Public bug reported: Binary package hint: postgresql
References: MDVSA-2008:004 (http://www.mandriva.com/en/security/advisories?name=MDVSA-2008:004) Quoting: "Index Functions Privilege Escalation (CVE-2007-6600): as a unique feature, PostgreSQL allows users to create indexes on the results of user-defined functions, known as expression indexes. This provided two vulnerabilities to privilege escalation: (1) index functions were executed as the superuser and not the table owner during VACUUM and ANALYZE, and (2) that SET ROLE and SET SESSION AUTHORIZATION were permitted within index functions. Regular Expression Denial-of-Service (CVE-2007-4772, CVE-2007-6067, CVE-2007-4769): three separate issues in the regular expression libraries used by PostgreSQL allowed malicious users to initiate a denial-of-service by passing certain regular expressions in SQL queries. First, users could create infinite loops using some specific regular expressions. Second, certain complex regular expressions could consume excessive amounts of memory. Third, out-of-range backref numbers could be used to crash the backend. DBLink Privilege Escalation (CVE-2007-6601): DBLink functions combined with local trust or ident authentication could be used by a malicious user to gain superuser privileges. This issue has been fixed, and does not affect users who have not installed DBLink (an optional module), or who are using password authentication for local access. This same problem was addressed in the previous release cycle (see CVE-2007-3278), but that patch failed to close all forms of the loophole. Updated packages fix these issues by upgrading to the latest maintenance versions of PostgreSQL." ** Affects: postgresql (Ubuntu) Importance: Undecided Status: New ** Visibility changed to: Public ** CVE added: http://www.cve.mitre.org/cgi- bin/cvename.cgi?name=2007-6600 ** CVE added: http://www.cve.mitre.org/cgi- bin/cvename.cgi?name=2007-4772 ** CVE added: http://www.cve.mitre.org/cgi- bin/cvename.cgi?name=2007-6067 ** CVE added: http://www.cve.mitre.org/cgi- bin/cvename.cgi?name=2007-4769 ** CVE added: http://www.cve.mitre.org/cgi- bin/cvename.cgi?name=2007-6601 -- [postgresql] multiple vulnerabilities https://bugs.launchpad.net/bugs/181720 You received this bug notification because you are a member of Ubuntu Bugs, which is the bug contact for Ubuntu. -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
