USN-1058-1

Executive Summary

Summary
Title	PostgreSQL vulnerability

Informations
Name	USN-1058-1	First vendor Publication	2011-02-03
Vendor	Ubuntu	Last vendor Modification	2011-02-03
Severity (Vendor)	N/A	Revision	N/A

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:S/C:P/I:P/A:P)
Cvss Base Score	6.5	Attack Range	Network
Cvss Impact Score	6.4	Attack Complexity	Low
Cvss Expoit Score	8	Authentification	Requires single instance
Calculate full CVSS 2.0 Vectors scores

Detail

A security issue affects the following Ubuntu releases:

Ubuntu 6.06 LTS
Ubuntu 8.04 LTS
Ubuntu 9.10
Ubuntu 10.04 LTS
Ubuntu 10.10

This advisory also applies to the corresponding versions of
Kubuntu, Edubuntu, and Xubuntu.

The problem can be corrected by upgrading your system to the
following package versions:

Ubuntu 6.06 LTS:
postgresql-contrib-8.1 8.1.23-0ubuntu0.6.06.1

Ubuntu 8.04 LTS:
postgresql-contrib-8.3 8.3.14-0ubuntu8.04

Ubuntu 9.10:
postgresql-contrib-8.4 8.4.7-0ubuntu0.9.10

Ubuntu 10.04 LTS:
postgresql-contrib-8.4 8.4.7-0ubuntu0.10.04

Ubuntu 10.10:
postgresql-contrib-8.4 8.4.7-0ubuntu0.10.10

In general, a standard system update will make all the necessary changes.

Details follow:

Geoff Keating reported that a buffer overflow exists in the intarray
module's input function for the query_int type. This could allow an
attacker to cause a denial of service or possibly execute arbitrary
code as the postgres user.

Original Source

Url : http://www.ubuntu.com/usn/USN-1058-1

CWE : Common Weakness Enumeration

id	Name
CWE-189	Numeric Errors

CPE : Common Platform Enumeration

Type	Description	Count
Application	Postgresql Postgresql cpe:/a:postgresql:postgresql:9.0.2 cpe:/a:postgresql:postgresql:9.0.1 cpe:/a:postgresql:postgresql:9.0 cpe:/a:postgresql:postgresql:8.4.6 cpe:/a:postgresql:postgresql:8.4.5 cpe:/a:postgresql:postgresql:8.4.4 cpe:/a:postgresql:postgresql:8.4.3 cpe:/a:postgresql:postgresql:8.4.2 cpe:/a:postgresql:postgresql:8.4.1 cpe:/a:postgresql:postgresql:8.4 cpe:/a:postgresql:postgresql:8.3.9 cpe:/a:postgresql:postgresql:8.3.8 cpe:/a:postgresql:postgresql:8.3.7 cpe:/a:postgresql:postgresql:8.3.6 cpe:/a:postgresql:postgresql:8.3.5 cpe:/a:postgresql:postgresql:8.3.4 cpe:/a:postgresql:postgresql:8.3.3 cpe:/a:postgresql:postgresql:8.3.2 cpe:/a:postgresql:postgresql:8.3.13 cpe:/a:postgresql:postgresql:8.3.12 cpe:/a:postgresql:postgresql:8.3.11 cpe:/a:postgresql:postgresql:8.3.10 cpe:/a:postgresql:postgresql:8.3.1 cpe:/a:postgresql:postgresql:8.3 cpe:/a:postgresql:postgresql:8.2.9 cpe:/a:postgresql:postgresql:8.2.8 cpe:/a:postgresql:postgresql:8.2.7 cpe:/a:postgresql:postgresql:8.2.6 cpe:/a:postgresql:postgresql:8.2.5 cpe:/a:postgresql:postgresql:8.2.4 cpe:/a:postgresql:postgresql:8.2.3 cpe:/a:postgresql:postgresql:8.2.2 cpe:/a:postgresql:postgresql:8.2.19 cpe:/a:postgresql:postgresql:8.2.18 cpe:/a:postgresql:postgresql:8.2.17 cpe:/a:postgresql:postgresql:8.2.16 cpe:/a:postgresql:postgresql:8.2.15 cpe:/a:postgresql:postgresql:8.2.14 cpe:/a:postgresql:postgresql:8.2.13 cpe:/a:postgresql:postgresql:8.2.12 cpe:/a:postgresql:postgresql:8.2.11 cpe:/a:postgresql:postgresql:8.2.10 cpe:/a:postgresql:postgresql:8.2.1 cpe:/a:postgresql:postgresql:8.2	44

Open Source Vulnerability Database (OSVDB)

id	Description
70740	PostgreSQL intarray Module contrib/intarray/_int_bool.c gettoken() Function O...

Type	Count
CPE ID(s)	44
osvdb(s)	1

Related	Severity
CVE-2010-4015	(Medium)

Same Subject	Severity
Login to view 6 more Alert(s)

USN-1058-1

Executive Summary

Security-Database Scoring CVSS v2

Detail

Original Source

CWE : Common Weakness Enumeration

CPE : Common Platform Enumeration

Open Source Vulnerability Database (OSVDB)

Global Informations

Open Standards

Other Databases

COMPANY

STANDARDS

RECENT POSTS

MENU