p PatchFirst

CVE-2015-0244

CVE-2015-0244

This page contains facts from public vulnerability sources. Check the original advisory before updating.

PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1 does not properly handle errors while reading a protocol message, which allows remote attackers to conduct SQL injection attacks via crafted binary data in a parameter and causing an error, which triggers the loss of synchronization and part of the protocol message to be treated as a new message, as demonstrated by causing a timeout or query cancellation.

CVSS 9.8 · Critical · EPSS 4.4% · Fix available

Published
Updated

Stack: system · database

Affected products and versions

  • postgresql

    Versions
    • before 9.0.19: Affected
    • 9.1.x before 9.1.15: Affected
    • 9.2.x before 9.2.10: Affected
    • 9.3.x before 9.3.6: Affected
    • 9.4.x before 9.4.1: Affected

    No fix published

  • postgresql-9.1 Ubuntu:14.04:LTS

    Versions
    • 9.1.10-1
    • 9.1.10-1bzr1
    • 9.1.11-1
    • 9.1.11-2
    • 9.1.12-1
    • 9.1.13-1
    • 9.1.14-0ubuntu0.14.04
    Affected ranges
    • ECOSYSTEM: < 9.1.15-0ubuntu0.14.04

    Update to 9.1.15-0ubuntu0.14.04

  • postgresql-9.3 Ubuntu:14.04:LTS

    Versions
    • 9.3.1-1
    • 9.3.2-1
    • 9.3.2-1ubuntu1
    • 9.3.2-1ubuntu2
    • 9.3.3-1
    • 9.3.3-1bzr1
    • 9.3.3-1bzr2
    • 9.3.4-1
    • 9.3.5-0ubuntu0.14.04.1
    Affected ranges
    • ECOSYSTEM: < 9.3.6-0ubuntu0.14.04

    Update to 9.3.6-0ubuntu0.14.04

Original sources

Check your server →