https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 08:51:33 +0000 https://cve.radiocsirt.org/vuln/bdu:2024-09682 bdu:2024-09682 https://cve.radiocsirt.org/vuln/bdu:2024-09682 https://cve.radiocsirt.org/vuln/bell-cve-2024-10977 <p><strong>Affected:</strong> Alpaquita:23: postgresql15, Alpaquita:stream: postgresql17</p> <p><strong>Affected:</strong> Alpaquita:23: postgresql15, Alpaquita:stream: postgresql17</p> https://cve.radiocsirt.org/vuln/bell-cve-2024-10977 https://cve.radiocsirt.org/vuln/bit-postgresql-2024-10977 <p><strong>Affected:</strong> Bitnami: postgresql</p> <p>Client use of server error message in PostgreSQL allows a server not trusted under current SSL or GSS settings to furnish arbitrary non-NUL bytes to the libpq application. For example, a man-in-the-middle attacker could send a long error message that a human or screen-scraper user of psql mistakes for valid query results. This is probably not a concern for clients where the user interface unambiguously indicates the boundary between one error message and other text. Versions before PostgreSQL 17.1, 16.5, 15.9, 14.14, 13.17, and 12.21 are affected.</p> <p><strong>Affected:</strong> Bitnami: postgresql</p> <p>Client use of server error message in PostgreSQL allows a server not trusted under current SSL or GSS settings to furnish arbitrary non-NUL bytes to the libpq application. For example, a man-in-the-middle attacker could send a long error message that a human or screen-scraper user of psql mistakes for valid query results. This is probably not a concern for clients where the user interface unambiguously indicates the boundary between one error message and other text. Versions before PostgreSQL 17.1, 16.5, 15.9, 14.14, 13.17, and 12.21 are affected.</p> https://cve.radiocsirt.org/vuln/bit-postgresql-2024-10977 https://cve.radiocsirt.org/vuln/certfr-2024-avi-0987 certfr-2024-avi-0987 https://cve.radiocsirt.org/vuln/certfr-2024-avi-0987 https://cve.radiocsirt.org/vuln/cleanstart-2026-ah36441 <p><strong>Affected:</strong> CleanStart: postgresql16</p> <p>Security vulnerability affects the postgresql16 package. This issue is resolved in later releases. See references for vulnerability details.</p> <p><strong>Affected:</strong> CleanStart: postgresql16</p> <p>Security vulnerability affects the postgresql16 package. This issue is resolved in later releases. See references for vulnerability details.</p> https://cve.radiocsirt.org/vuln/cleanstart-2026-ah36441 https://cve.radiocsirt.org/vuln/euvd-2026-258501 EUVD-2026-258501 https://cve.radiocsirt.org/vuln/euvd-2026-258501 https://cve.radiocsirt.org/vuln/fkie_cve-2024-10977 <p>Client use of server error message in PostgreSQL allows a server not trusted under current SSL or GSS settings to furnish arbitrary non-NUL bytes to the libpq application. For example, a man-in-the-middle attacker could send a long error message that a human or screen-scraper user of psql mistakes for valid query results. This is probably not a concern for clients where the user interface unambiguously indicates the boundary between one error message and other text. Versions before PostgreSQL 17.1, 16.5, 15.9, 14.14, 13.17, and 12.21 are affected.</p> <p>Client use of server error message in PostgreSQL allows a server not trusted under current SSL or GSS settings to furnish arbitrary non-NUL bytes to the libpq application. For example, a man-in-the-middle attacker could send a long error message that a human or screen-scraper user of psql mistakes for valid query results. This is probably not a concern for clients where the user interface unambiguously indicates the boundary between one error message and other text. Versions before PostgreSQL 17.1, 16.5, 15.9, 14.14, 13.17, and 12.21 are affected.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2024-10977 https://cve.radiocsirt.org/vuln/ghsa-62q4-hc79-94qj <p>Client use of server error message in PostgreSQL allows a server not trusted under current SSL or GSS settings to furnish arbitrary non-NUL bytes to the libpq application. For example, a man-in-the-middle attacker could send a long error message that a human or screen-scraper user of psql mistakes for valid query results. This is probably not a concern for clients where the user interface unambiguously indicates the boundary between one error message and other text. Versions before PostgreSQL 17.1, 16.5, 15.9, 14.14, 13.17, and 12.21 are affected.</p> <p>Client use of server error message in PostgreSQL allows a server not trusted under current SSL or GSS settings to furnish arbitrary non-NUL bytes to the libpq application. For example, a man-in-the-middle attacker could send a long error message that a human or screen-scraper user of psql mistakes for valid query results. This is probably not a concern for clients where the user interface unambiguously indicates the boundary between one error message and other text. Versions before PostgreSQL 17.1, 16.5, 15.9, 14.14, 13.17, and 12.21 are affected.</p> https://cve.radiocsirt.org/vuln/ghsa-62q4-hc79-94qj https://cve.radiocsirt.org/vuln/msrc_cve-2024-10977 msrc_CVE-2024-10977 https://cve.radiocsirt.org/vuln/msrc_cve-2024-10977 https://cve.radiocsirt.org/vuln/oesa-2024-2427 <p><strong>Affected:</strong> openEuler:22.03-LTS-SP3: libpq</p> <p>PostgreSQL is a powerful, open source object-relational database system that uses and extends the SQL language combined with many features that safely store and scale the most complicated data workloads. This package provides the essential shared library for any PostgreSQL client program or interface. Security Fix(es): Late privilege drop in REFRESH MATERIALIZED VIEW CONCURRENTLY in PostgreSQL allows an object creator to execute arbitrary SQL functions as the command issuer. The command intends to run SQL functions as the owner of the materialized view, enabling safe refresh of untrusted materialized views. The victim is a superuser or member of one of the attacker&amp;apos;s roles. The attack requires luring the victim into running REFRESH MATERIALIZED VIEW CONCURRENTLY on the attacker&amp;apos;s materialized view. Versions before PostgreSQL 16.2, 15.6, 14.11, 13.14, and 12.18 are affected.(CVE-2024-0985) Incomplete tracking in PostgreSQL of tables with row security allows a reused query to view or change different rows from those intended. CVE-2023-2455 and CVE-2016-2193 fixed most interaction between row security and user ID changes. They missed cases where a subquery, WITH query, security invoker view, or SQL-language function references a table with a row-level security policy. This has the same consequences as the two earlier CVEs. That is to say, it leads to potentially incorrect policies being applied in cases where role-specific policies are used and a given qu…</p> <p><strong>Affected:</strong> openEuler:22.03-LTS-SP3: libpq</p> <p>PostgreSQL is a powerful, open source object-relational database system that uses and extends the SQL language combined with many features that safely store and scale the most complicated data workloads. This package provides the essential shared library for any PostgreSQL client program or interface. Security Fix(es): Late privilege drop in REFRESH MATERIALIZED VIEW CONCURRENTLY in PostgreSQL allows an object creator to execute arbitrary SQL functions as the command issuer. The command intends to run SQL functions as the owner of the materialized view, enabling safe refresh of untrusted materialized views. The victim is a superuser or member of one of the attacker&amp;apos;s roles. The attack requires luring the victim into running REFRESH MATERIALIZED VIEW CONCURRENTLY on the attacker&amp;apos;s materialized view. Versions before PostgreSQL 16.2, 15.6, 14.11, 13.14, and 12.18 are affected.(CVE-2024-0985) Incomplete tracking in PostgreSQL of tables with row security allows a reused query to view or change different rows from those intended. CVE-2023-2455 and CVE-2016-2193 fixed most interaction between row security and user ID changes. They missed cases where a subquery, WITH query, security invoker view, or SQL-language function references a table with a row-level security policy. This has the same consequences as the two earlier CVEs. That is to say, it leads to potentially incorrect policies being applied in cases where role-specific policies are used and a given qu…</p> https://cve.radiocsirt.org/vuln/oesa-2024-2427 https://cve.radiocsirt.org/vuln/opensuse-su-2024:14501-1 <p>postgresql12-12.21-1.1 on GA media</p> <p>postgresql12-12.21-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2024:14501-1 https://cve.radiocsirt.org/vuln/suse-su-2024:4052-1 <p>Security update for postgresql, postgresql16, postgresql17</p> <p>Security update for postgresql, postgresql16, postgresql17</p> https://cve.radiocsirt.org/vuln/suse-su-2024:4052-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2024-10977 <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: postgresql-9.3, Ubuntu:Pro:16.04:LTS: postgresql-9.5, Ubuntu:Pro:18.04:LTS: postgresql-10, Ubuntu:20.04:LTS: postgresql-12, Ubuntu:22.04:LTS: postgresql-14, Ubuntu:24.04:LTS: postgresql-16</p> <p>Client use of server error message in PostgreSQL allows a server not trusted under current SSL or GSS settings to furnish arbitrary non-NUL bytes to the libpq application. For example, a man-in-the-middle attacker could send a long error message that a human or screen-scraper user of psql mistakes for valid query results. This is probably not a concern for clients where the user interface unambiguously indicates the boundary between one error message and other text. Versions before PostgreSQL 17.1, 16.5, 15.9, 14.14, 13.17, and 12.21 are affected.</p> <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: postgresql-9.3, Ubuntu:Pro:16.04:LTS: postgresql-9.5, Ubuntu:Pro:18.04:LTS: postgresql-10, Ubuntu:20.04:LTS: postgresql-12, Ubuntu:22.04:LTS: postgresql-14, Ubuntu:24.04:LTS: postgresql-16</p> <p>Client use of server error message in PostgreSQL allows a server not trusted under current SSL or GSS settings to furnish arbitrary non-NUL bytes to the libpq application. For example, a man-in-the-middle attacker could send a long error message that a human or screen-scraper user of psql mistakes for valid query results. This is probably not a concern for clients where the user interface unambiguously indicates the boundary between one error message and other text. Versions before PostgreSQL 17.1, 16.5, 15.9, 14.14, 13.17, and 12.21 are affected.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2024-10977 https://cve.radiocsirt.org/vuln/wid-sec-w-2024-3475 <p>Ein entfernter Angreifer kann mehrere Schwachstellen in PostgreSQL ausnutzen, um beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren oder vertrauliche Informationen preiszugeben.</p> <p>Ein entfernter Angreifer kann mehrere Schwachstellen in PostgreSQL ausnutzen, um beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren oder vertrauliche Informationen preiszugeben.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2024-3475