CVE-2014-0063: Buffer Overflow
It was found that the buffers used to hold datetime output were too small. Long output could lead to a stack-based buffer overflow, possibly allowing an authenticated database user to crash the PostgreSQL server or execute arbitrary code.
Acknowledgements:
Red Hat would like to thank the PostgreSQL project for reporting this issue. Upstream acknowledges Noah Misch as the original reporter.
Other sources
Multiple stack-based buffer overflows in PostgreSQL before 8.4.20, 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 allow remote authenticated users to cause a denial of service (crash) or possibly execute arbitrary code via vectors related to an incorrect MAXDATELEN constant and datetime values involving (1) intervals, (2) timestamps, or (3) timezones, a different vulnerability than CVE-2014-0065.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-0063?
CVE-2014-0063 has a severity rating that may allow an authenticated database user to execute arbitrary code or crash the PostgreSQL server.
How do I fix CVE-2014-0063?
To fix CVE-2014-0063, you should upgrade PostgreSQL to a version that is not vulnerable, such as any version beyond 8.4.19.
What systems are affected by CVE-2014-0063?
CVE-2014-0063 affects PostgreSQL versions up to 8.4.19 and certain 9.x versions.
What type of vulnerability is CVE-2014-0063?
CVE-2014-0063 is a stack-based buffer overflow vulnerability related to datetime output.
Can CVE-2014-0063 be exploited remotely?
CVE-2014-0063 requires an authenticated user to exploit the vulnerability, making it less likely for remote exploitation.