SB2018101033 - Multiple vulnerabilities in PostgreSQL

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2018101033

SB2018101033 - Multiple vulnerabilities in PostgreSQL

Published: October 10, 2018 Updated: June 23, 2025

Security Bulletin ID SB2018101033
Severity
Medium
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 50% Low 50%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 secuirty vulnerabilities.


1) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2009-3230)

The vulnerability allows a remote user to read and manipulate data.

The core server component in PostgreSQL 8.4 before 8.4.1, 8.3 before 8.3.8, 8.2 before 8.2.14, 8.1 before 8.1.18, 8.0 before 8.0.22, and 7.4 before 7.4.26 does not use the appropriate privileges for the (1) RESET ROLE and (2) RESET SESSION AUTHORIZATION operations, which allows remote authenticated users to gain privileges. NOTE: this is due to an incomplete fix for CVE-2007-6600.


2) Input validation error (CVE-ID: CVE-2009-3229)

The vulnerability allows a remote user to perform service disruption.

The core server component in PostgreSQL 8.4 before 8.4.1, 8.3 before 8.3.8, and 8.2 before 8.2.14 allows remote authenticated users to cause a denial of service (backend shutdown) by "re-LOAD-ing" libraries from a certain plugins directory.


Remediation

Install update from vendor's website.

References