REDHAT-BUG-559259: Buffer Overflow

Published Jan 27, 2010

Updated

Intevydis reported a buffer overflow in PostgreSQL's implementation of substring() function when called with negative length argument:

http://intevydis.blogspot.com/2010/01/postgresql-8023-bitsubstr-overflow.html

Following query triggers overflow / crash:

select substring(B'10101010101010101010101010101010101010101010101',33,-15);

Affected Software

1 affected component

Intevydis PostgreSQL

Jan 27, 2010

Data Sourced

via Red Hat·03:33 PM

DescriptionSeverityAffected Software

The severity of REDHAT-BUG-559259 is considered high due to the potential for remote code execution from the buffer overflow.

To fix REDHAT-BUG-559259, update to the latest version of PostgreSQL that implements the necessary security patches.

REDHAT-BUG-559259 addresses a buffer overflow in PostgreSQL's substring() function when a negative length argument is used.

The vulnerability in REDHAT-BUG-559259 was reported by Intevydis.

REDHAT-BUG-559259 affects the Intevydis PostgreSQL software.