critique
CVE-2015-3166
postgresql: unanticipated errors from the standard library
Dans la Trivy database depuis au moins le 24 oct. 2026, 07:11 UTCLa date d'entrée avant ce build n'est pas enregistrée.
Sévérité par source
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat4.0AV:N/AC:H/Au:N/C:P/I:N/A:P
Le label propre à Trivy est CRITICAL. Critique selon NVD. Plus basse selon Amazon (moyenne), Oracle (moyenne), Ubuntu (moyenne), Red Hat (faible).
Description
The snprintf implementation in PostgreSQL before 9.0.20, 9.1.x before 9.1.16, 9.2.x before 9.2.11, 9.3.x before 9.3.7, and 9.4.x before 9.4.2 does not properly handle system-call errors, which allows attackers to obtain sensitive information or have other unspecified impact via unknown vectors, as demonstrated by an out-of-memory error.
Paquets affectés et versions corrigées
| Source | Paquet | Corrigé en |
|---|---|---|
| amazon linux 1 | postgresql8, postgresql8-contrib, postgresql8-debuginfo et 8 autres | 8.4.20-3.50.amzn1 |
| debian 7 | postgresql-9.1 | 9.1.16-0+deb7u1 |
| debian 8 | postgresql-9.1, postgresql-9.4 | 9.1.16-0+deb8u1 et 1 autres |
| Oracle Linux 6 | postgresql, postgresql-contrib, postgresql-devel et 7 autres | 8.4.20-3.el6_6 |
| Oracle Linux 7 | postgresql, postgresql-contrib, postgresql-devel et 8 autres | 9.2.13-1.el7_1 |
| ubuntu 12.04 | postgresql-9.1 | 9.1.16-0ubuntu0.12.04 |
| ubuntu 14.04 | postgresql-9.1, postgresql-9.3 | 9.1.16-0ubuntu0.14.04 et 1 autres |
| ubuntu 14.04-ESM | postgresql-9.3 | 9.3.7-0ubuntu0.14.04 |
| ubuntu 14.10 | postgresql-9.4 | 9.4.2-0ubuntu0.14.10 |
| ubuntu 15.04 | postgresql-9.4 | 9.4.2-0ubuntu0.15.04 |
| ubuntu 15.10 | postgresql-9.4 | 9.4.2-1 |
Afficher les 42 entrées de 11 sources
| Source | Paquet | Corrigé en |
|---|---|---|
| amazon linux 1 | postgresql8 | 8.4.20-3.50.amzn1 |
| amazon linux 1 | postgresql8-contrib | 8.4.20-3.50.amzn1 |
| amazon linux 1 | postgresql8-debuginfo | 8.4.20-3.50.amzn1 |
| amazon linux 1 | postgresql8-devel | 8.4.20-3.50.amzn1 |
| amazon linux 1 | postgresql8-docs | 8.4.20-3.50.amzn1 |
| amazon linux 1 | postgresql8-libs | 8.4.20-3.50.amzn1 |
| amazon linux 1 | postgresql8-plperl | 8.4.20-3.50.amzn1 |
| amazon linux 1 | postgresql8-plpython | 8.4.20-3.50.amzn1 |
| amazon linux 1 | postgresql8-pltcl | 8.4.20-3.50.amzn1 |
| amazon linux 1 | postgresql8-server | 8.4.20-3.50.amzn1 |
| amazon linux 1 | postgresql8-test | 8.4.20-3.50.amzn1 |
| debian 7 | postgresql-9.1 | 9.1.16-0+deb7u1 |
| debian 8 | postgresql-9.1 | 9.1.16-0+deb8u1 |
| debian 8 | postgresql-9.4 | 9.4.2-0+deb8u1 |
| Oracle Linux 6 | postgresql | 8.4.20-3.el6_6 |
| Oracle Linux 6 | postgresql-contrib | 8.4.20-3.el6_6 |
| Oracle Linux 6 | postgresql-devel | 8.4.20-3.el6_6 |
| Oracle Linux 6 | postgresql-docs | 8.4.20-3.el6_6 |
| Oracle Linux 6 | postgresql-libs | 8.4.20-3.el6_6 |
| Oracle Linux 6 | postgresql-plperl | 8.4.20-3.el6_6 |
| Oracle Linux 6 | postgresql-plpython | 8.4.20-3.el6_6 |
| Oracle Linux 6 | postgresql-pltcl | 8.4.20-3.el6_6 |
| Oracle Linux 6 | postgresql-server | 8.4.20-3.el6_6 |
| Oracle Linux 6 | postgresql-test | 8.4.20-3.el6_6 |
| Oracle Linux 7 | postgresql | 9.2.13-1.el7_1 |
| Oracle Linux 7 | postgresql-contrib | 9.2.13-1.el7_1 |
| Oracle Linux 7 | postgresql-devel | 9.2.13-1.el7_1 |
| Oracle Linux 7 | postgresql-docs | 9.2.13-1.el7_1 |
| Oracle Linux 7 | postgresql-libs | 9.2.13-1.el7_1 |
| Oracle Linux 7 | postgresql-plperl | 9.2.13-1.el7_1 |
| Oracle Linux 7 | postgresql-plpython | 9.2.13-1.el7_1 |
| Oracle Linux 7 | postgresql-pltcl | 9.2.13-1.el7_1 |
| Oracle Linux 7 | postgresql-server | 9.2.13-1.el7_1 |
| Oracle Linux 7 | postgresql-test | 9.2.13-1.el7_1 |
| Oracle Linux 7 | postgresql-upgrade | 9.2.13-1.el7_1 |
| ubuntu 12.04 | postgresql-9.1 | 9.1.16-0ubuntu0.12.04 |
| ubuntu 14.04 | postgresql-9.1 | 9.1.16-0ubuntu0.14.04 |
| ubuntu 14.04 | postgresql-9.3 | 9.3.7-0ubuntu0.14.04 |
| ubuntu 14.04-ESM | postgresql-9.3 | 9.3.7-0ubuntu0.14.04 |
| ubuntu 14.10 | postgresql-9.4 | 9.4.2-0ubuntu0.14.10 |
| ubuntu 15.04 | postgresql-9.4 | 9.4.2-0ubuntu0.15.04 |
| ubuntu 15.10 | postgresql-9.4 | 9.4.2-1 |
Références
- http://ubuntu.com/usn/usn-2621-1
- http://www.debian.org/security/2015/dsa-3269
- http://www.debian.org/security/2015/dsa-3270
- http://www.postgresql.org/about/news/1587/
- http://www.postgresql.org/docs/9.0/static/release-9-0-20.html
- http://www.postgresql.org/docs/9.1/static/release-9-1-16.html
- http://www.postgresql.org/docs/9.2/static/release-9-2-11.html
- http://www.postgresql.org/docs/9.3/static/release-9-3-7.html
Les 15 références
- http://www.postgresql.org/docs/9.4/static/release-9-4-2.html
- https://access.redhat.com/security/cve/CVE-2015-3166
- https://linux.oracle.com/cve/CVE-2015-3166.html
- https://linux.oracle.com/errata/ELSA-2015-1194.html
- https://nvd.nist.gov/vuln/detail/CVE-2015-3166
- https://ubuntu.com/security/notices/USN-2621-1
- https://www.cve.org/CVERecord?id=CVE-2015-3166