Safe.pm 2.26 and earlier (except 2.20 through 2.23 if using a threads-enabled Perl), when used in Perl 5.10.0 and earlier, may allow attackers to break out of safe compartment in (1) Safe::reval or (2) Safe::rdo using subroutine references, whose execution is delayed to happen outside of the safe compartment. If a victim was tricked into running a specially-crafted Perl script, using Safe extension module, it could lead to intended Safe module restrictions bypass, if the returned subroutine reference was called from outside of the compartment. Different vulnerability than CVE-2010-1168.

Solution: Ugrade to Safe.pm v2.27 or higher.

References: [1] http://search.cpan.org/~rgarcia/Safe-2.27/Safe.pm

Acknowledgements:

Red Hat would like to thank Tim Bunce for responsibly reporting this flaw. Upstream credits also Rafaël Garcia-Suarez for discovering of this issue.

A flaw was found in the way the PostgreSQL enforced permission checks on scripts written in PL/Perl. Once the PL/Perl procedural language was registered on particular database, a remote, authenticated user, privileged to create databases, running a specially-crafted PL/Perl script, could use this flaw to bypass intended PL/Perl trusted mode restrictions, allowing them to run arbitrary Perl scripts with the privileges of the database server.

References: [1] PostgreSQL PL/Perl procedural language manual page: http://www.postgresql.org/docs/8.1/interactive/plperl.html [2] PostgreSQL Trusted and Untrusted PL/Perl mode manual page: http://www.postgresql.org/docs/8.1/interactive/plperl-trusted.html

Acknowledgements:

Red Hat would like to thank Tim Bunce for responsibly reporting this issue.

PostgreSQL 7.3.x through 8.0.x gives public EXECUTE access to certain character conversion functions, which allows unprivileged users to call those functions with malicious values, with unknown impact, aka the "Character conversion vulnerability."

PostgreSQL 8.1.x before 8.1.4, 8.0.x before 8.0.8, 7.4.x before 7.4.13, 7.3.x before 7.3.15, and earlier versions allows context-dependent attackers to bypass SQL injection protection methods in applications that use multibyte encodings that allow the "\" (backslash) byte 0x5c to be the trailing byte of a multibyte character, such as SJIS, BIG5, GBK, GB18030, and UHC, which cannot be handled correctly by a client that does not understand multibyte encodings, aka a second variant of "Encoding-Based SQL Injection." NOTE: it could be argued that this is a class of issue related to interaction errors between the client and PostgreSQL, but a CVE has been assigned since PostgreSQL is treating this as a preventative measure against this class of problem.

PostgreSQL 8.1.x before 8.1.4, 8.0.x before 8.0.8, 7.4.x before 7.4.13, 7.3.x before 7.3.15, and earlier versions allows context-dependent attackers to bypass SQL injection protection methods in applications via invalid encodings of multibyte characters, aka one variant of "Encoding-Based SQL Injection."

The regular expression parser in TCL before 8.4.17, as used in PostgreSQL 8.2 before 8.2.6, 8.1 before 8.1.11, 8.0 before 8.0.15, and 7.4 before 7.4.19, allows remote authenticated users to cause a denial of service (backend crash) via an out-of-bounds backref number.

Algorithmic complexity vulnerability in the regular expression parser in TCL before 8.4.17, as used in PostgreSQL 8.2 before 8.2.6, 8.1 before 8.1.11, 8.0 before 8.0.15, and 7.4 before 7.4.19, allows remote authenticated users to cause a denial of service (memory consumption) via a crafted "complex" regular expression with doubly-nested states.

The query planner in PostgreSQL before 8.0.11, 8.1 before 8.1.7, and 8.2 before 8.2.2 does not verify that a table is compatible with a "previously made query plan," which allows remote authenticated users to cause a denial of service (server crash) and possibly access database content via an "ALTER COLUMN TYPE" SQL statement, which can be leveraged to read arbitrary memory from the server.

Multiple buffer overflows in gram.y for PostgreSQL 8.0.1 and earlier may allow attackers to execute arbitrary code via (1) a large number of variables in a SQL statement being handled by the readsqlconstruct function, (2) a large number of INTO variables in a SELECT statement being handled by the makeselectstmt function, (3) a large number of arbitrary variables in a SELECT statement being handled by the makeselectstmt function, and (4) a large number of INTO variables in a FETCH statement being handled by the makefetchstmt function, a different set of vulnerabilities than CVE-2005-0245.

PostgreSQL 8.0.0 and earlier allows local users to bypass the EXECUTE permission check for functions by using the CREATE AGGREGATE command.

Any logged-in database user who has the ability to create tables and functions (which in most installations will be everybody) can acquire database superuser privilege, which means he can make the server process do whatever he wants.

A flaw was found in the way the PostgreSQL enforced permission checks on scripts written in PL/Tcl. Once the PL/Tcl procedural language was registered on particular database, a remote, authenticated user, privileged to create databases, running a specially-crafted PL/Tcl script, could use this flaw to bypass intended PL/Tcl trusted mode restrictions, allowing them to run arbitrary Tcl scripts with the privileges of the database server.

References: [1] PostgreSQL PL/Tcl procedural language manual page: http://www.postgresql.org/docs/8.1/interactive/pltcl.html

A flaw was found in the way PostgreSQL handled SQL functions, created with SECURITY DEFINER keyword and implemented in PL/Perl or PL/Tcl languages. Once the PL/Perl or PL/Tcl procedural language was registered on particular database, a remote, authenticated user, running a specially-crafted PL/Perl or PL/Tcl script could use this flaw to bypass intended PostgreSQL SECURITY DEFINER function definition refinement / protection mechanism, allowing them to run particular PostgreSQL function under their effective user ID, potentially leading to escalation of their privileges.

References: [1] http://www.postgresql.org/docs/8.1/interactive/plperl.html [2] http://www.postgresql.org/docs/8.1/static/pltcl.html [3] http://www.postgresql.org/docs/8.1/interactive/sql-createfunction.html

PostgreSQL 7.4 before 7.4.29, 8.0 before 8.0.25, 8.1 before 8.1.21, 8.2 before 8.2.17, 8.3 before 8.3.11, and 8.4 before 8.4.4 does not properly check privileges during certain RESET ALL operations, which allows remote authenticated users to remove arbitrary parameter settings via a (1) ALTER USER or (2) ALTER DATABASE statement.

The intagg contrib module for PostgreSQL 8.0.0 and earlier allows attackers to cause a denial of service (crash) via crafted arrays.

PostgreSQL (pgsql) 7.4.x, 7.2.x, and other versions allows local users to load arbitrary shared libraries and execute code via the LOAD extension.

backend/parser/parsecoerce.c in PostgreSQL 7.4.1 through 7.4.14, 8.0.x before 8.0.9, and 8.1.x before 8.1.5 allows remote authenticated users to cause a denial of service (daemon crash) via a coercion of an unknown element to ANYARRAY.

backend/parser/analyze.c in PostgreSQL 8.1.x before 8.1.5 allows remote authenticated users to cause a denial of service (daemon crash) via certain aggregate functions in an UPDATE statement, which are not properly handled during a "MIN/MAX index optimization."

The tsearch2 module in PostgreSQL 7.4 through 8.0.x declares the (1) dexinit, (2) snbeninit, (3) snbruinit, (4) spellinit, and (5) syninit functions as "internal" even when they do not take an internal argument, which allows attackers to cause a denial of service (application crash) and possibly have other impacts via SQL commands that call other functions that accept internal arguments.

PostgreSQL 7.3.x before 7.3.14, 7.4.x before 7.4.12, 8.0.x before 8.0.7, and 8.1.x before 8.1.3, when compiled with Asserts enabled, allows local users to cause a denial of service (server crash) via a crafted SET SESSION AUTHORIZATION command, a different vulnerability than CVE-2006-0553.