kritik
CVE-2015-3166
postgresql: unanticipated errors from the standard library
En geç 24 Eki 2026, 07:11 UTC tarihinden beri Trivy database'indeO derlemeden önce ne zaman girdiği kayıtlı değil.
Kaynağa göre önem derecesi
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat4.0AV:N/AC:H/Au:N/C:P/I:N/A:P
Trivy'nin kendi etiketi CRITICAL. Kritik diyenler: NVD. Daha düşük diyenler: Amazon (orta), Oracle (orta), Ubuntu (orta), Red Hat (düşük).
Açıklama
The snprintf implementation in PostgreSQL before 9.0.20, 9.1.x before 9.1.16, 9.2.x before 9.2.11, 9.3.x before 9.3.7, and 9.4.x before 9.4.2 does not properly handle system-call errors, which allows attackers to obtain sensitive information or have other unspecified impact via unknown vectors, as demonstrated by an out-of-memory error.
Etkilenen paketler ve düzeltilmiş sürümler
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| amazon linux 1 | postgresql8, postgresql8-contrib, postgresql8-debuginfo ve 8 tane daha | 8.4.20-3.50.amzn1 |
| debian 7 | postgresql-9.1 | 9.1.16-0+deb7u1 |
| debian 8 | postgresql-9.1, postgresql-9.4 | 9.1.16-0+deb8u1 ve 1 tane daha |
| Oracle Linux 6 | postgresql, postgresql-contrib, postgresql-devel ve 7 tane daha | 8.4.20-3.el6_6 |
| Oracle Linux 7 | postgresql, postgresql-contrib, postgresql-devel ve 8 tane daha | 9.2.13-1.el7_1 |
| ubuntu 12.04 | postgresql-9.1 | 9.1.16-0ubuntu0.12.04 |
| ubuntu 14.04 | postgresql-9.1, postgresql-9.3 | 9.1.16-0ubuntu0.14.04 ve 1 tane daha |
| ubuntu 14.04-ESM | postgresql-9.3 | 9.3.7-0ubuntu0.14.04 |
| ubuntu 14.10 | postgresql-9.4 | 9.4.2-0ubuntu0.14.10 |
| ubuntu 15.04 | postgresql-9.4 | 9.4.2-0ubuntu0.15.04 |
| ubuntu 15.10 | postgresql-9.4 | 9.4.2-1 |
11 kaynaktaki 42 kaydın hepsini göster
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| amazon linux 1 | postgresql8 | 8.4.20-3.50.amzn1 |
| amazon linux 1 | postgresql8-contrib | 8.4.20-3.50.amzn1 |
| amazon linux 1 | postgresql8-debuginfo | 8.4.20-3.50.amzn1 |
| amazon linux 1 | postgresql8-devel | 8.4.20-3.50.amzn1 |
| amazon linux 1 | postgresql8-docs | 8.4.20-3.50.amzn1 |
| amazon linux 1 | postgresql8-libs | 8.4.20-3.50.amzn1 |
| amazon linux 1 | postgresql8-plperl | 8.4.20-3.50.amzn1 |
| amazon linux 1 | postgresql8-plpython | 8.4.20-3.50.amzn1 |
| amazon linux 1 | postgresql8-pltcl | 8.4.20-3.50.amzn1 |
| amazon linux 1 | postgresql8-server | 8.4.20-3.50.amzn1 |
| amazon linux 1 | postgresql8-test | 8.4.20-3.50.amzn1 |
| debian 7 | postgresql-9.1 | 9.1.16-0+deb7u1 |
| debian 8 | postgresql-9.1 | 9.1.16-0+deb8u1 |
| debian 8 | postgresql-9.4 | 9.4.2-0+deb8u1 |
| Oracle Linux 6 | postgresql | 8.4.20-3.el6_6 |
| Oracle Linux 6 | postgresql-contrib | 8.4.20-3.el6_6 |
| Oracle Linux 6 | postgresql-devel | 8.4.20-3.el6_6 |
| Oracle Linux 6 | postgresql-docs | 8.4.20-3.el6_6 |
| Oracle Linux 6 | postgresql-libs | 8.4.20-3.el6_6 |
| Oracle Linux 6 | postgresql-plperl | 8.4.20-3.el6_6 |
| Oracle Linux 6 | postgresql-plpython | 8.4.20-3.el6_6 |
| Oracle Linux 6 | postgresql-pltcl | 8.4.20-3.el6_6 |
| Oracle Linux 6 | postgresql-server | 8.4.20-3.el6_6 |
| Oracle Linux 6 | postgresql-test | 8.4.20-3.el6_6 |
| Oracle Linux 7 | postgresql | 9.2.13-1.el7_1 |
| Oracle Linux 7 | postgresql-contrib | 9.2.13-1.el7_1 |
| Oracle Linux 7 | postgresql-devel | 9.2.13-1.el7_1 |
| Oracle Linux 7 | postgresql-docs | 9.2.13-1.el7_1 |
| Oracle Linux 7 | postgresql-libs | 9.2.13-1.el7_1 |
| Oracle Linux 7 | postgresql-plperl | 9.2.13-1.el7_1 |
| Oracle Linux 7 | postgresql-plpython | 9.2.13-1.el7_1 |
| Oracle Linux 7 | postgresql-pltcl | 9.2.13-1.el7_1 |
| Oracle Linux 7 | postgresql-server | 9.2.13-1.el7_1 |
| Oracle Linux 7 | postgresql-test | 9.2.13-1.el7_1 |
| Oracle Linux 7 | postgresql-upgrade | 9.2.13-1.el7_1 |
| ubuntu 12.04 | postgresql-9.1 | 9.1.16-0ubuntu0.12.04 |
| ubuntu 14.04 | postgresql-9.1 | 9.1.16-0ubuntu0.14.04 |
| ubuntu 14.04 | postgresql-9.3 | 9.3.7-0ubuntu0.14.04 |
| ubuntu 14.04-ESM | postgresql-9.3 | 9.3.7-0ubuntu0.14.04 |
| ubuntu 14.10 | postgresql-9.4 | 9.4.2-0ubuntu0.14.10 |
| ubuntu 15.04 | postgresql-9.4 | 9.4.2-0ubuntu0.15.04 |
| ubuntu 15.10 | postgresql-9.4 | 9.4.2-1 |
Referanslar
- http://ubuntu.com/usn/usn-2621-1
- http://www.debian.org/security/2015/dsa-3269
- http://www.debian.org/security/2015/dsa-3270
- http://www.postgresql.org/about/news/1587/
- http://www.postgresql.org/docs/9.0/static/release-9-0-20.html
- http://www.postgresql.org/docs/9.1/static/release-9-1-16.html
- http://www.postgresql.org/docs/9.2/static/release-9-2-11.html
- http://www.postgresql.org/docs/9.3/static/release-9-3-7.html
15 referansın hepsi
- http://www.postgresql.org/docs/9.4/static/release-9-4-2.html
- https://access.redhat.com/security/cve/CVE-2015-3166
- https://linux.oracle.com/cve/CVE-2015-3166.html
- https://linux.oracle.com/errata/ELSA-2015-1194.html
- https://nvd.nist.gov/vuln/detail/CVE-2015-3166
- https://ubuntu.com/security/notices/USN-2621-1
- https://www.cve.org/CVERecord?id=CVE-2015-3166