SB2016101859 - Multiple vulnerabilities in PostgreSQL

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2016101859

SB2016101859 - Multiple vulnerabilities in PostgreSQL

Published: October 18, 2016 Updated: June 23, 2025

Security Bulletin ID SB2016101859
Severity
High
Patch available
YES
Number of vulnerabilities 5
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 20% Medium 20% Low 60%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 5 secuirty vulnerabilities.


1) Input validation error (CVE-ID: CVE-2002-1402)

The vulnerability allows a local user to read and manipulate data.

Buffer overflows in the (1) TZ and (2) SET TIME ZONE enivronment variables for PostgreSQL 7.2.1 and earlier allow local users to cause a denial of service and possibly execute arbitrary code.


2) Input validation error (CVE-ID: CVE-2002-1400)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

Heap-based buffer overflow in the repeat() function for PostgreSQL before 7.2.2 allows attackers to execute arbitrary code by causing repeat() to generate a large string.


3) Input validation error (CVE-ID: CVE-2002-1399)

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

Unknown vulnerability in cash_out and possibly other functions in PostgreSQL 7.2.1 and earlier, and possibly later versions before 7.2.3, with unknown impact, based on an invalid integer input which is processed as a different data type, as demonstrated using cash_out(2).


4) Input validation error (CVE-ID: CVE-2002-1398)

The vulnerability allows a local user to read and manipulate data.

Buffer overflow in the date parser for PostgreSQL before 7.2.2 allows attackers to cause a denial of service and possibly execute arbitrary code via a long date string, aka a vulnerability "in handling long datetime input."


5) Input validation error (CVE-ID: CVE-2002-1642)

The vulnerability allows a local user to execute arbitrary code.

PostgreSQL 7.2.1 and 7.2.2 allows local users to delete transaction log (pg_clog) data and cause a denial of service (data loss) via the VACUUM command.


Remediation

Install update from vendor's website.

References