PostgreSQL 7.4.x before 7.4.27, 8.0.x before 8.0.23, 8.1.x before 8.1.19, 8.2.x before 8.2.15, 8.3.x before 8.3.9, and 8.4.x before 8.4.2 does not properly manage session-local state during execution of an index function by a database superuser, which allows remote authenticated users to gain privileges via a table with crafted index functions, as demonstrated by functions that modify (1) search_path or (2) a prepared statement, a related issue to CVE-2007-6600 and CVE-2009-3230.
CVSS Details
- CVSS 3.1 Base Score: 6.3
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade postgresql-plUpgrade postgresql-contribUpgrade postgresql-tclUpgrade postgresql-docsUpgrade postgresql-develUpgrade postgresql-testUpgrade postgresql-serverUpgrade postgresql-libsUpgrade postgresql-jdbcUpgrade postgresqlUpgrade postgresql-python | Dec 1, 2016 | Dec 15, 2009 |
| Freebsd | — | Upgrade postgresql-serverUpgrade postgresql-client | Dec 10, 2025 | Dec 17, 2009 |
| Gentoo Linux | — | Upgrade dev-db/postgresql-server.Upgrade dev-db/postgresql-base.Upgrade dev-db/postgresql. | Oct 30, 2017 | Dec 15, 2009 |
| Oracle_linux | — | Upgrade postgresql-tclUpgrade postgresql-pythonUpgrade postgresql-plUpgrade postgresql-testUpgrade postgresqlUpgrade postgresql-libsUpgrade postgresql-develUpgrade postgresql-docsUpgrade postgresql-contribUpgrade postgresql-server | Oct 16, 2024 | Dec 15, 2009 |
| Postgres | — | Upgrade to PostgreSQL version 8.2.15Upgrade to PostgreSQL version 8.1.19Upgrade to PostgreSQL version 7.4.27Upgrade to PostgreSQL version 8.4.2Upgrade to PostgreSQL version 8.3.9Upgrade to PostgreSQL version 8.0.23 | Feb 24, 2013 | Dec 15, 2009 |
| Suse | — | Upgrade postgresql93-develUpgrade postgresql93-docsUpgrade postgresql94-docsUpgrade postgresql-contribUpgrade postgresql10-docsUpgrade postgresql10-serverUpgrade postgresql96-serverUpgrade postgresql-docsUpgrade postgresql10Upgrade postgresql94-contribUpgrade libpq5-32bitUpgrade postgresql-develUpgrade postgresql10-plperlUpgrade postgresql-libs-x86Upgrade postgresql91-contribUpgrade postgresql10-develUpgrade postgresql93Upgrade postgresql93-contribUpgrade postgresql91Upgrade libpq5Upgrade postgresql96Upgrade postgresql94-develUpgrade postgresql91-docsUpgrade postgresql10-plpythonUpgrade postgresql-libsUpgrade postgresql-serverUpgrade postgresql-libs-32bitUpgrade postgresql10-pltclUpgrade postgresql91-serverUpgrade postgresql94Upgrade postgresql96-develUpgrade postgresql94-serverUpgrade libecpg6Upgrade postgresql96-contribUpgrade postgresql93-serverUpgrade postgresql10-contribUpgrade postgresql96-docsUpgrade postgresql | Feb 17, 2015 | Jun 28, 2013 |
| Ubuntu | — | Upgrade postgresql-8.4Upgrade postgresql-8.3Upgrade postgresql-8.1 | Nov 8, 2024 | Dec 15, 2009 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub