ByteOS Network

Vulnerability Details :

CVE-2015-0241

Assigner-redhat

Assigner Org ID-53f830b8-0a3f-465b-8143-3b8a9948e749

Published At-27 Jan, 2020 | 15:29

Updated At-06 Aug, 2024 | 04:03

The to_char function in PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1 allows remote authenticated users to cause a denial of service (crash) or possibly execute arbitrary code via a (1) large number of digits when processing a numeric formatting template, which triggers a buffer over-read, or (2) crafted timestamp formatting template, which triggers a buffer overflow.

EPSS History

Score

Latest Score

N/A

Percentile

Latest Percentile

N/A

▼Common Vulnerabilities and Exposures (CVE)

cve.org

Assigner:redhat

Assigner Org ID:53f830b8-0a3f-465b-8143-3b8a9948e749

Published At:27 Jan, 2020 | 15:29

Updated At:06 Aug, 2024 | 04:03

▼CVE Numbering Authority (CNA)

Affected Products

Vendor

The PostgreSQL Global Development Group

Product

PostgreSQL

Versions

Affected

before 9.0.19
9.1.x before 9.1.15
9.2.x before 9.2.10
9.3.x before 9.3.6
9.4.x before 9.4.1

Problem Types

Type	CWE ID	Description
text	N/A	Other

Type: text

CWE ID: N/A

Description: Other

References

Hyperlink	Resource
http://www.postgresql.org/docs/9.4/static/release-9-4-1.html	x_refsource_CONFIRM
http://www.postgresql.org/docs/current/static/release-9-0-19.html	x_refsource_CONFIRM
http://www.postgresql.org/docs/current/static/release-9-1-15.html	x_refsource_CONFIRM
http://www.postgresql.org/docs/current/static/release-9-2-10.html	x_refsource_CONFIRM
http://www.postgresql.org/docs/current/static/release-9-3-6.html	x_refsource_CONFIRM
http://www.postgresql.org/about/news/1569/	x_refsource_CONFIRM
http://www.debian.org/security/2015/dsa-3155	x_refsource_CONFIRM

Hyperlink: http://www.postgresql.org/docs/9.4/static/release-9-4-1.html

Resource:

x_refsource_CONFIRM

Hyperlink: http://www.postgresql.org/docs/current/static/release-9-0-19.html

Resource:

x_refsource_CONFIRM

Hyperlink: http://www.postgresql.org/docs/current/static/release-9-1-15.html

Resource:

x_refsource_CONFIRM

Hyperlink: http://www.postgresql.org/docs/current/static/release-9-2-10.html

Resource:

x_refsource_CONFIRM

Hyperlink: http://www.postgresql.org/docs/current/static/release-9-3-6.html

Resource:

x_refsource_CONFIRM

Hyperlink: http://www.postgresql.org/about/news/1569/

Resource:

x_refsource_CONFIRM

Hyperlink: http://www.debian.org/security/2015/dsa-3155

Resource:

x_refsource_CONFIRM

▼Authorized Data Publishers (ADP)

CVE Program Container

References

Hyperlink	Resource
http://www.postgresql.org/docs/9.4/static/release-9-4-1.html	x_refsource_CONFIRM x_transferred
http://www.postgresql.org/docs/current/static/release-9-0-19.html	x_refsource_CONFIRM x_transferred
http://www.postgresql.org/docs/current/static/release-9-1-15.html	x_refsource_CONFIRM x_transferred
http://www.postgresql.org/docs/current/static/release-9-2-10.html	x_refsource_CONFIRM x_transferred
http://www.postgresql.org/docs/current/static/release-9-3-6.html	x_refsource_CONFIRM x_transferred
http://www.postgresql.org/about/news/1569/	x_refsource_CONFIRM x_transferred
http://www.debian.org/security/2015/dsa-3155	x_refsource_CONFIRM x_transferred

Hyperlink: http://www.postgresql.org/docs/9.4/static/release-9-4-1.html

Resource:

x_refsource_CONFIRM

x_transferred

Hyperlink: http://www.postgresql.org/docs/current/static/release-9-0-19.html

Resource:

x_refsource_CONFIRM

x_transferred

Hyperlink: http://www.postgresql.org/docs/current/static/release-9-1-15.html

Resource:

x_refsource_CONFIRM

x_transferred

Hyperlink: http://www.postgresql.org/docs/current/static/release-9-2-10.html

Resource:

x_refsource_CONFIRM

x_transferred

Hyperlink: http://www.postgresql.org/docs/current/static/release-9-3-6.html

Resource:

x_refsource_CONFIRM

x_transferred

Hyperlink: http://www.postgresql.org/about/news/1569/

Resource:

x_refsource_CONFIRM

x_transferred

Hyperlink: http://www.debian.org/security/2015/dsa-3155

Resource:

x_refsource_CONFIRM

x_transferred

▼National Vulnerability Database (NVD)

nvd.nist.gov

Source:secalert@redhat.com

Published At:27 Jan, 2020 | 16:15

Updated At:31 Jan, 2020 | 20:01

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	8.8	HIGH	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary	2.0	6.5	MEDIUM	AV:N/AC:L/Au:S/C:P/I:P/A:P

Type: Primary

Version: 3.1

Base score: 8.8

Base severity: HIGH

Vector:

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Type: Primary

Version: 2.0

Base score: 6.5

Base severity: MEDIUM

Vector:

AV:N/AC:L/Au:S/C:P/I:P/A:P

CPE Matches

The PostgreSQL Global Development Group

>>postgresql>>Versions before 9.0.19(exclusive)

cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*

The PostgreSQL Global Development Group

>>postgresql>>Versions from 9.1.0(inclusive) to 9.1.15(exclusive)

cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*

The PostgreSQL Global Development Group

>>postgresql>>Versions from 9.2.0(inclusive) to 9.2.10(exclusive)

cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*

The PostgreSQL Global Development Group

>>postgresql>>Versions from 9.3.0(inclusive) to 9.3.6(exclusive)

cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*

The PostgreSQL Global Development Group

>>postgresql>>Versions from 9.4.0(inclusive) to 9.4.1(exclusive)

cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*

Debian GNU/Linux

>>debian_linux>>7.0

cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*

Debian GNU/Linux

>>debian_linux>>8.0

cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-120	Primary	nvd@nist.gov

CWE ID: CWE-120

Type: Primary

Source: nvd@nist.gov