Most recent entries from all

bdu:2019-03335

cnvd-2017-36407

EUVD-2026-173922

fkie_cve-2017-12172

PostgreSQL 10.x before 10.1, 9.6.x before 9.6.6, 9.5.x before 9.5.10, 9.4.x before 9.4.15, 9.3.x before 9.3.20, and 9.2.x before 9.2.24 runs under a non-root operating system account, and database superusers have effective ability to run arbitrary code under that system account. PostgreSQL provides a script for starting the database server during system boot. Packages of PostgreSQL for many operating systems provide their own, packager-authored startup implementations. Several implementations use a log file name that the database superuser can replace with a symbolic link. As root, they open(), chmod() and/or chown() this log file name. This often suffices for the database superuser to escalate to root privileges when root starts the server.

GHSA-r936-w9vp-c53q

gsd-2017-12172

RHSA-2017:3402 — Red Hat Security Advisory: postgresql security update

postgresql: Start scripts permit database administrator to modify root-owned files postgresql: Start scripts permit database administrator to modify root-owned files

RHSA-2017:3403 — Red Hat Security Advisory: rh-postgresql94-postgresql security update

postgresql: Start scripts permit database administrator to modify root-owned files postgresql: Start scripts permit database administrator to modify root-owned files

SUSE-SU-2018:0077-1 — Security update for postgresql94

Security update for postgresql94

WID-SEC-W-2024-0143 — PostgreSQL: Mehrere Schwachstellen

Ein lokaler oder entfernter authenitisierter Angreifer kann mehrere Schwachstellen in PostgreSQL ausnutzen, um seine Privilegien zu erhöhen, vertrauliche Daten einzusehen, Daten zu manipulieren, einen Denial of Serivce auszulösen oder Sicherheitsmechanismen zu umgehen.