rpm package
opensuse/postgresql11&distro=openSUSE Tumbleweed
pkg:rpm/opensuse/postgresql11&distro=openSUSE%20Tumbleweed
Vulnerabilities (28)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2020-1720 | — | < 11.13-1.3 | 11.13-1.3 | Mar 17, 2020 | A flaw was found in PostgreSQL's "ALTER ... DEPENDS ON EXTENSION", where sub-commands did not perform authorization checks. An authenticated attacker could use this flaw in certain configurations to perform drop objects such as function, triggers, et al., leading to database corr | ||
| CVE-2019-10208 | — | < 11.13-1.3 | 11.13-1.3 | Oct 29, 2019 | A flaw was discovered in postgresql versions 9.4.x before 9.4.24, 9.5.x before 9.5.19, 9.6.x before 9.6.15, 10.x before 10.10 and 11.x before 11.5 where arbitrary SQL statements can be executed given a suitable SECURITY DEFINER function. An attacker, with EXECUTE permission on th | ||
| CVE-2019-10209 | — | < 11.13-1.3 | 11.13-1.3 | Oct 29, 2019 | Postgresql, versions 11.x before 11.5, is vulnerable to a memory disclosure in cross-type comparison for hashed subplan. | ||
| CVE-2019-10130 | — | < 11.13-1.3 | 11.13-1.3 | Jul 30, 2019 | A vulnerability was found in PostgreSQL versions 11.x up to excluding 11.3, 10.x up to excluding 10.8, 9.6.x up to, excluding 9.6.13, 9.5.x up to, excluding 9.5.17. PostgreSQL maintains column statistics for tables. Certain statistics, such as histograms and lists of most common | ||
| CVE-2019-10129 | — | < 11.13-1.3 | 11.13-1.3 | Jul 30, 2019 | A vulnerability was found in postgresql versions 11.x prior to 11.3. Using a purpose-crafted insert to a partitioned table, an attacker can read arbitrary bytes of server memory. In the default configuration, any user can create a partitioned table suitable for this attack. (Expl | ||
| CVE-2019-10164 | — | < 11.13-1.3 | 11.13-1.3 | Jun 26, 2019 | PostgreSQL versions 10.x before 10.9 and versions 11.x before 11.4 are vulnerable to a stack-based buffer overflow. Any authenticated user can overflow a stack-based buffer by changing the user's own password to a purpose-crafted value. This often suffices to execute arbitrary co | ||
| CVE-2018-16850 | — | < 11.13-1.3 | 11.13-1.3 | Nov 13, 2018 | postgresql before versions 11.1, 10.6 is vulnerable to a to SQL injection in pg_upgrade and pg_dump via CREATE TRIGGER ... REFERENCING. Using a purpose-crafted trigger definition, an attacker can cause arbitrary SQL statements to run, with superuser privileges. | ||
| CVE-2018-10925 | Hig | 8.1 | < 11.13-1.3 | 11.13-1.3 | Aug 9, 2018 | It was discovered that PostgreSQL versions before 10.5, 9.6.10, 9.5.14, 9.4.19, and 9.3.24 failed to properly check authorization on certain statements involved with "INSERT ... ON CONFLICT DO UPDATE". An attacker with "CREATE TABLE" privileges could exploit this to read arbitrar |
- CVE-2020-1720Mar 17, 2020affected < 11.13-1.3fixed 11.13-1.3
A flaw was found in PostgreSQL's "ALTER ... DEPENDS ON EXTENSION", where sub-commands did not perform authorization checks. An authenticated attacker could use this flaw in certain configurations to perform drop objects such as function, triggers, et al., leading to database corr
- CVE-2019-10208Oct 29, 2019affected < 11.13-1.3fixed 11.13-1.3
A flaw was discovered in postgresql versions 9.4.x before 9.4.24, 9.5.x before 9.5.19, 9.6.x before 9.6.15, 10.x before 10.10 and 11.x before 11.5 where arbitrary SQL statements can be executed given a suitable SECURITY DEFINER function. An attacker, with EXECUTE permission on th
- CVE-2019-10209Oct 29, 2019affected < 11.13-1.3fixed 11.13-1.3
Postgresql, versions 11.x before 11.5, is vulnerable to a memory disclosure in cross-type comparison for hashed subplan.
- CVE-2019-10130Jul 30, 2019affected < 11.13-1.3fixed 11.13-1.3
A vulnerability was found in PostgreSQL versions 11.x up to excluding 11.3, 10.x up to excluding 10.8, 9.6.x up to, excluding 9.6.13, 9.5.x up to, excluding 9.5.17. PostgreSQL maintains column statistics for tables. Certain statistics, such as histograms and lists of most common
- CVE-2019-10129Jul 30, 2019affected < 11.13-1.3fixed 11.13-1.3
A vulnerability was found in postgresql versions 11.x prior to 11.3. Using a purpose-crafted insert to a partitioned table, an attacker can read arbitrary bytes of server memory. In the default configuration, any user can create a partitioned table suitable for this attack. (Expl
- CVE-2019-10164Jun 26, 2019affected < 11.13-1.3fixed 11.13-1.3
PostgreSQL versions 10.x before 10.9 and versions 11.x before 11.4 are vulnerable to a stack-based buffer overflow. Any authenticated user can overflow a stack-based buffer by changing the user's own password to a purpose-crafted value. This often suffices to execute arbitrary co
- CVE-2018-16850Nov 13, 2018affected < 11.13-1.3fixed 11.13-1.3
postgresql before versions 11.1, 10.6 is vulnerable to a to SQL injection in pg_upgrade and pg_dump via CREATE TRIGGER ... REFERENCING. Using a purpose-crafted trigger definition, an attacker can cause arbitrary SQL statements to run, with superuser privileges.
- affected < 11.13-1.3fixed 11.13-1.3
It was discovered that PostgreSQL versions before 10.5, 9.6.10, 9.5.14, 9.4.19, and 9.3.24 failed to properly check authorization on certain statements involved with "INSERT ... ON CONFLICT DO UPDATE". An attacker with "CREATE TABLE" privileges could exploit this to read arbitrar
Page 2 of 2