATE AGGREGATE command.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

PostgreSQL: 7.2 - 8.0.0

CPE2.3 External links

https://archives.postgresql.org/pgsql-hackers/2005-01/msg00922.php
https://marc.info/?l=bugtraq&m=110806034116082&w=2
https://secunia.com/advisories/12948
https://www.mandriva.com/security/advisories?name=MDKSA-2005:040
https://www.novell.com/linux/security/advisories/2005_36_sudo.html
https://www.redhat.com/support/errata/RHSA-2005-138.html
https://www.securityfocus.com/bid/12417
https://exchange.xforce.ibmcloud.com/vulnerabilities/19184
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10927


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Heap-based buffer overflow

EUVDB-ID: #VU111739

Risk: Medium

CVSSv4.0: 7.4 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Green]

CVE-ID: CVE-2005-0245

CWE-ID: CWE-122 - Heap-based Buffer Overflow

Exploit availability: Yes

Description

The vulnerability allows a remote user to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error. A remote user can pass a large number of arguments to a refcursor function (gram.y), trigger a heap-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

PostgreSQL: 7.2 - 8.0.0

CPE2.3 External links

https://archives.postgresql.org/pgsql-patches/2005-01/msg00216.php
https://archives.postgresql.org/pgsql-committers/2005-01/msg00298.php
https://archives.postgresql.org/pgsql-committers/2005-02/msg00049.php
https://www.debian.org/security/2005/dsa-683
https://www.redhat.com/support/errata/RHSA-2005-138.html
https://www.redhat.com/support/errata/RHSA-2005-150.html
https://secunia.com/advisories/12948
https://www.novell.com/linux/security/advisories/2005_36_sudo.html
https://www.securityfocus.com/bid/12417
https://www.mandriva.com/security/advisories?name=MDKSA-2005:040
https://marc.info/?l=bugtraq&m=110806034116082&w=2
https://exchange.xforce.ibmcloud.com/vulnerabilities/19188
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10175


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

4) Input validation error

EUVDB-ID: #VU111740

Risk: Medium

CVSSv4.0: 4.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2005-0246

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote user to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input. A remote user can pass specially crafted arrays to the database and perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

PostgreSQL: 7.2 - 8.0.0

CPE2.3 External links

https://archives.postgresql.org/pgsql-committers/2005-01/msg00401.php
https://www.redhat.com/support/errata/RHSA-2005-138.html
https://secunia.com/advisories/12948
https://www.novell.com/linux/security/advisories/2005_36_sudo.html
https://www.securityfocus.com/bid/12417
https://www.mandriva.com/security/advisories?name=MDKSA-2005:040
https://marc.info/?l=bugtraq&m=110806034116082&w=2
https://exchange.xforce.ibmcloud.com/vulnerabilities/19185
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10148


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###