Race condition in the (1) CREATE INDEX and (2) unspecified ALTER TABLE commands in PostgreSQL before 8.4.20, 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 allows remote authenticated users to create an unauthorized index or read portions of unauthorized tables by creating or deleting a table with the same name during the timing window.
CVSS Details
- CVSS 3.1 Base Score: 3.1
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade postgresql | Sep 20, 2017 | Mar 31, 2014 |
| Centos_linux | — | Upgrade postgresql84-libsUpgrade postgresql-libsUpgrade postgresqlUpgrade postgresql84-pythonUpgrade postgresql-plperlUpgrade postgresql84-contribUpgrade postgresql84-plperlUpgrade postgresql-plpythonUpgrade postgresql-pltclUpgrade postgresql-serverUpgrade postgresql84-plpythonUpgrade postgresql-testUpgrade postgresql-plUpgrade postgresql-pythonUpgrade postgresql84-docsUpgrade postgresql-tclUpgrade postgresql84Upgrade postgresql84-testUpgrade postgresql84-develUpgrade postgresql-develUpgrade postgresql-docsUpgrade postgresql84-pltclUpgrade postgresql84-serverUpgrade postgresql84-tclUpgrade postgresql-contrib | Dec 1, 2016 | Mar 31, 2014 |
| Freebsd | — | Upgrade postgresql-server | Dec 10, 2025 | Feb 20, 2014 |
| Gentoo Linux | — | Upgrade dev-db/postgresql-server. | Oct 30, 2017 | Mar 31, 2014 |
| Oracle_linux | — | Upgrade postgresql-docsUpgrade postgresql-plpythonUpgrade postgresql-contribUpgrade postgresql-serverUpgrade postgresqlUpgrade postgresql84Upgrade postgresql-libsUpgrade postgresql84-plpythonUpgrade postgresql84-testUpgrade postgresql-plperlUpgrade postgresql-testUpgrade postgresql84-tclUpgrade postgresql-develUpgrade postgresql84-develUpgrade postgresql84-plperlUpgrade postgresql-pltclUpgrade postgresql84-contribUpgrade postgresql84-libsUpgrade postgresql84-pltclUpgrade postgresql84-serverUpgrade postgresql84-docsUpgrade postgresql84-python | Oct 16, 2024 | Mar 28, 2014 |
| Postgres | — | Upgrade to PostgreSQL version 9.3.3 | Apr 1, 2014 | Mar 31, 2014 |
| Suse | — | Upgrade libpq5-32bitUpgrade libpq5Upgrade postgresql94-docsUpgrade postgresql93Upgrade postgresql10-serverUpgrade postgresql10Upgrade postgresql10-plperlUpgrade postgresql94-contribUpgrade postgresql93-contribUpgrade postgresql93-docsUpgrade postgresql10-develUpgrade postgresql96-serverUpgrade postgresql91-develUpgrade postgresql91-contribUpgrade postgresql93-develUpgrade postgresql94Upgrade postgresql94-develUpgrade postgresql10-docsUpgrade postgresql96-develUpgrade postgresql91-docsUpgrade postgresql96-docsUpgrade postgresql10-contribUpgrade postgresql91Upgrade postgresql10-pltclUpgrade postgresql96-contribUpgrade postgresql93-serverUpgrade postgresql91-serverUpgrade postgresql10-plpythonUpgrade postgresql96Upgrade postgresql94-serverUpgrade libecpg6 | Dec 18, 2015 | Mar 28, 2014 |
| Ubuntu | — | Upgrade postgresql-8.4Upgrade postgresql-9.1 | Nov 8, 2024 | Mar 31, 2014 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub