The PL/perl and PL/Tcl implementations in PostgreSQL 7.4 before 7.4.30, 8.0 before 8.0.26, 8.1 before 8.1.22, 8.2 before 8.2.18, 8.3 before 8.3.12, 8.4 before 8.4.5, and 9.0 before 9.0.1 do not properly protect script execution by a different SQL user identity within the same session, which allows remote authenticated users to gain privileges via crafted script code in a SECURITY DEFINER function, as demonstrated by (1) redefining standard functions or (2) redefining operators, a different vulnerability than CVE-2010-1168, CVE-2010-1169, CVE-2010-1170, and CVE-2010-1447.
CVSS Details
- CVSS 3.1 Base Score: 9.8
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade postgresql-serverUpgrade postgresql-docsUpgrade postgresql-pythonUpgrade postgresql84-plperlUpgrade postgresql84-plpythonUpgrade postgresql-plUpgrade postgresql-jdbcUpgrade postgresql84Upgrade postgresql-testUpgrade postgresql-libsUpgrade postgresqlUpgrade postgresql84-pythonUpgrade postgresql84-libsUpgrade postgresql84-pltclUpgrade postgresql84-tclUpgrade postgresql-develUpgrade postgresql84-contribUpgrade postgresql-tclUpgrade postgresql-contribUpgrade postgresql84-docsUpgrade postgresql84-serverUpgrade postgresql84-testUpgrade postgresql84-devel | Dec 1, 2016 | Oct 6, 2010 |
| Gentoo Linux | — | Upgrade dev-db/postgresql-server.Upgrade dev-db/postgresql-base.Upgrade dev-db/postgresql. | Oct 30, 2017 | Oct 6, 2010 |
| Oracle_linux | — | Upgrade postgresql-docsUpgrade postgresql84-plpythonUpgrade postgresql-tclUpgrade postgresql-develUpgrade postgresql84Upgrade postgresql84-testUpgrade postgresql84-contribUpgrade postgresql-libsUpgrade postgresql84-libsUpgrade postgresql84-plperlUpgrade postgresqlUpgrade postgresql84-serverUpgrade postgresql-plUpgrade postgresql84-tclUpgrade postgresql84-develUpgrade postgresql-pythonUpgrade postgresql84-docsUpgrade postgresql-contribUpgrade postgresql-testUpgrade postgresql84-pltclUpgrade postgresql-serverUpgrade postgresql84-python | Oct 16, 2024 | Oct 6, 2010 |
| Postgres | — | Upgrade to PostgreSQL version 8.4.5Upgrade to PostgreSQL version 8.2.18Upgrade to PostgreSQL version 9.0.1Upgrade to PostgreSQL version 7.4.30Upgrade to PostgreSQL version 8.0.26Upgrade to PostgreSQL version 8.3.12Upgrade to PostgreSQL version 8.1.22 | Feb 24, 2013 | Oct 6, 2010 |
| Redhat_linux | — | — | Jul 9, 2025 | Oct 5, 2010 |
| Suse | — | Upgrade postgresql10-pltclUpgrade postgresql96-develUpgrade postgresql-docsUpgrade postgresql94-docsUpgrade postgresql10-plperlUpgrade postgresql91Upgrade postgresql91-docsUpgrade postgresql94-develUpgrade postgresql10-develUpgrade postgresql-libs-32bitUpgrade postgresql96-docsUpgrade postgresql94Upgrade postgresql-contribUpgrade postgresql96-contribUpgrade postgresql96Upgrade postgresql10-docsUpgrade postgresql-libs-x86Upgrade libecpg6Upgrade libpq5-32bitUpgrade postgresql94-contribUpgrade postgresql93-docsUpgrade postgresql-develUpgrade postgresql10-plpythonUpgrade postgresql91-serverUpgrade postgresql93-develUpgrade postgresql91-contribUpgrade postgresql-libsUpgrade postgresql-serverUpgrade postgresql93-contribUpgrade postgresql93Upgrade postgresql10Upgrade postgresql93-serverUpgrade postgresql94-serverUpgrade postgresql10-contribUpgrade libpq5Upgrade postgresqlUpgrade postgresql10-serverUpgrade postgresql96-server | Feb 17, 2015 | Jun 28, 2013 |
| Ubuntu | — | Upgrade postgresql-plperl-8.3Upgrade postgresql-pltcl-8.1Upgrade postgresql-pltcl-8.4Upgrade postgresql-pltcl-8.3Upgrade postgresql-plperl-8.4Upgrade postgresql-plperl-8.1 | Nov 8, 2024 | Oct 6, 2010 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub