CVE-2013-0255: Input Validation
An array index error, leading to out of heap-based buffer bounds read flaw was found in the way PostgreSQL, an advanced Object-Relational database management system (DBMS), performed retrieval of textual form of error message representation when processing certain enumeration types. An unprivileged database user could issue a specially-crafted SQL query that, when processed by the server component of the PostgreSQL service, would lead to denial of service (daemon crash) or disclosure (of certain portions of) server memory.
Other sources
PostgreSQL 9.2.x before 9.2.3, 9.1.x before 9.1.8, 9.0.x before 9.0.12, 8.4.x before 8.4.16, and 8.3.x before 8.3.23 does not properly declare the enumrecv function in backend/utils/adt/enum.c, which causes it to be invoked with incorrect arguments and allows remote authenticated users to cause a denial of service (server crash) or read sensitive process memory via a crafted SQL command, which triggers an array index error and an out-of-bounds read.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2013-0255?
CVE-2013-0255 has been classified with a moderate severity level.
How do I fix CVE-2013-0255?
To fix CVE-2013-0255, upgrade PostgreSQL to versions 9.2.3, 9.1.8, 9.0.12, 8.4.16, or 8.3.23 or later.
What versions of PostgreSQL are affected by CVE-2013-0255?
CVE-2013-0255 affects PostgreSQL versions 8.3 up to 8.3.22, 8.4 up to 8.4.15, 9.0 up to 9.0.11, and 9.1 up to 9.1.7.
Is it safe to use CVE-2013-0255 vulnerable versions in production?
Using vulnerable versions affected by CVE-2013-0255 in production environments is not recommended due to potential security risks.
What can happen if CVE-2013-0255 is exploited?
Exploitation of CVE-2013-0255 can lead to unauthorized access and manipulation of the PostgreSQL database, putting data integrity at risk.