Most severe vulnerabilities for "postgresql" 9.1

Where

AND

Sort:

PostgreSQL postgresqlBuffer Overflow

Risk 86

Severity

9.8

Buffer Overflow

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

The snprintf implementation in PostgreSQL before 9.0.20, 9.1.x before 9.1.16, 9.2.x before 9.2.11, 9.3.x before 9.3.7, and 9.4.x before 9.4.2 does not properly handle system-call errors, which allows attackers to obtain sensitive information or have other unspecified impact via unknown vectors, as demonstrated by an out-of-memory error.

First published (updated )

CVE-2015-3166

PostgreSQL postgresqlPostgreSQL 9.2.x before 9.2.4, 9.1.x before 9.1.9, 9.0.x before 9.0.13, and 8.4.x before 8.4.17, whe…

Risk 72

Severity

8.5

AV:N/AC:M/Au:S/C:C/I:C/A:C

PostgreSQL 9.2.x before 9.2.4, 9.1.x before 9.1.9, 9.0.x before 9.0.13, and 8.4.x before 8.4.17, when using OpenSSL, generates insufficiently random numbers, which might allow remote authenticated users to have an unspecified impact via vectors related to the "contrib/pgcrypto functions."

First published (updated )

CVE-2013-1900

PostgreSQL postgresqlInfoleak

Risk 43

Severity

7.5

Infoleak

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

contrib/pgcrypto in PostgreSQL before 9.0.20, 9.1.x before 9.1.16, 9.2.x before 9.2.11, 9.3.x before 9.3.7, and 9.4.x before 9.4.2 uses different error responses when an incorrect key is used, which makes it easier for attackers to obtain the key via a brute force attack.

First published (updated )

CVE-2015-3167

PostgreSQL postgresqlCode Injection

Risk 46

Severity

6.5

Code Injection

AV:N/AC:L/Au:S/C:P/I:P/A:P

Argument injection vulnerability in PostgreSQL 9.2.x before 9.2.4, 9.1.x before 9.1.9, and 9.0.x before 9.0.13 allows remote attackers to cause a denial of service (file corruption), and allows remote authenticated users to modify configuration settings and execute arbitrary code, via a connection request using a database name that begins with a "-" (hyphen).

First published (updated )

CVE-2013-1899

Opensuse Project OpensuseInput Validation

Risk 22

Severity

4.3

Input Validation

AV:N/AC:M/Au:N/C:N/I:P/A:N

PostgreSQL 8.4.x before 8.4.11, 9.0.x before 9.0.7, and 9.1.x before 9.1.3 truncates the common name to only 32 characters when verifying SSL certificates, which allows remote attackers to spoof connections when the host name is exactly 32 characters.

First published (updated )

CVE-2012-0867

redhat/postgresqlThe crypt_des (aka DES-based crypt) function in FreeBSD before 9.0-RELEASE-p2, as used in PHP, Postg…

Risk 22

Severity

4.3

AV:N/AC:M/Au:N/C:N/I:P/A:N

A security flaw was found in the way DES and extended DES based crypt() password encryption function performed encryption of certain keys, when the key to be encrypted was provided in the Unicode encoding (certain keys were truncated before being DES digested). When the resulting ciphertext for such a previously shortened key was used as a pattern in a password protected resource, intended to be matched against subsequently encrypted value of the password field, retrieved from the user authentication dialog, it could lead to authentication bypass.

1 / 2

Source: Red Hat

First published (updated )

CVE-2012-2143

Canonical Ubuntu LinuxDouble Free

Risk 22

Severity

4.3

Double Free

AV:N/AC:M/Au:N/C:N/I:N/A:P

Double free vulnerability in PostgreSQL before 9.0.20, 9.1.x before 9.1.16, 9.2.x before 9.2.11, 9.3.x before 9.3.7, and 9.4.x before 9.4.2 allows remote attackers to cause a denial of service (crash) by closing an SSL session at a time when the authentication timeout will expire during the session shutdown sequence.

First published (updated )

CVE-2015-3165

PostgreSQL postgresqlPostgreSQL 9.2.x before 9.2.4 and 9.1.x before 9.1.9 does not properly check REPLICATION privileges,…

Risk 21

Severity

AV:N/AC:L/Au:S/C:N/I:P/A:N

PostgreSQL 9.2.x before 9.2.4 and 9.1.x before 9.1.9 does not properly check REPLICATION privileges, which allows remote authenticated users to bypass intended backup restrictions by calling the (1) pgstartbackup or (2) pgstopbackup functions.

First published (updated )

CVE-2013-1901