Stack-based buffer overflow in Debian Linux - CVE-2015-0242

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when processing a floating point number with a large precision, as demonstrated by using the to_char function. A remote unauthenticated attacker can trigger stack-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Affected software

How to mitigate CVE-2015-0242

External References

• http://www.debian.org/security/2015/dsa-3155
• http://www.postgresql.org/about/news/1569/
• http://www.postgresql.org/docs/9.4/static/release-9-4-1.html
• http://www.postgresql.org/docs/current/static/release-9-0-19.html
• http://www.postgresql.org/docs/current/static/release-9-1-15.html
• http://www.postgresql.org/docs/current/static/release-9-2-10.html
• http://www.postgresql.org/docs/current/static/release-9-3-6.html

Related Security Bulletins

• Stack-based buffer overflow in Debian Linux
• Amazon Linux AMI update for postgresql92
• Gentoo update for PostgreSQL
• Fedora 21 update for postgresql