CVE-2016-5423: Null Pointer Dereference
It was discovered that certain SQL statements containing CASE/WHEN commands could crash the PostgreSQL server, or disclose a few bytes of server memory, potentially leading to arbitrary code execution.
Other sources
PostgreSQL before 9.1.23, 9.2.x before 9.2.18, 9.3.x before 9.3.14, 9.4.x before 9.4.9, and 9.5.x before 9.5.4 allow remote authenticated users to cause a denial of service (NULL pointer dereference and server crash), obtain sensitive memory information, or possibly execute arbitrary code via (1) a CASE expression within the test value subexpression of another CASE or (2) inlining of an SQL function that implements the equality operator used for a CASE expression involving values of different types.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2016-5423?
CVE-2016-5423 is classified as a high severity vulnerability due to potential remote code execution and denial of service.
How do I fix CVE-2016-5423?
To fix CVE-2016-5423, upgrade your PostgreSQL installation to version 9.1.23, 9.2.18, 9.3.14, 9.4.9, or 9.5.4 or later.
What versions of PostgreSQL are affected by CVE-2016-5423?
CVE-2016-5423 affects PostgreSQL versions prior to 9.1.23, 9.2.x before 9.2.18, 9.3.x before 9.3.14, 9.4.x before 9.4.9, and 9.5.x before 9.5.4.
What can attackers do with CVE-2016-5423?
Attackers can exploit CVE-2016-5423 to cause a denial of service, access sensitive memory information, or potentially execute arbitrary code.
Who is affected by CVE-2016-5423?
Remote authenticated users of the affected PostgreSQL versions are primarily at risk of CVE-2016-5423.