The PL/Tcl implementation in PostgreSQL 7.4 before 7.4.29, 8.0 before 8.0.25, 8.1 before 8.1.21, 8.2 before 8.2.17, 8.3 before 8.3.11, 8.4 before 8.4.4, and 9.0 Beta before 9.0 Beta 2 loads Tcl code from the pltcl_modules table regardless of the table's ownership and permissions, which allows remote authenticated users, with database-creation privileges, to execute arbitrary Tcl code by creating this table and inserting a crafted Tcl script.
CVSS Details
- CVSS 3.1 Base Score: 8.8
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade postgresql84-develUpgrade postgresql-docsUpgrade postgresql-contribUpgrade postgresql84-testUpgrade postgresql-develUpgrade postgresql-libsUpgrade postgresql84-plpythonUpgrade postgresql84-contribUpgrade postgresql84Upgrade postgresql84-pltclUpgrade postgresql-tclUpgrade postgresql-testUpgrade postgresql84-libsUpgrade postgresql-serverUpgrade postgresql84-plperlUpgrade postgresql84-pythonUpgrade postgresql84-docsUpgrade postgresqlUpgrade postgresql84-tclUpgrade postgresql-pythonUpgrade postgresql-jdbcUpgrade postgresql84-serverUpgrade postgresql-pl | Dec 1, 2016 | May 19, 2010 |
| Gentoo Linux | — | Upgrade dev-db/postgresql-server.Upgrade dev-db/postgresql.Upgrade dev-db/postgresql-base. | Oct 30, 2017 | May 19, 2010 |
| Oracle_linux | — | Upgrade postgresql84-testUpgrade postgresql84-docsUpgrade postgresql84-plpythonUpgrade postgresql-docsUpgrade postgresql-libsUpgrade postgresql-serverUpgrade postgresql-tclUpgrade postgresql-testUpgrade postgresql84Upgrade postgresqlUpgrade postgresql84-plperlUpgrade postgresql-contribUpgrade postgresql-pythonUpgrade postgresql84-develUpgrade postgresql84-serverUpgrade postgresql84-contribUpgrade postgresql84-libsUpgrade postgresql84-pythonUpgrade postgresql-develUpgrade postgresql-plUpgrade postgresql84-tclUpgrade postgresql84-pltcl | Oct 16, 2024 | May 19, 2010 |
| Postgres | — | Upgrade to PostgreSQL version 8.2.17Upgrade to PostgreSQL version 8.4.4Upgrade to PostgreSQL version 8.3.11Upgrade to PostgreSQL version 8.1.21Upgrade to PostgreSQL version 8.0.25Upgrade to PostgreSQL version 7.4.29 | Feb 24, 2013 | May 19, 2010 |
| Redhat_linux | — | No solution exists | Jul 16, 2026 | May 17, 2010 |
| Suse | — | Upgrade postgresql91Upgrade postgresql96-develUpgrade postgresql93Upgrade postgresql10-plperlUpgrade postgresql96-docsUpgrade postgresql96-serverUpgrade postgresql93-serverUpgrade postgresql-libsUpgrade postgresql93-docsUpgrade postgresql93-contribUpgrade postgresql10-plpythonUpgrade postgresql91-contribUpgrade postgresqlUpgrade postgresql96-contribUpgrade libpq5Upgrade postgresql-docsUpgrade postgresql-libs-x86Upgrade postgresql94-serverUpgrade postgresql-serverUpgrade postgresql94-develUpgrade postgresql10-pltclUpgrade postgresql93-develUpgrade postgresql94Upgrade libecpg6Upgrade postgresql-develUpgrade postgresql-contribUpgrade postgresql91-docsUpgrade postgresql10-develUpgrade postgresql91-serverUpgrade postgresql96Upgrade postgresql94-docsUpgrade postgresql10-serverUpgrade postgresql94-contribUpgrade postgresql-libs-32bitUpgrade postgresql10-contribUpgrade postgresql10-docsUpgrade libpq5-32bitUpgrade postgresql10 | Feb 17, 2015 | Jun 28, 2013 |
| Ubuntu | — | Upgrade postgresql-plperl-8.3Upgrade postgresql-plperl-8.1Upgrade postgresql-pltcl-8.3Upgrade postgresql-pltcl-8.4Upgrade postgresql-pltcl-8.1Upgrade postgresql-plperl-8.4 | Nov 8, 2024 | May 19, 2010 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub