kritisch
CVE-2015-3166
postgresql: unanticipated errors from the standard library
In der Trivy Database seit spätestens 24. Okt. 2026, 07:11 UTCWann der Eintrag vor diesem Build hinzukam, ist nicht erfasst.
Einstufung nach Quelle
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat4.0AV:N/AC:H/Au:N/C:P/I:N/A:P
Trivys eigenes Label ist CRITICAL. Kritisch laut NVD. Niedriger laut Amazon (mittel), Oracle (mittel), Ubuntu (mittel), Red Hat (niedrig).
Beschreibung
The snprintf implementation in PostgreSQL before 9.0.20, 9.1.x before 9.1.16, 9.2.x before 9.2.11, 9.3.x before 9.3.7, and 9.4.x before 9.4.2 does not properly handle system-call errors, which allows attackers to obtain sensitive information or have other unspecified impact via unknown vectors, as demonstrated by an out-of-memory error.
Betroffene Pakete und behobene Versionen
| Quelle | Paket | Behoben in |
|---|---|---|
| amazon linux 1 | postgresql8, postgresql8-contrib, postgresql8-debuginfo und 8 weitere | 8.4.20-3.50.amzn1 |
| debian 7 | postgresql-9.1 | 9.1.16-0+deb7u1 |
| debian 8 | postgresql-9.1, postgresql-9.4 | 9.1.16-0+deb8u1 und 1 weitere |
| Oracle Linux 6 | postgresql, postgresql-contrib, postgresql-devel und 7 weitere | 8.4.20-3.el6_6 |
| Oracle Linux 7 | postgresql, postgresql-contrib, postgresql-devel und 8 weitere | 9.2.13-1.el7_1 |
| ubuntu 12.04 | postgresql-9.1 | 9.1.16-0ubuntu0.12.04 |
| ubuntu 14.04 | postgresql-9.1, postgresql-9.3 | 9.1.16-0ubuntu0.14.04 und 1 weitere |
| ubuntu 14.04-ESM | postgresql-9.3 | 9.3.7-0ubuntu0.14.04 |
| ubuntu 14.10 | postgresql-9.4 | 9.4.2-0ubuntu0.14.10 |
| ubuntu 15.04 | postgresql-9.4 | 9.4.2-0ubuntu0.15.04 |
| ubuntu 15.10 | postgresql-9.4 | 9.4.2-1 |
Alle 42 Einträge aus 11 Quellen zeigen
| Quelle | Paket | Behoben in |
|---|---|---|
| amazon linux 1 | postgresql8 | 8.4.20-3.50.amzn1 |
| amazon linux 1 | postgresql8-contrib | 8.4.20-3.50.amzn1 |
| amazon linux 1 | postgresql8-debuginfo | 8.4.20-3.50.amzn1 |
| amazon linux 1 | postgresql8-devel | 8.4.20-3.50.amzn1 |
| amazon linux 1 | postgresql8-docs | 8.4.20-3.50.amzn1 |
| amazon linux 1 | postgresql8-libs | 8.4.20-3.50.amzn1 |
| amazon linux 1 | postgresql8-plperl | 8.4.20-3.50.amzn1 |
| amazon linux 1 | postgresql8-plpython | 8.4.20-3.50.amzn1 |
| amazon linux 1 | postgresql8-pltcl | 8.4.20-3.50.amzn1 |
| amazon linux 1 | postgresql8-server | 8.4.20-3.50.amzn1 |
| amazon linux 1 | postgresql8-test | 8.4.20-3.50.amzn1 |
| debian 7 | postgresql-9.1 | 9.1.16-0+deb7u1 |
| debian 8 | postgresql-9.1 | 9.1.16-0+deb8u1 |
| debian 8 | postgresql-9.4 | 9.4.2-0+deb8u1 |
| Oracle Linux 6 | postgresql | 8.4.20-3.el6_6 |
| Oracle Linux 6 | postgresql-contrib | 8.4.20-3.el6_6 |
| Oracle Linux 6 | postgresql-devel | 8.4.20-3.el6_6 |
| Oracle Linux 6 | postgresql-docs | 8.4.20-3.el6_6 |
| Oracle Linux 6 | postgresql-libs | 8.4.20-3.el6_6 |
| Oracle Linux 6 | postgresql-plperl | 8.4.20-3.el6_6 |
| Oracle Linux 6 | postgresql-plpython | 8.4.20-3.el6_6 |
| Oracle Linux 6 | postgresql-pltcl | 8.4.20-3.el6_6 |
| Oracle Linux 6 | postgresql-server | 8.4.20-3.el6_6 |
| Oracle Linux 6 | postgresql-test | 8.4.20-3.el6_6 |
| Oracle Linux 7 | postgresql | 9.2.13-1.el7_1 |
| Oracle Linux 7 | postgresql-contrib | 9.2.13-1.el7_1 |
| Oracle Linux 7 | postgresql-devel | 9.2.13-1.el7_1 |
| Oracle Linux 7 | postgresql-docs | 9.2.13-1.el7_1 |
| Oracle Linux 7 | postgresql-libs | 9.2.13-1.el7_1 |
| Oracle Linux 7 | postgresql-plperl | 9.2.13-1.el7_1 |
| Oracle Linux 7 | postgresql-plpython | 9.2.13-1.el7_1 |
| Oracle Linux 7 | postgresql-pltcl | 9.2.13-1.el7_1 |
| Oracle Linux 7 | postgresql-server | 9.2.13-1.el7_1 |
| Oracle Linux 7 | postgresql-test | 9.2.13-1.el7_1 |
| Oracle Linux 7 | postgresql-upgrade | 9.2.13-1.el7_1 |
| ubuntu 12.04 | postgresql-9.1 | 9.1.16-0ubuntu0.12.04 |
| ubuntu 14.04 | postgresql-9.1 | 9.1.16-0ubuntu0.14.04 |
| ubuntu 14.04 | postgresql-9.3 | 9.3.7-0ubuntu0.14.04 |
| ubuntu 14.04-ESM | postgresql-9.3 | 9.3.7-0ubuntu0.14.04 |
| ubuntu 14.10 | postgresql-9.4 | 9.4.2-0ubuntu0.14.10 |
| ubuntu 15.04 | postgresql-9.4 | 9.4.2-0ubuntu0.15.04 |
| ubuntu 15.10 | postgresql-9.4 | 9.4.2-1 |
Referenzen
- http://ubuntu.com/usn/usn-2621-1
- http://www.debian.org/security/2015/dsa-3269
- http://www.debian.org/security/2015/dsa-3270
- http://www.postgresql.org/about/news/1587/
- http://www.postgresql.org/docs/9.0/static/release-9-0-20.html
- http://www.postgresql.org/docs/9.1/static/release-9-1-16.html
- http://www.postgresql.org/docs/9.2/static/release-9-2-11.html
- http://www.postgresql.org/docs/9.3/static/release-9-3-7.html
Alle 15 Referenzen
- http://www.postgresql.org/docs/9.4/static/release-9-4-2.html
- https://access.redhat.com/security/cve/CVE-2015-3166
- https://linux.oracle.com/cve/CVE-2015-3166.html
- https://linux.oracle.com/errata/ELSA-2015-1194.html
- https://nvd.nist.gov/vuln/detail/CVE-2015-3166
- https://ubuntu.com/security/notices/USN-2621-1
- https://www.cve.org/CVERecord?id=CVE-2015-3166