Integer overflow in src/backend/executor/nodeHash.c in PostgreSQL 8.4.1 and earlier, and 8.5 through 8.5alpha2, allows remote authenticated users to cause a denial of service (daemon crash) via a SELECT statement with many LEFT JOIN clauses, related to certain hashtable size calculations.
CVSS Details
- CVSS 3.1 Base Score: 6.5
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade postgresql-contribUpgrade postgresql-docsUpgrade postgresql-develUpgrade postgresql-tclUpgrade postgresql-plUpgrade postgresql-testUpgrade postgresql-pythonUpgrade postgresqlUpgrade postgresql-libsUpgrade postgresql-jdbcUpgrade postgresql-server | Dec 1, 2016 | Mar 19, 2010 |
| Gentoo Linux | — | Upgrade dev-db/postgresql-base.Upgrade dev-db/postgresql-server.Upgrade dev-db/postgresql. | Oct 30, 2017 | Mar 19, 2010 |
| Oracle_linux | — | Upgrade postgresql-contribUpgrade postgresql-plUpgrade postgresqlUpgrade postgresql-testUpgrade postgresql-serverUpgrade postgresql-pythonUpgrade postgresql-libsUpgrade postgresql-develUpgrade postgresql-tclUpgrade postgresql-docs | Oct 16, 2024 | Mar 19, 2010 |
| Suse | — | Upgrade postgresql-libs-32bitUpgrade postgresql-libs-x86Upgrade postgresql-contribUpgrade postgresql-docsUpgrade postgresql-serverUpgrade postgresqlUpgrade postgresql-libs | Feb 17, 2015 | Jun 28, 2013 |
| Ubuntu | — | Upgrade postgresql-8.3Upgrade postgresql-8.1Upgrade postgresql-8.4 | Nov 19, 2024 | Mar 19, 2010 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub