The bitsubstr function in backend/utils/adt/varbit.c in PostgreSQL 8.0.23, 8.1.11, and 8.3.8 allows remote authenticated users to cause a denial of service (daemon crash) or have unspecified other impact via vectors involving a negative integer in the third argument, as demonstrated by a SELECT statement that contains a call to the substring function for a bit string, related to an "overflow."
CVSS Details
- CVSS 3.1 Base Score: 8.8
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade postgresqlUpgrade postgresql-plUpgrade postgresql-pythonUpgrade postgresql-tclUpgrade postgresql-docsUpgrade postgresql-contribUpgrade postgresql-testUpgrade postgresql-libsUpgrade postgresql-develUpgrade postgresql-serverUpgrade postgresql-jdbc | Dec 1, 2016 | Feb 2, 2010 |
| Freebsd | — | Upgrade postgresql-server | Dec 10, 2025 | Mar 25, 2010 |
| Gentoo Linux | — | Upgrade dev-db/postgresql.Upgrade dev-db/postgresql-base.Upgrade dev-db/postgresql-server. | Oct 30, 2017 | Feb 2, 2010 |
| Oracle_linux | — | Upgrade postgresql-serverUpgrade postgresql-contribUpgrade postgresql-libsUpgrade postgresql-develUpgrade postgresqlUpgrade postgresql-docsUpgrade postgresql-pythonUpgrade postgresql-tclUpgrade postgresql-testUpgrade postgresql-pl | Oct 16, 2024 | Feb 2, 2010 |
| Suse | — | Upgrade postgresql-contribUpgrade postgresql-develUpgrade postgresql-libs-32bitUpgrade postgresqlUpgrade postgresql-serverUpgrade postgresql-libs-x86Upgrade postgresql-libsUpgrade postgresql-docs | Aug 9, 2024 | Jun 28, 2013 |
| Ubuntu | — | Upgrade postgresql-8.3Upgrade postgresql-8.4Upgrade postgresql-8.1 | Nov 8, 2024 | Feb 2, 2010 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub