Integer overflow in src/backend/executor/nodeHash.c in PostgreSQL 8.4.1 and earlier, and 8.5 through 8.5alpha2, allows remote authenticated users to cause a denial of service (daemon crash) via a SELECT statement with many LEFT JOIN clauses, related to certain hashtable size calculations.
CVSS Details
- CVSS 3.1 Base Score: 6.5
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade postgresql-contribUpgrade postgresql-docsUpgrade postgresql-develUpgrade postgresql-serverUpgrade postgresql-pythonUpgrade postgresql-libsUpgrade postgresqlUpgrade postgresql-jdbcUpgrade postgresql-plUpgrade postgresql-tclUpgrade postgresql-test | Dec 1, 2016 | Mar 19, 2010 |
| Gentoo Linux | — | Upgrade dev-db/postgresql.Upgrade dev-db/postgresql-server.Upgrade dev-db/postgresql-base. | Oct 30, 2017 | Mar 19, 2010 |
| Oracle_linux | — | Upgrade postgresqlUpgrade postgresql-develUpgrade postgresql-plUpgrade postgresql-serverUpgrade postgresql-pythonUpgrade postgresql-contribUpgrade postgresql-testUpgrade postgresql-libsUpgrade postgresql-docsUpgrade postgresql-tcl | Oct 16, 2024 | Mar 19, 2010 |
| Suse | — | Upgrade postgresql-libs-32bitUpgrade postgresql-libs-x86Upgrade postgresql-serverUpgrade postgresql-contribUpgrade postgresqlUpgrade postgresql-docsUpgrade postgresql-libs | Feb 17, 2015 | Jun 28, 2013 |
| Ubuntu | — | Upgrade postgresql-8.3Upgrade postgresql-8.1Upgrade postgresql-8.4 | Nov 19, 2024 | Mar 19, 2010 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub