Most recent entries from all

ALSA-2024:10785 — Important: postgresql:12 security update

Affected: AlmaLinux:8: pg_repack, AlmaLinux:8: pgaudit, AlmaLinux:8: postgres-decoderbufs, AlmaLinux:8: postgresql, AlmaLinux:8: postgresql-contrib, AlmaLinux:8: postgresql-docs, AlmaLinux:8: postgresql-plperl, AlmaLinux:8: postgresql-plpython3, AlmaLinux:8: postgresql-pltcl, AlmaLinux:8: postgresql-server and 6 more

PostgreSQL is an advanced object-relational database management system (DBMS).

Security Fix(es):

* postgresql: PostgreSQL SET ROLE, SET SESSION AUTHORIZATION reset to wrong user ID (CVE-2024-10978) * postgresql: PostgreSQL PL/Perl environment variable changes execute arbitrary code (CVE-2024-10979) * postgresql: PostgreSQL row security below e.g. subqueries disregards user ID changes (CVE-2024-10976)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2024-09679

BELL-CVE-2024-10979

Affected: Alpaquita:23: postgresql15, Alpaquita:stream: postgresql17

BIT-postgresql-2024-10979 — PostgreSQL PL/Perl environment variable changes execute arbitrary code

Affected: Bitnami: postgresql

Incorrect control of environment variables in PostgreSQL PL/Perl allows an unprivileged database user to change sensitive process environment variables (e.g. PATH). That often suffices to enable arbitrary code execution, even if the attacker lacks a database server operating system user. Versions before PostgreSQL 17.1, 16.5, 15.9, 14.14, 13.17, and 12.21 are affected.

certfr-2024-avi-0987 — De multiples vulnérabilités ont été découvertes dans PostgreSQL. Certaines d'entre elles permettent à un attaquant de p…

certfr-2024-avi-0987

Withdrawn: CLEANSTART-2026-KA40024 — PostgreSQL optimizer statistics allow a user to read sampled data within a view that the user cannot access

Withdrawn by the publisher.

Affected: CleanStart: postgresql

Multiple security vulnerabilities affect the postgresql package. PostgreSQL optimizer statistics allow a user to read sampled data within a view that the user cannot access. See references for individual vulnerability details.

EUVD-2026-258503

fkie_cve-2024-10979

GHSA-2r9h-x757-8j9q

msrc_CVE-2024-10979 — PostgreSQL PL/Perl environment variable changes execute arbitrary code

msrc_CVE-2024-10979

OESA-2024-2427 — libpq security update

Affected: openEuler:22.03-LTS-SP3: libpq

PostgreSQL is a powerful, open source object-relational database system that uses and extends the SQL language combined with many features that safely store and scale the most complicated data workloads. This package provides the essential shared library for any PostgreSQL client program or interface. Security Fix(es): Late privilege drop in REFRESH MATERIALIZED VIEW CONCURRENTLY in PostgreSQL allows an object creator to execute arbitrary SQL functions as the command issuer. The command intends to run SQL functions as the owner of the materialized view, enabling safe refresh of untrusted materialized views. The victim is a superuser or member of one of the attacker's roles. The attack requires luring the victim into running REFRESH MATERIALIZED VIEW CONCURRENTLY on the attacker's materialized view. Versions before PostgreSQL 16.2, 15.6, 14.11, 13.14, and 12.18 are affected.(CVE-2024-0985) Incomplete tracking in PostgreSQL of tables with row security allows a reused query to view or change different rows from those intended. CVE-2023-2455 and CVE-2016-2193 fixed most interaction between row security and user ID changes. They missed cases where a subquery, WITH query, security invoker view, or SQL-language function references a table with a row-level security policy. This has the same consequences as the two earlier CVEs. That is to say, it leads to potentially incorrect policies being applied in cases where role-specific policies are used and a given qu…

openSUSE-SU-2024:14501-1 — postgresql12-12.21-1.1 on GA media

postgresql12-12.21-1.1 on GA media

RHSA-2024:10593 — Red Hat Security Advisory: postgresql:16 security update

postgresql: PostgreSQL PL/Perl environment variable changes execute arbitrary code

SUSE-SU-2024:4052-1 — Security update for postgresql, postgresql16, postgresql17

Security update for postgresql, postgresql16, postgresql17

UBUNTU-CVE-2024-10979

Affected: Ubuntu:Pro:14.04:LTS: postgresql-9.3, Ubuntu:Pro:16.04:LTS: postgresql-9.5, Ubuntu:Pro:18.04:LTS: postgresql-10, Ubuntu:20.04:LTS: postgresql-12, Ubuntu:22.04:LTS: postgresql-14, Ubuntu:24.04:LTS: postgresql-16

WID-SEC-W-2024-3475 — PostgreSQL: Mehrere Schwachstellen

Ein entfernter Angreifer kann mehrere Schwachstellen in PostgreSQL ausnutzen, um beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren oder vertrauliche Informationen preiszugeben.