CVE-2014-2669: Buffer Overflow
Multiple integer overflows in contrib/hstore/hstoreio.c in PostgreSQL 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 allow remote authenticated users to have unspecified impact via vectors related to the (1) hstorerecv, (2) hstorefromarrays, and (3) hstorefromarray functions in contrib/hstore/hstoreio.c; and the (4) hstoreArrayToPairs function in contrib/hstore/hstoreop.c, which triggers a buffer overflow. NOTE: this issue was SPLIT from CVE-2014-0064 because it has a different set of affected versions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PostgreSQL contrib/hstoreto a version that resolves this vulnerability.Fixed in 9.0.16 - Upgrade
Upgrade
PostgreSQL contrib/hstoreto a version that resolves this vulnerability.Fixed in 9.1.12 - Upgrade
Upgrade
PostgreSQL contrib/hstoreto a version that resolves this vulnerability.Fixed in 9.2.7 - Upgrade
Upgrade
PostgreSQL contrib/hstoreto a version that resolves this vulnerability.Fixed in 9.3.3
Event History
Frequently Asked Questions
What is the severity of CVE-2014-2669?
CVE-2014-2669 is considered a moderate severity vulnerability due to the possibility of integer overflow leading to unspecified impacts.
How do I fix CVE-2014-2669?
To fix CVE-2014-2669, upgrade PostgreSQL to versions 9.0.16, 9.1.12, 9.2.7, or 9.3.3 or later.
What causes CVE-2014-2669?
CVE-2014-2669 is caused by multiple integer overflows in the hstore module of PostgreSQL.
Who is affected by CVE-2014-2669?
Remote authenticated users of PostgreSQL versions before 9.0.16, 9.1.12, 9.2.7, and 9.3.3 are affected by CVE-2014-2669.
What aspects of PostgreSQL are impacted by CVE-2014-2669?
CVE-2014-2669 impacts the hstore_recv, hstore_from_arrays, and hstore functions within PostgreSQL.