CREATE TRIGGER in PostgreSQL 8.3.x before 8.3.18, 8.4.x before 8.4.11, 9.0.x before 9.0.7, and 9.1.x before 9.1.3 does not properly check the execute permission for trigger functions marked SECURITY DEFINER, which allows remote authenticated users to execute otherwise restricted triggers on arbitrary data by installing the trigger on an attacker-owned table.
CVSS Details
- CVSS 3.1 Base Score: 6.3
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade postgresql84-contribUpgrade postgresql-docsUpgrade postgresql84-testUpgrade postgresql84-pltclUpgrade postgresql-pythonUpgrade postgresql84-pythonUpgrade postgresql-plpythonUpgrade postgresql-contribUpgrade postgresql84-serverUpgrade postgresql84-develUpgrade postgresql-tclUpgrade postgresql-develUpgrade postgresql-plUpgrade postgresql84-docsUpgrade postgresql84-tclUpgrade postgresql84Upgrade postgresql-libsUpgrade postgresql-plperlUpgrade postgresqlUpgrade postgresql84-plpythonUpgrade postgresql84-plperlUpgrade postgresql-pltclUpgrade postgresql-testUpgrade postgresql84-libsUpgrade postgresql-server | Dec 1, 2016 | Jul 18, 2012 |
| Freebsd | — | Upgrade postgresql-client | Dec 10, 2025 | Feb 28, 2012 |
| Gentoo Linux | — | Upgrade dev-db/postgresql-server. | Oct 30, 2017 | Jul 18, 2012 |
| Oracle_linux | — | Upgrade postgresql-testUpgrade postgresql84-plperlUpgrade postgresql-serverUpgrade postgresql84-plpythonUpgrade postgresql-plperlUpgrade postgresql-libsUpgrade postgresql-tclUpgrade postgresql-plUpgrade postgresql84-libsUpgrade postgresql-pythonUpgrade postgresqlUpgrade postgresql84-pythonUpgrade postgresql84Upgrade postgresql-develUpgrade postgresql84-develUpgrade postgresql84-tclUpgrade postgresql-docsUpgrade postgresql84-pltclUpgrade postgresql-contribUpgrade postgresql84-testUpgrade postgresql-pltclUpgrade postgresql84-serverUpgrade postgresql-plpythonUpgrade postgresql84-docsUpgrade postgresql84-contrib | Oct 16, 2024 | Jul 18, 2012 |
| Postgres | — | Upgrade to PostgreSQL version 9.0.7Upgrade to PostgreSQL version 8.4.11Upgrade to PostgreSQL version 8.3.18Upgrade to PostgreSQL version 9.1.3 | Feb 24, 2013 | Jul 18, 2012 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Feb 27, 2012 |
| Suse | — | Upgrade postgresql93Upgrade postgresql-develUpgrade postgresql94-docsUpgrade postgresql93-docsUpgrade postgresql93-develUpgrade postgresql10-pltclUpgrade postgresql96-docsUpgrade postgresql96-develUpgrade postgresql10-plperlUpgrade postgresql94-develUpgrade postgresql10-docsUpgrade postgresql94-contribUpgrade libpq5-32bitUpgrade postgresql10-contribUpgrade postgresql96-contribUpgrade postgresql10-develUpgrade postgresql-contribUpgrade postgresql94-serverUpgrade postgresql94Upgrade postgresqlUpgrade libpq5Upgrade postgresql93-contribUpgrade libecpg6Upgrade postgresql93-serverUpgrade postgresql10-serverUpgrade postgresql96Upgrade postgresql96-serverUpgrade postgresql-docsUpgrade postgresql-serverUpgrade postgresql10Upgrade postgresql10-plpython | Dec 12, 2013 | Jun 28, 2013 |
| Ubuntu | — | Upgrade postgresql-8.4Upgrade postgresql-9.1Upgrade postgresql-8.3 | Nov 8, 2024 | Jul 18, 2012 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub