Unrated severityNVD Advisory· Published Dec 15, 2009· Updated Jun 16, 2026
CVE-2009-4136
CVE-2009-4136
Description
PostgreSQL 7.4.x before 7.4.27, 8.0.x before 8.0.23, 8.1.x before 8.1.19, 8.2.x before 8.2.15, 8.3.x before 8.3.9, and 8.4.x before 8.4.2 does not properly manage session-local state during execution of an index function by a database superuser, which allows remote authenticated users to gain privileges via a table with crafted index functions, as demonstrated by functions that modify (1) search_path or (2) a prepared statement, a related issue to CVE-2007-6600 and CVE-2009-3230.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
96cpe:2.3:a:postgresql:postgresql:7.4.1:*:*:*:*:*:*:*+ 92 more
- cpe:2.3:a:postgresql:postgresql:7.4.1:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:7.4.10:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:7.4.11:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:7.4.12:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:7.4.13:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:7.4.14:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:7.4.15:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:7.4.16:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:7.4.17:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:7.4.18:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:7.4.19:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:7.4.2:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:7.4.20:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:7.4.21:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:7.4.22:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:7.4.23:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:7.4.24:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:7.4.25:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:7.4.26:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:7.4.3:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:7.4.4:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:7.4.5:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:7.4.6:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:7.4.7:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:7.4.8:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:7.4.9:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:8.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:8.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:8.0.10:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:8.0.11:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:8.0.12:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:8.0.13:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:8.0.14:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:8.0.15:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:8.0.16:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:8.0.17:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:8.0.18:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:8.0.19:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:8.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:8.0.20:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:8.0.21:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:8.0.22:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:8.0.3:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:8.0.4:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:8.0.5:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:8.0.6:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:8.0.7:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:8.0.8:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:8.0.9:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:8.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:8.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:8.1.10:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:8.1.11:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:8.1.12:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:8.1.13:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:8.1.14:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:8.1.15:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:8.1.16:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:8.1.17:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:8.1.18:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:8.1.2:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:8.1.3:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:8.1.4:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:8.1.5:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:8.1.6:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:8.1.7:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:8.1.8:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:8.1.9:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:8.2:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:8.2.1:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:8.2.10:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:8.2.11:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:8.2.12:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:8.2.13:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:8.2.14:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:8.2.2:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:8.2.3:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:8.2.4:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:8.2.5:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:8.2.6:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:8.2.7:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:8.2.8:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:8.2.9:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:8.3.1:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:8.3.2:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:8.3.3:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:8.3.4:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:8.3.5:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:8.3.6:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:8.3.7:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:8.3.8:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:8.4.1:*:*:*:*:*:*:*
- (no CPE)range: 7.4.x before 7.4.27, 8.0.x before 8.0.23, 8.1.x before 8.1.19, 8.2.x before 8.2.15, 8.3.x before 8.3.9, 8.4.x before 8.4.2
- osv-coords3 versionspkg:rpm/opensuse/postgresql93&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/postgresql94&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/postgresql95&distro=openSUSE%20Tumbleweed
< 9.3.15-1.1+ 2 more
- (no CPE)range: < 9.3.15-1.1
- (no CPE)range: < 9.4.10-1.1
- (no CPE)range: < 9.5.4-1.2
Patches
Vulnerability mechanics
References
26- www.postgresql.org/docs/current/static/release-7-4-27.htmlnvdPatchVendor Advisory
- www.postgresql.org/docs/current/static/release-8-0-23.htmlnvdPatchVendor Advisory
- www.postgresql.org/docs/current/static/release-8-1-19.htmlnvdPatchVendor Advisory
- www.postgresql.org/docs/current/static/release-8-2-15.htmlnvdPatchVendor Advisory
- www.postgresql.org/docs/current/static/release-8-3-9.htmlnvdPatchVendor Advisory
- www.postgresql.org/docs/current/static/release-8-4-2.htmlnvdPatchVendor Advisory
- bugzilla.redhat.com/show_bug.cginvdPatch
- www.postgresql.org/support/security.htmlnvdVendor Advisory
- lists.opensuse.org/opensuse-security-announce/2010-01/msg00007.htmlnvd
- marc.infonvd
- osvdb.org/61039nvd
- secunia.com/advisories/37663nvd
- secunia.com/advisories/39820nvd
- wiki.rpath.com/wiki/Advisories:rPSA-2010-0012nvd
- www.mandriva.com/security/advisoriesnvd
- www.redhat.com/support/errata/RHSA-2010-0427.htmlnvd
- www.redhat.com/support/errata/RHSA-2010-0428.htmlnvd
- www.redhat.com/support/errata/RHSA-2010-0429.htmlnvd
- www.securityfocus.com/archive/1/509917/100/0/threadednvd
- www.securityfocus.com/bid/37333nvd
- www.securitytracker.com/idnvd
- www.vupen.com/english/advisories/2009/3519nvd
- www.vupen.com/english/advisories/2010/1197nvd
- oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9358nvd
- www.redhat.com/archives/fedora-package-announce/2009-December/msg01035.htmlnvd
- www.redhat.com/archives/fedora-package-announce/2009-December/msg01056.htmlnvd
News mentions
0No linked articles in our index yet.