Permissions, Privileges, and Access Controls in PostgreSQL - CVE-2010-1447
Published: September 19, 2017 / Updated: June 23, 2025
Vulnerability identifier: #VU111768
CSH Severity: High
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2010-1447
CWE-ID: CWE-264
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to execute arbitrary code.
The Safe (aka Safe.pm) module 2.26, and certain earlier versions, for Perl, as used in PostgreSQL 7.4 before 7.4.29, 8.0 before 8.0.25, 8.1 before 8.1.21, 8.2 before 8.2.17, 8.3 before 8.3.11, 8.4 before 8.4.4, and 9.0 Beta before 9.0 Beta 2, allows context-dependent attackers to bypass intended (1) Safe::reval and (2) Safe::rdo access restrictions, and inject and execute arbitrary code, via vectors involving subroutine references and delayed execution.
Affected software
PostgreSQL
Gentoo Linux
dev-db/postgresql
dev-db/postgresql-server
Gentoo Linux
dev-db/postgresql
dev-db/postgresql-server
How to mitigate CVE-2010-1447
Install update from vendor's website.
PostgreSQL - addressed in versions 7.4.29, 8.0.25, 8.1.21, 8.2.17, 8.3.11, 8.4.4
dev-db/postgresql - update to 9.0.5
dev-db/postgresql-server - update to 9.0.5
dev-db/postgresql - update to 9.0.5
dev-db/postgresql-server - update to 9.0.5
External References
- http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705
- http://osvdb.org/64756
- http://secunia.com/advisories/39845
- http://secunia.com/advisories/40049
- http://secunia.com/advisories/40052
- http://security-tracker.debian.org/tracker/CVE-2010-1447
- http://www.debian.org/security/2011/dsa-2267
- http://www.mandriva.com/security/advisories?name=MDVSA-2010:115
- http://www.mandriva.com/security/advisories?name=MDVSA-2010:116
- http://www.openwall.com/lists/oss-security/2010/05/20/5
- http://www.postgresql.org/about/news.1203
- http://www.redhat.com/support/errata/RHSA-2010-0457.html
- http://www.redhat.com/support/errata/RHSA-2010-0458.html
- http://www.securityfocus.com/bid/40305
- http://www.securitytracker.com/id?1023988
- http://www.vupen.com/english/advisories/2010/1167
- https://bugs.launchpad.net/bugs/cve/2010-1447
- https://bugzilla.redhat.com/show_bug.cgi?id=588269
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11530
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7320