SB2018101626 - Multiple vulnerabilities in PostgreSQL

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2018101626

SB2018101626 - Multiple vulnerabilities in PostgreSQL

Published: October 16, 2018 Updated: June 23, 2025

Security Bulletin ID SB2018101626
Severity
High
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 secuirty vulnerabilities.


1) Input validation error (CVE-ID: CVE-2007-3280)

The vulnerability allows a remote user to execute arbitrary code.

The Database Link library (dblink) in PostgreSQL 8.1 implements functions via CREATE statements that map to arbitrary libraries based on the C programming language, which allows remote authenticated superusers to map and execute a function from any library, as demonstrated by using the system function in libc.so.6 to gain shell access.


2) Input validation error (CVE-ID: CVE-2007-3279)

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

PostgreSQL 8.1 and probably later versions, when the PL/pgSQL (plpgsql) language has been created, grants certain plpgsql privileges to the PUBLIC domain, which allows remote attackers to create and execute functions, as demonstrated by functions that perform local brute-force password guessing attacks, which may evade intrusion detection.


Remediation

Install update from vendor's website.

References