critical
CVE-2015-3166
postgresql: unanticipated errors from the standard library
In the Trivy database since at least 24 Oct 2026, 07:11 UTCWhen it arrived before that build is not recorded.
Severity by source
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat4.0AV:N/AC:H/Au:N/C:P/I:N/A:P
Trivy's own label is CRITICAL. Rated critical by NVD. Rated lower by Amazon (medium), Oracle (medium), Ubuntu (medium), Red Hat (low).
Description
The snprintf implementation in PostgreSQL before 9.0.20, 9.1.x before 9.1.16, 9.2.x before 9.2.11, 9.3.x before 9.3.7, and 9.4.x before 9.4.2 does not properly handle system-call errors, which allows attackers to obtain sensitive information or have other unspecified impact via unknown vectors, as demonstrated by an out-of-memory error.
Affected packages and fixed versions
| Source | Package | Fixed in |
|---|---|---|
| amazon linux 1 | postgresql8, postgresql8-contrib, postgresql8-debuginfo and 8 more | 8.4.20-3.50.amzn1 |
| debian 7 | postgresql-9.1 | 9.1.16-0+deb7u1 |
| debian 8 | postgresql-9.1, postgresql-9.4 | 9.1.16-0+deb8u1 and 1 more |
| Oracle Linux 6 | postgresql, postgresql-contrib, postgresql-devel and 7 more | 8.4.20-3.el6_6 |
| Oracle Linux 7 | postgresql, postgresql-contrib, postgresql-devel and 8 more | 9.2.13-1.el7_1 |
| ubuntu 12.04 | postgresql-9.1 | 9.1.16-0ubuntu0.12.04 |
| ubuntu 14.04 | postgresql-9.1, postgresql-9.3 | 9.1.16-0ubuntu0.14.04 and 1 more |
| ubuntu 14.04-ESM | postgresql-9.3 | 9.3.7-0ubuntu0.14.04 |
| ubuntu 14.10 | postgresql-9.4 | 9.4.2-0ubuntu0.14.10 |
| ubuntu 15.04 | postgresql-9.4 | 9.4.2-0ubuntu0.15.04 |
| ubuntu 15.10 | postgresql-9.4 | 9.4.2-1 |
Show all 42 entries from 11 sources
| Source | Package | Fixed in |
|---|---|---|
| amazon linux 1 | postgresql8 | 8.4.20-3.50.amzn1 |
| amazon linux 1 | postgresql8-contrib | 8.4.20-3.50.amzn1 |
| amazon linux 1 | postgresql8-debuginfo | 8.4.20-3.50.amzn1 |
| amazon linux 1 | postgresql8-devel | 8.4.20-3.50.amzn1 |
| amazon linux 1 | postgresql8-docs | 8.4.20-3.50.amzn1 |
| amazon linux 1 | postgresql8-libs | 8.4.20-3.50.amzn1 |
| amazon linux 1 | postgresql8-plperl | 8.4.20-3.50.amzn1 |
| amazon linux 1 | postgresql8-plpython | 8.4.20-3.50.amzn1 |
| amazon linux 1 | postgresql8-pltcl | 8.4.20-3.50.amzn1 |
| amazon linux 1 | postgresql8-server | 8.4.20-3.50.amzn1 |
| amazon linux 1 | postgresql8-test | 8.4.20-3.50.amzn1 |
| debian 7 | postgresql-9.1 | 9.1.16-0+deb7u1 |
| debian 8 | postgresql-9.1 | 9.1.16-0+deb8u1 |
| debian 8 | postgresql-9.4 | 9.4.2-0+deb8u1 |
| Oracle Linux 6 | postgresql | 8.4.20-3.el6_6 |
| Oracle Linux 6 | postgresql-contrib | 8.4.20-3.el6_6 |
| Oracle Linux 6 | postgresql-devel | 8.4.20-3.el6_6 |
| Oracle Linux 6 | postgresql-docs | 8.4.20-3.el6_6 |
| Oracle Linux 6 | postgresql-libs | 8.4.20-3.el6_6 |
| Oracle Linux 6 | postgresql-plperl | 8.4.20-3.el6_6 |
| Oracle Linux 6 | postgresql-plpython | 8.4.20-3.el6_6 |
| Oracle Linux 6 | postgresql-pltcl | 8.4.20-3.el6_6 |
| Oracle Linux 6 | postgresql-server | 8.4.20-3.el6_6 |
| Oracle Linux 6 | postgresql-test | 8.4.20-3.el6_6 |
| Oracle Linux 7 | postgresql | 9.2.13-1.el7_1 |
| Oracle Linux 7 | postgresql-contrib | 9.2.13-1.el7_1 |
| Oracle Linux 7 | postgresql-devel | 9.2.13-1.el7_1 |
| Oracle Linux 7 | postgresql-docs | 9.2.13-1.el7_1 |
| Oracle Linux 7 | postgresql-libs | 9.2.13-1.el7_1 |
| Oracle Linux 7 | postgresql-plperl | 9.2.13-1.el7_1 |
| Oracle Linux 7 | postgresql-plpython | 9.2.13-1.el7_1 |
| Oracle Linux 7 | postgresql-pltcl | 9.2.13-1.el7_1 |
| Oracle Linux 7 | postgresql-server | 9.2.13-1.el7_1 |
| Oracle Linux 7 | postgresql-test | 9.2.13-1.el7_1 |
| Oracle Linux 7 | postgresql-upgrade | 9.2.13-1.el7_1 |
| ubuntu 12.04 | postgresql-9.1 | 9.1.16-0ubuntu0.12.04 |
| ubuntu 14.04 | postgresql-9.1 | 9.1.16-0ubuntu0.14.04 |
| ubuntu 14.04 | postgresql-9.3 | 9.3.7-0ubuntu0.14.04 |
| ubuntu 14.04-ESM | postgresql-9.3 | 9.3.7-0ubuntu0.14.04 |
| ubuntu 14.10 | postgresql-9.4 | 9.4.2-0ubuntu0.14.10 |
| ubuntu 15.04 | postgresql-9.4 | 9.4.2-0ubuntu0.15.04 |
| ubuntu 15.10 | postgresql-9.4 | 9.4.2-1 |
References
- http://ubuntu.com/usn/usn-2621-1
- http://www.debian.org/security/2015/dsa-3269
- http://www.debian.org/security/2015/dsa-3270
- http://www.postgresql.org/about/news/1587/
- http://www.postgresql.org/docs/9.0/static/release-9-0-20.html
- http://www.postgresql.org/docs/9.1/static/release-9-1-16.html
- http://www.postgresql.org/docs/9.2/static/release-9-2-11.html
- http://www.postgresql.org/docs/9.3/static/release-9-3-7.html
All 15 references
- http://www.postgresql.org/docs/9.4/static/release-9-4-2.html
- https://access.redhat.com/security/cve/CVE-2015-3166
- https://linux.oracle.com/cve/CVE-2015-3166.html
- https://linux.oracle.com/errata/ELSA-2015-1194.html
- https://nvd.nist.gov/vuln/detail/CVE-2015-3166
- https://ubuntu.com/security/notices/USN-2621-1
- https://www.cve.org/CVERecord?id=CVE-2015-3166