CVE-2005-0247: Buffer Overflow
Multiple buffer overflows in gram.y for PostgreSQL 8.0.1 and earlier may allow attackers to execute arbitrary code via (1) a large number of variables in a SQL statement being handled by the readsqlconstruct function, (2) a large number of INTO variables in a SELECT statement being handled by the makeselectstmt function, (3) a large number of arbitrary variables in a SELECT statement being handled by the makeselectstmt function, and (4) a large number of INTO variables in a FETCH statement being handled by the makefetchstmt function, a different set of vulnerabilities than CVE-2005-0245.
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2005-0247?
CVE-2005-0247 has been classified as a high-severity vulnerability due to its potential for allowing arbitrary code execution.
How do I fix CVE-2005-0247?
To mitigate CVE-2005-0247, upgrade your PostgreSQL to version 8.0.2 or later where the vulnerability has been patched.
Which PostgreSQL versions are affected by CVE-2005-0247?
CVE-2005-0247 affects PostgreSQL versions 8.0.1 and earlier, as well as various earlier versions like 7.2.x, 7.3.x, and 7.4.x.
What types of attacks can exploit CVE-2005-0247?
Attackers can exploit CVE-2005-0247 through SQL statements with an excessive number of variables, leading to buffer overflow conditions.
Is there a workaround to prevent CVE-2005-0247 without upgrading?
While upgrading to a patched version is the best solution, limiting SQL statement sizes and variable counts may temporarily reduce risk.