The PL/Tcl implementation in PostgreSQL 7.4 before 7.4.29, 8.0 before 8.0.25, 8.1 before 8.1.21, 8.2 before 8.2.17, 8.3 before 8.3.11, 8.4 before 8.4.4, and 9.0 Beta before 9.0 Beta 2 loads Tcl code from the pltcl_modules table regardless of the table's ownership and permissions, which allows remote authenticated users, with database-creation privileges, to execute arbitrary Tcl code by creating this table and inserting a crafted Tcl script.
CVSS Details
- CVSS 3.1 Base Score: 8.8
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade postgresql84-plperlUpgrade postgresql-plUpgrade postgresql84-pythonUpgrade postgresql84-libsUpgrade postgresql84-tclUpgrade postgresql84-docsUpgrade postgresql-serverUpgrade postgresql-pythonUpgrade postgresql-tclUpgrade postgresql84-pltclUpgrade postgresql84-serverUpgrade postgresqlUpgrade postgresql-testUpgrade postgresql-jdbcUpgrade postgresql84-develUpgrade postgresql-docsUpgrade postgresql-libsUpgrade postgresql84-testUpgrade postgresql84-plpythonUpgrade postgresql84Upgrade postgresql-develUpgrade postgresql-contribUpgrade postgresql84-contrib | Dec 1, 2016 | May 19, 2010 |
| Gentoo Linux | — | Upgrade dev-db/postgresql.Upgrade dev-db/postgresql-server.Upgrade dev-db/postgresql-base. | Oct 30, 2017 | May 19, 2010 |
| Oracle_linux | — | Upgrade postgresql-serverUpgrade postgresql84Upgrade postgresqlUpgrade postgresql-tclUpgrade postgresql84-testUpgrade postgresql-testUpgrade postgresql-docsUpgrade postgresql84-docsUpgrade postgresql-libsUpgrade postgresql84-plpythonUpgrade postgresql84-plperlUpgrade postgresql84-pythonUpgrade postgresql-develUpgrade postgresql-plUpgrade postgresql84-libsUpgrade postgresql84-serverUpgrade postgresql84-develUpgrade postgresql84-contribUpgrade postgresql-contribUpgrade postgresql-pythonUpgrade postgresql84-pltclUpgrade postgresql84-tcl | Oct 16, 2024 | May 19, 2010 |
| Postgres | — | Upgrade to PostgreSQL version 8.0.25Upgrade to PostgreSQL version 8.2.17Upgrade to PostgreSQL version 8.4.4Upgrade to PostgreSQL version 8.1.21Upgrade to PostgreSQL version 8.3.11Upgrade to PostgreSQL version 7.4.29 | Feb 24, 2013 | May 19, 2010 |
| Redhat_linux | — | No solution exists | Jul 16, 2026 | May 17, 2010 |
| Suse | — | Upgrade postgresql-contribUpgrade postgresql10-docsUpgrade postgresql94Upgrade postgresql-libs-32bitUpgrade postgresql96Upgrade postgresql94-docsUpgrade libecpg6Upgrade postgresql10-serverUpgrade postgresql10-contribUpgrade postgresql10-develUpgrade postgresql94-contribUpgrade postgresql91-docsUpgrade postgresql10Upgrade postgresql91-serverUpgrade libpq5-32bitUpgrade postgresql-develUpgrade postgresql-docsUpgrade postgresql94-serverUpgrade postgresql-libs-x86Upgrade postgresql93-contribUpgrade postgresql-serverUpgrade postgresql96-contribUpgrade postgresqlUpgrade postgresql91Upgrade postgresql93-serverUpgrade postgresql10-plperlUpgrade postgresql93Upgrade libpq5Upgrade postgresql91-contribUpgrade postgresql96-docsUpgrade postgresql93-develUpgrade postgresql93-docsUpgrade postgresql96-serverUpgrade postgresql96-develUpgrade postgresql10-plpythonUpgrade postgresql94-develUpgrade postgresql-libsUpgrade postgresql10-pltcl | Feb 17, 2015 | Jun 28, 2013 |
| Ubuntu | — | Upgrade postgresql-plperl-8.4Upgrade postgresql-pltcl-8.4Upgrade postgresql-pltcl-8.3Upgrade postgresql-plperl-8.1Upgrade postgresql-pltcl-8.1Upgrade postgresql-plperl-8.3 | Nov 8, 2024 | May 19, 2010 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub