The version of PostgreSQL installed on the remote host is 9.0.x prior to 9.0.23, 9.1.x prior to 9.1.19, 9.2.x prior to 9.2.14, 9.3.x prior to 9.3.10, or 9.4.x prior to 9.4.5. It is, therefore, affected by multiple vulnerabilities :

  - A denial of service vulnerability exists due to an     unspecified flaw in the crypt() function. An     authenticated, remote attacker can exploit this to cause     a memory leak, resulting in a denial of service     condition. (CVE-2015-5288)

  - A denial of service vulnerability exists due to improper     validation of user-supplied JSON input. An     authenticated, remote attacker can exploit this, via     specially crafted JSON input, to cause the server to     crash. (CVE-2015-5289)

  - A denial of service vulnerability exists due to a flaw     that is triggered when a function is executed in an     outer-subtransaction cursor. An authenticated, remote     attacker can exploit this to cause a denial of service     condition.

  - Multiple stack overflow conditions exist due to improper     validation of user-supplied input when handling input to     record types, range types, json, jsonb, tsquery,     ltxtquery and query_int. An authenticated, remote     attacker can exploit this to cause a denial of service     condition and potentially remote code execution.

  - An information disclosure vulnerability exists due to     world-readable permissions granted to temporary files     that are created during a pg_dump with tar-format     output. A local attacker can exploit this disclose     sensitive information.

  - An overflow condition exists due to improper validation     of user-supplied input when handling SIMILAR TO and LIKE     matching regular expressions. An authenticated, remote     attacker can exploit this to cause a stack overflow,     resulting in a denial of service condition.

Detections

Analytics

PostgreSQL 9.0.x < 9.0.23 / 9.1.x < 9.1.19 / 9.2.x < 9.2.14 / 9.3.x < 9.3.10 / 9.4.x < 9.4.5 Multiple Vulnerabilities

medium Nessus Plugin ID 86422

Version 1.16

Version 1.15

Version 1.16 Oct 23, 2024, 3:47 PM Plugin metadata (update thorough_tests attribute) Plugin Feed: 202410231547
Version 1.15 Apr 4, 2023, 12:12 PM Plugin metadata (remove thorough_tests attribute) Plugin Feed: 202304041212