USN-2499-1

Dashboard / Vulnerabilities / USN-2499-1

USN-2499-1

Summary: postgresql-8.4, postgresql-9.1, postgresql-9.3, postgresql-9.4 vulnerabilities

Details: Stephen Frost discovered that PostgreSQL incorrectly displayed certain values in error messages. An authenticated user could gain access to seeing certain values, contrary to expected permissions. (CVE-2014-8161) Andres Freund, Peter Geoghegan and Noah Misch discovered that PostgreSQL incorrectly handled buffers in to_char functions. An authenticated attacker could possibly use this issue to cause PostgreSQL to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2015-0241) It was discovered that PostgreSQL incorrectly handled memory in the pgcrypto extension. An authenticated attacker could possibly use this issue to cause PostgreSQL to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2015-0243) Emil Lenngren discovered that PostgreSQL incorrectly handled extended protocol message reading. An authenticated attacker could possibly use this issue to cause PostgreSQL to crash, resulting in a denial of service, or possibly inject query messages. (CVE-2015-0244)

References: https://ubuntu.com/security/notices/USN-2499-1, https://ubuntu.com/security/CVE-2014-8161, https://ubuntu.com/security/CVE-2015-0241, https://ubuntu.com/security/CVE-2015-0243, https://ubuntu.com/security/CVE-2015-0244