Security Update for postgresql-9.1
Summary
DSA-3155-1: postgresql-9.1 - security update. Affects postgresql-9.1 versions < 9.1.15-0+deb7u1. Fixed in 9.1.15-0+deb7u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PostgreSQL-9.1 is a SQL database system used for managing relational databases. It provides various features and functionalities for storing and retrieving data. However, several vulnerabilities have been discovered in PostgreSQL-9.1, which could potentially compromise the security and integrity of the database system.
Vulnerability Detail
The vulnerabilities in PostgreSQL-9.1 include:
-
Information Leak (CVE-2014-8161): A user with limited clearance on a table may gain access to information in columns without SELECT rights through server error messages.
-
Out of Boundaries Read/Write (CVE-2015-0241): The function to_char() may read/write beyond the end of a buffer, leading to a server crash when processing formatting templates.
-
Buffer Overruns in contrib/pgcrypto (CVE-2015-0243): The pgcrypto module is vulnerable to stack buffer overruns, which could result in a server crash.
-
SQL Command Injection (CVE-2015-0244): An attacker can inject SQL commands when the synchronization between the client and server is lost.
How To Fix
Minimum fixed version
9.1.15-0+deb7u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade postgresql-9.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no specific workarounds mentioned for these vulnerabilities.
Conclusion
PostgreSQL-9.1 is affected by multiple vulnerabilities that could lead to information leaks, server crashes, and SQL command injection. To address these issues, it is crucial to upgrade to the recommended versions mentioned above. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for postgresql-9.1 →
FAQ
The information leak vulnerability allows a user with limited clearance to access data in columns without proper permissions. This could potentially expose sensitive information to unauthorized individuals.
The out of boundaries read/write vulnerability in the to_char() function can cause the server to crash when processing formatting templates. This can lead to service disruption and potential data loss.
The buffer overruns in the pgcrypto module can result in a server crash. This can impact the availability and reliability of the PostgreSQL-9.1 database system.
The SQL command injection vulnerability allows an attacker to inject malicious SQL commands when the client-server synchronization is lost. This can lead to unauthorized access, data manipulation, or other malicious activities.
Specific exploits for these vulnerabilities have not been mentioned in the provided information. However, it is always recommended to promptly apply security updates to mitigate the risk of potential exploits.
Related vulnerabilities
Recent vulnerabilities recorded for postgresql-9.1.
