SB2008091004 - Buffer overflow in PostgreSQL
Published: September 10, 2008 Updated: June 23, 2025
Security Bulletin ID
SB2008091004
Severity
Medium
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Remote access
Highest impact
Data manipulation
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Buffer overflow (CVE-ID: CVE-2002-1401)
The vulnerability allows a remote user to read and manipulate data.
Buffer overflows in (1) circle_poly, (2) path_encode and (3) path_add (also incorrectly identified as path_addr) for PostgreSQL 7.2.3 and earlier allow attackers to cause a denial of service and possibly execute arbitrary code, possibly as a result of an integer overflow.
Remediation
Install update from vendor's website.
References
- http://archives.postgresql.org/pgsql-hackers/2002-08/msg02047.php
- http://archives.postgresql.org/pgsql-hackers/2002-08/msg02081.php
- http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000524
- http://secunia.com/advisories/8034
- http://www.debian.org/security/2002/dsa-165
- http://www.redhat.com/support/errata/RHSA-2003-001.html