PostgreSQL 7.4.x before 7.4.27, 8.0.x before 8.0.23, 8.1.x before 8.1.19, 8.2.x before 8.2.15, 8.3.x before 8.3.9, and 8.4.x before 8.4.2 does not properly manage session-local state during execution of an index function by a database superuser, which allows remote authenticated users to gain privileges via a table with crafted index functions, as demonstrated by functions that modify (1) search_path or (2) a prepared statement, a related issue to CVE-2007-6600 and CVE-2009-3230.
CVSS Details
- CVSS 3.1 Base Score: 6.3
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade postgresql-docsUpgrade postgresql-plUpgrade postgresql-develUpgrade postgresql-contribUpgrade postgresql-tclUpgrade postgresql-serverUpgrade postgresqlUpgrade postgresql-testUpgrade postgresql-pythonUpgrade postgresql-jdbcUpgrade postgresql-libs | Dec 1, 2016 | Dec 15, 2009 |
| Freebsd | — | Upgrade postgresql-serverUpgrade postgresql-client | Dec 10, 2025 | Dec 17, 2009 |
| Gentoo Linux | — | Upgrade dev-db/postgresql-server.Upgrade dev-db/postgresql.Upgrade dev-db/postgresql-base. | Oct 30, 2017 | Dec 15, 2009 |
| Oracle_linux | — | Upgrade postgresql-develUpgrade postgresql-libsUpgrade postgresql-serverUpgrade postgresqlUpgrade postgresql-docsUpgrade postgresql-testUpgrade postgresql-contribUpgrade postgresql-tclUpgrade postgresql-plUpgrade postgresql-python | Oct 16, 2024 | Dec 15, 2009 |
| Postgres | — | Upgrade to PostgreSQL version 7.4.27Upgrade to PostgreSQL version 8.1.19Upgrade to PostgreSQL version 8.2.15Upgrade to PostgreSQL version 8.4.2Upgrade to PostgreSQL version 8.3.9Upgrade to PostgreSQL version 8.0.23 | Feb 24, 2013 | Dec 15, 2009 |
| Suse | — | Upgrade postgresql93-serverUpgrade postgresql94-develUpgrade postgresql94-serverUpgrade postgresql-serverUpgrade postgresql10-pltclUpgrade postgresql91Upgrade postgresql-libsUpgrade postgresql91-docsUpgrade postgresql91-serverUpgrade postgresql10-plpythonUpgrade libpq5Upgrade postgresql94Upgrade libecpg6Upgrade postgresql96-develUpgrade postgresql96-docsUpgrade postgresqlUpgrade postgresql-libs-32bitUpgrade postgresql10-contribUpgrade postgresql96-contribUpgrade postgresql96Upgrade postgresql93-docsUpgrade postgresql10Upgrade postgresql93-develUpgrade postgresql91-contribUpgrade postgresql-develUpgrade postgresql93Upgrade postgresql10-develUpgrade postgresql-contribUpgrade postgresql-docsUpgrade postgresql10-plperlUpgrade postgresql93-contribUpgrade libpq5-32bitUpgrade postgresql96-serverUpgrade postgresql-libs-x86Upgrade postgresql94-docsUpgrade postgresql10-serverUpgrade postgresql10-docsUpgrade postgresql94-contrib | Feb 17, 2015 | Jun 28, 2013 |
| Ubuntu | — | Upgrade postgresql-8.3Upgrade postgresql-8.4Upgrade postgresql-8.1 | Nov 8, 2024 | Dec 15, 2009 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub