High severity7.1NVD Advisory· Published Dec 9, 2016· Updated Jun 17, 2026

CVE-2016-5424

Description

PostgreSQL before 9.1.23, 9.2.x before 9.2.18, 9.3.x before 9.3.14, 9.4.x before 9.4.9, and 9.5.x before 9.5.4 might allow remote authenticated users with the CREATEDB or CREATEROLE role to gain superuser privileges via a (1) " (double quote), (2) \ (backslash), (3) carriage return, or (4) newline character in a (a) database or (b) role name that is mishandled during an administrative operation.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

PostgreSQL/PostgreSQL47 versions
cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*+ 46 more
- cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*range: <=9.1.22
- cpe:2.3:a:postgresql:postgresql:9.2:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:9.2.1:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:9.2.10:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:9.2.11:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:9.2.12:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:9.2.13:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:9.2.14:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:9.2.15:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:9.2.16:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:9.2.17:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:9.2.2:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:9.2.3:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:9.2.4:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:9.2.5:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:9.2.6:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:9.2.7:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:9.2.8:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:9.2.9:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:9.3:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:9.3.1:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:9.3.10:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:9.3.11:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:9.3.12:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:9.3.13:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:9.3.2:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:9.3.3:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:9.3.4:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:9.3.5:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:9.3.6:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:9.3.7:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:9.3.8:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:9.3.9:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:9.4:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:9.4.1:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:9.4.2:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:9.4.3:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:9.4.4:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:9.4.5:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:9.4.6:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:9.4.7:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:9.4.8:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:9.5:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:9.5.1:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:9.5.2:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:9.5.3:*:*:*:*:*:*:*
- (no CPE)range: <9.1.23, <9.2.18, <9.3.14, <9.4.9, <9.5.4
Debian/linux
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
osv-coords18 versions
pkg:rpm/opensuse/postgresql93&distro=openSUSE%20Tumbleweed pkg:rpm/opensuse/postgresql94&distro=openSUSE%20Tumbleweed pkg:rpm/opensuse/postgresql95&distro=openSUSE%20Tumbleweed pkg:rpm/suse/postgresql93&distro=SUSE%20Linux%20Enterprise%20Server%2012-LTSS pkg:rpm/suse/postgresql93&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012 pkg:rpm/suse/postgresql94&distro=SUSE%20Linux%20Enterprise%20Desktop%2012%20SP1 pkg:rpm/suse/postgresql94&distro=SUSE%20Linux%20Enterprise%20Server%2011%20SP4 pkg:rpm/suse/postgresql94&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP1 pkg:rpm/suse/postgresql94&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2011%20SP4 pkg:rpm/suse/postgresql94&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP1 pkg:rpm/suse/postgresql94&distro=SUSE%20Manager%202.1 pkg:rpm/suse/postgresql94-libs&distro=SUSE%20Linux%20Enterprise%20Desktop%2012%20SP1 pkg:rpm/suse/postgresql94-libs&distro=SUSE%20Linux%20Enterprise%20Server%2011%20SP4 pkg:rpm/suse/postgresql94-libs&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP1 pkg:rpm/suse/postgresql94-libs&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2011%20SP4 pkg:rpm/suse/postgresql94-libs&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP1 pkg:rpm/suse/postgresql94-libs&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2011%20SP4 pkg:rpm/suse/postgresql94-libs&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP1
< 9.3.15-1.1+ 17 more
- (no CPE)range: < 9.3.15-1.1
- (no CPE)range: < 9.4.10-1.1
- (no CPE)range: < 9.5.4-1.2
- (no CPE)range: < 9.3.14-19.2
- (no CPE)range: < 9.3.14-19.2
- (no CPE)range: < 9.4.9-14.1
- (no CPE)range: < 9.4.9-0.19.1
- (no CPE)range: < 9.4.9-14.1
- (no CPE)range: < 9.4.9-0.19.1
- (no CPE)range: < 9.4.9-14.1
- (no CPE)range: < 9.4.9-0.19.1
- (no CPE)range: < 9.4.9-14.1
- (no CPE)range: < 9.4.9-0.19.1
- (no CPE)range: < 9.4.9-14.1
- (no CPE)range: < 9.4.9-0.19.1
- (no CPE)range: < 9.4.9-14.1
- (no CPE)range: < 9.4.9-0.19.1
- (no CPE)range: < 9.4.9-14.1

Patches

Vulnerability mechanics

References

www.postgresql.org/about/news/1688/nvdPatchThird Party AdvisoryVDB Entry
www.debian.org/security/2016/dsa-3646nvdThird Party Advisory
www.securityfocus.com/bid/92435nvdThird Party AdvisoryVDB Entry
www.securitytracker.com/id/1036617nvdThird Party AdvisoryVDB Entry
www.postgresql.org/docs/current/static/release-9-1-23.htmlnvdRelease NotesVendor Advisory
www.postgresql.org/docs/current/static/release-9-2-18.htmlnvdRelease NotesVendor Advisory
www.postgresql.org/docs/current/static/release-9-3-14.htmlnvdRelease NotesVendor Advisory
www.postgresql.org/docs/current/static/release-9-4-9.htmlnvdRelease NotesVendor Advisory
www.postgresql.org/docs/current/static/release-9-5-4.htmlnvdRelease NotesVendor Advisory
rhn.redhat.com/errata/RHSA-2016-1781.htmlnvd
rhn.redhat.com/errata/RHSA-2016-1820.htmlnvd
rhn.redhat.com/errata/RHSA-2016-1821.htmlnvd
rhn.redhat.com/errata/RHSA-2016-2606.htmlnvd
access.redhat.com/errata/RHSA-2017:2425nvd
security.gentoo.org/glsa/201701-33nvd

News mentions

No linked articles in our index yet.

cvss	0.461
epss	0.004
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000