PostgreSQL 8.2 before 8.2.6, 8.1 before 8.1.11, 8.0 before 8.0.15, 7.4 before 7.4.19, and 7.3 before 7.3.21 uses superuser privileges instead of table owner privileges for (1) VACUUM and (2) ANALYZE operations within index functions, and supports (3) SET ROLE and (4) SET SESSION AUTHORIZATION within index functions, which allows remote authenticated users to gain privileges.
CVSS Details
- CVSS 3.1 Base Score: 8.8
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Freebsd | — | Upgrade postgresqlUpgrade postgresql-server | Dec 10, 2025 | Apr 24, 2008 |
| Gentoo Linux | — | Upgrade dev-db/postgresql. | Oct 30, 2017 | Jan 9, 2008 |
| Oracle_linux | — | Upgrade postgresql-develUpgrade postgresql-contribUpgrade postgresql-docsUpgrade postgresql-libsUpgrade postgresql-tclUpgrade postgresql-pythonUpgrade postgresql-plUpgrade postgresql-testUpgrade postgresql-serverUpgrade postgresql | Oct 16, 2024 | Jan 9, 2008 |
| Suse | — | Upgrade postgresql93-docsUpgrade postgresql-docsUpgrade postgresqlUpgrade postgresql94-contribUpgrade postgresql-libs-x86Upgrade postgresql10-serverUpgrade postgresql94Upgrade postgresql91-contribUpgrade postgresql96-serverUpgrade postgresql93Upgrade postgresql10-plperlUpgrade postgresql-libs-32bitUpgrade postgresql96Upgrade postgresql96-docsUpgrade postgresql94-serverUpgrade postgresql10-contribUpgrade postgresql96-contribUpgrade postgresql91Upgrade postgresql93-contribUpgrade postgresql-contribUpgrade postgresql-develUpgrade postgresql10-develUpgrade postgresql-serverUpgrade postgresql93-develUpgrade libpq5Upgrade libecpg6Upgrade postgresql10-plpythonUpgrade postgresql94-develUpgrade postgresql10Upgrade postgresql96-develUpgrade postgresql91-docsUpgrade postgresql93-serverUpgrade postgresql-libsUpgrade postgresql10-docsUpgrade postgresql94-docsUpgrade libpq5-32bitUpgrade postgresql91-serverUpgrade postgresql10-pltcl | Feb 17, 2015 | Jul 9, 2013 |
| Ubuntu | — | Upgrade postgresql-8.2Upgrade postgresql-pltcl-8.2Upgrade postgresql-8.1Upgrade postgresql-pltcl-8.1 | Nov 8, 2024 | Jan 9, 2008 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub