rpm package
suse/postgresql94-libs&distro=SUSE Linux Enterprise Server 11 SP3-TERADATA
pkg:rpm/suse/postgresql94-libs&distro=SUSE%20Linux%20Enterprise%20Server%2011%20SP3-TERADATA
Vulnerabilities (5)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2017-7548 | Hig | 7.5 | < 9.4.13-0.23.5.1 | 9.4.13-0.23.5.1 | Aug 16, 2017 | PostgreSQL versions before 9.4.13, 9.5.8 and 9.6.4 are vulnerable to authorization flaw allowing remote authenticated attackers with no privileges on a large object to overwrite the entire contents of the object, resulting in a denial of service. | |
| CVE-2017-7547 | Hig | 8.8 | < 9.4.13-0.23.5.1 | 9.4.13-0.23.5.1 | Aug 16, 2017 | PostgreSQL versions before 9.2.22, 9.3.18, 9.4.13, 9.5.8 and 9.6.4 are vulnerable to authorization flaw allowing remote authenticated attackers to retrieve passwords from the user mappings defined by the foreign server owners without actually having the privileges to do so. | |
| CVE-2017-7546 | Cri | 9.8 | < 9.4.13-0.23.5.1 | 9.4.13-0.23.5.1 | Aug 16, 2017 | PostgreSQL versions before 9.2.22, 9.3.18, 9.4.13, 9.5.8 and 9.6.4 are vulnerable to incorrect authentication flaw allowing remote attackers to gain access to database accounts with an empty password. | |
| CVE-2015-5289 | — | < 9.4.5-0.8.3 | 9.4.5-0.8.3 | Oct 26, 2015 | Multiple stack-based buffer overflows in json parsing in PostgreSQL before 9.3.x before 9.3.10 and 9.4.x before 9.4.5 allow attackers to cause a denial of service (server crash) via unspecified vectors, which are not properly handled in (1) json or (2) jsonb values. | ||
| CVE-2015-5288 | — | < 9.4.5-0.8.3 | 9.4.5-0.8.3 | Oct 26, 2015 | The crypt function in contrib/pgcrypto in PostgreSQL before 9.0.23, 9.1.x before 9.1.19, 9.2.x before 9.2.14, 9.3.x before 9.3.10, and 9.4.x before 9.4.5 allows attackers to cause a denial of service (server crash) or read arbitrary server memory via a "too-short" salt. |
- affected < 9.4.13-0.23.5.1fixed 9.4.13-0.23.5.1
PostgreSQL versions before 9.4.13, 9.5.8 and 9.6.4 are vulnerable to authorization flaw allowing remote authenticated attackers with no privileges on a large object to overwrite the entire contents of the object, resulting in a denial of service.
- affected < 9.4.13-0.23.5.1fixed 9.4.13-0.23.5.1
PostgreSQL versions before 9.2.22, 9.3.18, 9.4.13, 9.5.8 and 9.6.4 are vulnerable to authorization flaw allowing remote authenticated attackers to retrieve passwords from the user mappings defined by the foreign server owners without actually having the privileges to do so.
- affected < 9.4.13-0.23.5.1fixed 9.4.13-0.23.5.1
PostgreSQL versions before 9.2.22, 9.3.18, 9.4.13, 9.5.8 and 9.6.4 are vulnerable to incorrect authentication flaw allowing remote attackers to gain access to database accounts with an empty password.
- CVE-2015-5289Oct 26, 2015affected < 9.4.5-0.8.3fixed 9.4.5-0.8.3
Multiple stack-based buffer overflows in json parsing in PostgreSQL before 9.3.x before 9.3.10 and 9.4.x before 9.4.5 allow attackers to cause a denial of service (server crash) via unspecified vectors, which are not properly handled in (1) json or (2) jsonb values.
- CVE-2015-5288Oct 26, 2015affected < 9.4.5-0.8.3fixed 9.4.5-0.8.3
The crypt function in contrib/pgcrypto in PostgreSQL before 9.0.23, 9.1.x before 9.1.19, 9.2.x before 9.2.14, 9.3.x before 9.3.10, and 9.4.x before 9.4.5 allows attackers to cause a denial of service (server crash) or read arbitrary server memory via a "too-short" salt.