CVSS: 7.5EPSS: 15%CPEs: 44EXPL: 0CVE-2015-3165 – postgresql: double-free after authentication timeout
https://notcve.org/view.php?id=CVE-2015-3165
22 May 2015 — Double free vulnerability in PostgreSQL before 9.0.20, 9.1.x before 9.1.16, 9.2.x before 9.2.11, 9.3.x before 9.3.7, and 9.4.x before 9.4.2 allows remote attackers to cause a denial of service (crash) by closing an SSL session at a time when the authentication timeout will expire during the session shutdown sequence. Vulnerabilidad de doble liberación en PostgreSQL anterior a 9.0.20, 9.1.x anterior a 9.1.16, 9.2.x anterior a 9.2.11, 9.3.x anterior a 9.3.7, y 9.4.x anterior a 9.4.2 permite a atacantes remoto... • http://lists.apple.com/archives/security-announce/2015/Sep/msg00004.html • CWE-416: Use After Free •
CVSS: 7.5EPSS: 0%CPEs: 12EXPL: 0CVE-2015-3167 – postgresql: pgcrypto has multiple error messages for decryption with an incorrect key.
https://notcve.org/view.php?id=CVE-2015-3167
22 May 2015 — contrib/pgcrypto in PostgreSQL before 9.0.20, 9.1.x before 9.1.16, 9.2.x before 9.2.11, 9.3.x before 9.3.7, and 9.4.x before 9.4.2 uses different error responses when an incorrect key is used, which makes it easier for attackers to obtain the key via a brute force attack. contrib/pgcrypto en PostgreSQL versiones anteriores a 9.0.20, versiones 9.1.x anteriores a 9.1.16, versiones 9.2.x anteriores a 9.2.11, versiones 9.3.x anteriores a 9.3.7 y versiones 9.4.x anteriores a 9.4.2, utiliza diferentes respuestas ... • http://ubuntu.com/usn/usn-2621-1 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-209: Generation of Error Message Containing Sensitive Information •
CVSS: 8.8EPSS: 0%CPEs: 8EXPL: 0CVE-2015-0242 – Gentoo Linux Security Advisory 201507-20
https://notcve.org/view.php?id=CVE-2015-0242
30 Mar 2015 — Stack-based buffer overflow in the *printf function implementations in PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1, when running on a Windows system, allows remote authenticated users to cause a denial of service (crash) and possibly execute arbitrary code via a floating point number with a large precision, as demonstrated by using the to_char function. Un desbordamiento del búfer en la región stack de la memoria en las implementaciones de l... • http://www.debian.org/security/2015/dsa-3155 • CWE-787: Out-of-bounds Write •
CVSS: 4.3EPSS: 0%CPEs: 7EXPL: 0CVE-2014-8161 – postgresql: information leak through constraint violation errors
https://notcve.org/view.php?id=CVE-2014-8161
09 Feb 2015 — PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1 allows remote authenticated users to obtain sensitive column values by triggering constraint violation and then reading the error message. PostgreSQL versiones anteriores a 9.0.19, versiones 9.1.x anteriores a 9.1.15, versiones 9.2.x anteriores a 9.2.10, versiones 9.3.x anteriores a 9.3.6 y versiones 9.4.x anteriores a 9.4.1, permite a usuarios autenticados remotos obtener valores de columna confid... • http://www.debian.org/security/2015/dsa-3155 • CWE-209: Generation of Error Message Containing Sensitive Information CWE-300: Channel Accessible by Non-Endpoint •
CVSS: 9.8EPSS: 0%CPEs: 7EXPL: 0CVE-2015-0244 – postgresql: loss of frontend/backend protocol synchronization after an error
https://notcve.org/view.php?id=CVE-2015-0244
09 Feb 2015 — PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1 does not properly handle errors while reading a protocol message, which allows remote attackers to conduct SQL injection attacks via crafted binary data in a parameter and causing an error, which triggers the loss of synchronization and part of the protocol message to be treated as a new message, as demonstrated by causing a timeout or query cancellation. PostgreSQL versiones anteriores a 9.0.19, v... • http://www.debian.org/security/2015/dsa-3155 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') CWE-300: Channel Accessible by Non-Endpoint •
CVSS: 8.8EPSS: 0%CPEs: 7EXPL: 0CVE-2015-0241 – postgresql: buffer overflow in the to_char() function
https://notcve.org/view.php?id=CVE-2015-0241
09 Feb 2015 — The to_char function in PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1 allows remote authenticated users to cause a denial of service (crash) or possibly execute arbitrary code via a (1) large number of digits when processing a numeric formatting template, which triggers a buffer over-read, or (2) crafted timestamp formatting template, which triggers a buffer overflow. La función to_char en PostgreSQL versiones anteriores a 9.0.19, versiones 9.... • http://www.debian.org/security/2015/dsa-3155 • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') CWE-122: Heap-based Buffer Overflow •
CVSS: 8.8EPSS: 0%CPEs: 7EXPL: 0CVE-2015-0243 – postgresql: buffer overflow flaws in contrib/pgcrypto
https://notcve.org/view.php?id=CVE-2015-0243
09 Feb 2015 — Multiple buffer overflows in contrib/pgcrypto in PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1 allow remote authenticated users to cause a denial of service (crash) and possibly execute arbitrary code via unspecified vectors. Múltiples desbordamientos del búfer en contrib/pgcrypto en PostgreSQL versiones anteriores a 9.0.19, versiones 9.1.x anteriores a 9.1.15, versiones 9.2.x anteriores a 9.2.10, versiones 9.3.x anteriores a 9.3.6 y versiones... • http://www.debian.org/security/2015/dsa-3155 • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') CWE-122: Heap-based Buffer Overflow •