Input validation error in PostgreSQL - CVE-2007-0556
Published: October 16, 2018 / Updated: June 23, 2025
Vulnerability identifier: #VU111783
CSH Severity: Medium
CVSS v4: 6.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2007-0556
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to read data or crash the application.
The query planner in PostgreSQL before 8.0.11, 8.1 before 8.1.7, and 8.2 before 8.2.2 does not verify that a table is compatible with a "previously made query plan," which allows remote authenticated users to cause a denial of service (server crash) and possibly access database content via an "ALTER COLUMN TYPE" SQL statement, which can be leveraged to read arbitrary memory from the server.
Affected software
PostgreSQL
Gentoo Linux
dev-db/postgresql
Gentoo Linux
dev-db/postgresql
How to mitigate CVE-2007-0556
Install update from vendor's website.
PostgreSQL - addressed in versions 8.1.7, 8.2.2
dev-db/postgresql - update to 8.0.11
dev-db/postgresql - update to 8.0.11
External References
- http://fedoranews.org/cms/node/2554
- http://lists.rpath.com/pipermail/security-announce/2007-February/000141.html
- http://osvdb.org/33302
- http://secunia.com/advisories/24028
- http://secunia.com/advisories/24033
- http://secunia.com/advisories/24042
- http://secunia.com/advisories/24050
- http://secunia.com/advisories/24057
- http://secunia.com/advisories/24151
- http://secunia.com/advisories/24315
- http://secunia.com/advisories/24513
- http://secunia.com/advisories/24577
- http://secunia.com/advisories/25220
- http://security.gentoo.org/glsa/glsa-200703-15.xml
- http://securitytracker.com/id?1017597
- http://sunsolve.sun.com/search/document.do?assetkey=1-26-102825-1
- http://support.avaya.com/elmodocs2/security/ASA-2007-117.htm
- http://www.mandriva.com/security/advisories?name=MDKSA-2007:037
- http://www.novell.com/linux/security/advisories/2007_10_sr.html
- http://www.postgresql.org/support/security
- http://www.redhat.com/support/errata/RHSA-2007-0067.html
- http://www.redhat.com/support/errata/RHSA-2007-0068.html
- http://www.securityfocus.com/archive/1/459280/100/0/threaded
- http://www.securityfocus.com/archive/1/459448/100/0/threaded
- http://www.securityfocus.com/bid/22387
- http://www.trustix.org/errata/2007/0007
- http://www.ubuntu.com/usn/usn-417-2
- http://www.vupen.com/english/advisories/2007/0478
- http://www.vupen.com/english/advisories/2007/0774
- https://exchange.xforce.ibmcloud.com/vulnerabilities/32191
- https://issues.rpath.com/browse/RPL-1025
- https://issues.rpath.com/browse/RPL-830
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11353
- https://usn.ubuntu.com/417-1/