PostgreSQL 7.4.x before 7.4.27, 8.0.x before 8.0.23, 8.1.x before 8.1.19, 8.2.x before 8.2.15, 8.3.x before 8.3.9, and 8.4.x before 8.4.2 does not properly manage session-local state during execution of an index function by a database superuser, which allows remote authenticated users to gain privileges via a table with crafted index functions, as demonstrated by functions that modify (1) search_path or (2) a prepared statement, a related issue to CVE-2007-6600 and CVE-2009-3230.
CVSS Details
- CVSS 3.1 Base Score: 6.3
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade postgresql-pythonUpgrade postgresql-libsUpgrade postgresql-testUpgrade postgresqlUpgrade postgresql-jdbcUpgrade postgresql-serverUpgrade postgresql-develUpgrade postgresql-docsUpgrade postgresql-contribUpgrade postgresql-plUpgrade postgresql-tcl | Dec 1, 2016 | Dec 15, 2009 |
| Freebsd | — | Upgrade postgresql-clientUpgrade postgresql-server | Dec 10, 2025 | Dec 17, 2009 |
| Gentoo Linux | — | Upgrade dev-db/postgresql.Upgrade dev-db/postgresql-base.Upgrade dev-db/postgresql-server. | Oct 30, 2017 | Dec 15, 2009 |
| Oracle_linux | — | Upgrade postgresqlUpgrade postgresql-libsUpgrade postgresql-testUpgrade postgresql-contribUpgrade postgresql-develUpgrade postgresql-docsUpgrade postgresql-serverUpgrade postgresql-pythonUpgrade postgresql-plUpgrade postgresql-tcl | Oct 16, 2024 | Dec 15, 2009 |
| Postgres | — | Upgrade to PostgreSQL version 7.4.27Upgrade to PostgreSQL version 8.2.15Upgrade to PostgreSQL version 8.1.19Upgrade to PostgreSQL version 8.4.2Upgrade to PostgreSQL version 8.3.9Upgrade to PostgreSQL version 8.0.23 | Feb 24, 2013 | Dec 15, 2009 |
| Suse | — | Upgrade postgresql-libsUpgrade postgresql-plpythonUpgrade postgresql-libs-32bitUpgrade postgresql-plUpgrade postgresql-serverUpgrade postgresqlUpgrade postgresql-plperlUpgrade postgresql-pltclUpgrade postgresql-libs-64bitUpgrade postgresql-docsUpgrade postgresql-develUpgrade postgresql-libs-x86Upgrade postgresql-contribUpgrade sap-aio-release | Feb 17, 2015 | Dec 15, 2009 |
| Ubuntu | — | Upgrade postgresql-8.3Upgrade postgresql-8.4Upgrade postgresql-8.1 | Nov 8, 2024 | Dec 15, 2009 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub