The PL/Tcl implementation in PostgreSQL 7.4 before 7.4.29, 8.0 before 8.0.25, 8.1 before 8.1.21, 8.2 before 8.2.17, 8.3 before 8.3.11, 8.4 before 8.4.4, and 9.0 Beta before 9.0 Beta 2 loads Tcl code from the pltcl_modules table regardless of the table's ownership and permissions, which allows remote authenticated users, with database-creation privileges, to execute arbitrary Tcl code by creating this table and inserting a crafted Tcl script.
CVSS Details
- CVSS 3.1 Base Score: 8.8
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade postgresql84-pythonUpgrade postgresql84-pltclUpgrade postgresql84-libsUpgrade postgresql-testUpgrade postgresql84-docsUpgrade postgresqlUpgrade postgresql84-plperlUpgrade postgresql-pythonUpgrade postgresql-tclUpgrade postgresql84-tclUpgrade postgresql84-serverUpgrade postgresql-plUpgrade postgresql-jdbcUpgrade postgresql-serverUpgrade postgresql84-plpythonUpgrade postgresql84Upgrade postgresql-libsUpgrade postgresql-docsUpgrade postgresql84-develUpgrade postgresql-contribUpgrade postgresql-develUpgrade postgresql84-testUpgrade postgresql84-contrib | Dec 1, 2016 | May 19, 2010 |
| Gentoo Linux | — | Upgrade dev-db/postgresql-base.Upgrade dev-db/postgresql.Upgrade dev-db/postgresql-server. | Oct 30, 2017 | May 19, 2010 |
| Oracle_linux | — | Upgrade postgresql-develUpgrade postgresql84-develUpgrade postgresql84-pltclUpgrade postgresql-pythonUpgrade postgresql84-pythonUpgrade postgresql84-serverUpgrade postgresql84-tclUpgrade postgresql84-contribUpgrade postgresql-contribUpgrade postgresql84-libsUpgrade postgresql-plUpgrade postgresqlUpgrade postgresql-serverUpgrade postgresql84-testUpgrade postgresql-tclUpgrade postgresql84-plpythonUpgrade postgresql84-docsUpgrade postgresql-docsUpgrade postgresql-libsUpgrade postgresql84Upgrade postgresql-testUpgrade postgresql84-plperl | Oct 16, 2024 | May 19, 2010 |
| Postgres | — | Upgrade to PostgreSQL version 8.1.21Upgrade to PostgreSQL version 8.2.17Upgrade to PostgreSQL version 8.3.11Upgrade to PostgreSQL version 8.0.25Upgrade to PostgreSQL version 8.4.4Upgrade to PostgreSQL version 7.4.29 | Feb 24, 2013 | May 19, 2010 |
| Redhat_linux | — | No solution exists | Jul 16, 2026 | May 17, 2010 |
| Suse | — | Upgrade postgresql94-docsUpgrade postgresql10-contribUpgrade libecpg6Upgrade postgresql-libs-32bitUpgrade postgresql-contribUpgrade postgresql91-serverUpgrade postgresql94Upgrade postgresql10-serverUpgrade postgresql94-contribUpgrade postgresql96Upgrade postgresql-develUpgrade postgresql91-docsUpgrade libpq5-32bitUpgrade postgresql10-develUpgrade postgresql10-docsUpgrade postgresql10Upgrade postgresql96-contribUpgrade postgresql93-develUpgrade postgresql94-serverUpgrade postgresql96-serverUpgrade postgresql94-develUpgrade postgresql93-docsUpgrade postgresql-libs-x86Upgrade postgresql93-contribUpgrade postgresql93Upgrade postgresql-docsUpgrade postgresql96-develUpgrade postgresqlUpgrade postgresql-libsUpgrade postgresql93-serverUpgrade postgresql91-contribUpgrade postgresql91Upgrade libpq5Upgrade postgresql10-plpythonUpgrade postgresql10-pltclUpgrade postgresql-serverUpgrade postgresql96-docsUpgrade postgresql10-plperl | Feb 17, 2015 | Jun 28, 2013 |
| Ubuntu | — | Upgrade postgresql-plperl-8.3Upgrade postgresql-pltcl-8.4Upgrade postgresql-plperl-8.4Upgrade postgresql-pltcl-8.3Upgrade postgresql-plperl-8.1Upgrade postgresql-pltcl-8.1 | Nov 8, 2024 | May 19, 2010 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub