CVE-2015-3166: Buffer Overflow
First published: Wed Nov 20 2019(Updated: )
The snprintf implementation in PostgreSQL before 9.0.20, 9.1.x before 9.1.16, 9.2.x before 9.2.11, 9.3.x before 9.3.7, and 9.4.x before 9.4.2 does not properly handle system-call errors, which allows attackers to obtain sensitive information or have other unspecified impact via unknown vectors, as demonstrated by an out-of-memory error.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| PostgreSQL | <9.0.20 | |
| PostgreSQL | >=9.1<9.1.16 | |
| PostgreSQL | >=9.2<9.2.11 | |
| PostgreSQL | >=9.3<9.3.7 | |
| PostgreSQL | >=9.4<9.4.2 | |
| Debian Linux | =7.0 | |
| Debian Linux | =8.0 | |
| Debian Linux | =9.0 | |
| Ubuntu | =12.04 | |
| Ubuntu | =14.04 | |
| Ubuntu | =14.10 | |
| Ubuntu | =15.04 | |
| =17.1.0 | 17.1.1 | |
| >=16.1.0<=16.1.5 | ||
| >=15.1.0<=15.1.10 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.postgresql.org/about/news/1587/
- http://www.postgresql.org/docs/9.0/static/release-9-0-20.html
- http://www.postgresql.org/docs/9.1/static/release-9-1-16.html
- http://www.postgresql.org/docs/9.2/static/release-9-2-11.html
- http://www.postgresql.org/docs/9.3/static/release-9-3-7.html
- http://www.postgresql.org/docs/9.4/static/release-9-4-2.html
- http://www.debian.org/security/2015/dsa-3269
- http://www.debian.org/security/2015/dsa-3270
- http://ubuntu.com/usn/usn-2621-1
- https://my.f5.com/manage/s/article/K000150204
Frequently Asked Questions
What is CVE-2015-3166?
CVE-2015-3166 is a vulnerability in PostgreSQL that allows attackers to obtain sensitive information or have other unspecified impact.
What versions of PostgreSQL are affected by CVE-2015-3166?
PostgreSQL versions before 9.0.20, 9.1.x before 9.1.16, 9.2.x before 9.2.11, 9.3.x before 9.3.7, and 9.4.x before 9.4.2 are affected by CVE-2015-3166.
What is the severity of CVE-2015-3166?
CVE-2015-3166 has a severity rating of 9.8 (critical).
How can I fix CVE-2015-3166?
To fix CVE-2015-3166, it is recommended to upgrade to PostgreSQL versions 9.0.20, 9.1.16, 9.2.11, 9.3.7, or 9.4.2.
Where can I find more information about CVE-2015-3166?
More information about CVE-2015-3166 can be found at the following references: [1] [2] [3].
- agent/type
- agent/weakness
- agent/author
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/first-publish-date
- agent/last-modified-date
- agent/references
- agent/source
- agent/severity
- agent/event
- collector/nvd-index
- agent/software-canonical-lookup-request
- agent/softwarecombine
- agent/tags
- collector/f5-advisory
- source/F5
- alias/CVE-2015-3166
- vendor/postgresql
- canonical/postgresql
- version/postgresql/9.1
- version/postgresql/9.2
- version/postgresql/9.3
- version/postgresql/9.4
- vendor/debian
- canonical/debian linux
- version/debian linux/7.0
- version/debian linux/8.0
- version/debian linux/9.0
- vendor/canonical
- canonical/ubuntu
- version/ubuntu/12.04
- version/ubuntu/14.04
- version/ubuntu/14.10
- version/ubuntu/15.04
- vendor/f5