CVE-2010-4015: Buffer Overflow

Published Feb 2, 2011

Updated

Buffer overflow in the gettoken function in contrib/intarray/intbool.c in the intarray array module in PostgreSQL 9.0.x before 9.0.3, 8.4.x before 8.4.7, 8.3.x before 8.3.14, and 8.2.x before 8.2.20 allows remote authenticated users to cause a denial of service (crash) and possibly execute arbitrary code via integers with a large number of digits to unspecified functions.

Affected Software

44 affected components

PostgreSQL postgresql=8.3

PostgreSQL postgresql=8.3.1

PostgreSQL postgresql=8.3.2

PostgreSQL postgresql=8.3.3

PostgreSQL postgresql=8.3.4

PostgreSQL postgresql=8.3.5

PostgreSQL postgresql=8.3.6

PostgreSQL postgresql=8.3.7

PostgreSQL postgresql=8.3.8

PostgreSQL postgresql=8.3.9

PostgreSQL postgresql=8.3.10

PostgreSQL postgresql=8.3.11

PostgreSQL postgresql=8.3.12

PostgreSQL postgresql=8.3.13

PostgreSQL postgresql=9.0

PostgreSQL postgresql=9.0.1

PostgreSQL postgresql=9.0.2

PostgreSQL postgresql=8.4

PostgreSQL postgresql=8.4.1

PostgreSQL postgresql=8.4.2

PostgreSQL postgresql=8.4.3

PostgreSQL postgresql=8.4.4

PostgreSQL postgresql=8.4.5

PostgreSQL postgresql=8.4.6

PostgreSQL postgresql=8.2

PostgreSQL postgresql=8.2.1

PostgreSQL postgresql=8.2.2

PostgreSQL postgresql=8.2.3

PostgreSQL postgresql=8.2.4

PostgreSQL postgresql=8.2.5

PostgreSQL postgresql=8.2.6

PostgreSQL postgresql=8.2.7

PostgreSQL postgresql=8.2.8

PostgreSQL postgresql=8.2.9

PostgreSQL postgresql=8.2.10

PostgreSQL postgresql=8.2.11

PostgreSQL postgresql=8.2.12

PostgreSQL postgresql=8.2.13

PostgreSQL postgresql=8.2.14

PostgreSQL postgresql=8.2.15

PostgreSQL postgresql=8.2.16

PostgreSQL postgresql=8.2.17

PostgreSQL postgresql=8.2.18

PostgreSQL postgresql=8.2.19

Remediation

Patch Available

http://git.postgresql.org/gitweb?p=postgresql.git;a=commitdiff;h=7ccb6dc2d3e266a551827bb99179708580f72431

Event History

Feb 2, 2011

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2010-4015?

CVE-2010-4015 is rated as a high severity vulnerability that can lead to denial of service and potential remote code execution.

How do I fix CVE-2010-4015?

To fix CVE-2010-4015, you should upgrade PostgreSQL to version 9.0.3 or later, 8.4.7 or later, 8.3.14 or later, or 8.2.20 or later.

Which versions are affected by CVE-2010-4015?

CVE-2010-4015 affects PostgreSQL versions 9.0.x before 9.0.3, 8.4.x before 8.4.7, 8.3.x before 8.3.14, and 8.2.x before 8.2.20.

Who can exploit CVE-2010-4015?

CVE-2010-4015 can be exploited by remote authenticated users to cause a denial of service.

What is the impact of CVE-2010-4015?

The impact of CVE-2010-4015 includes crashing the database and potentially executing arbitrary code.