PostgreSQL before 9.1.23, 9.2.x before 9.2.18, 9.3.x before 9.3.14, 9.4.x before 9.4.9, and 9.5.x before 9.5.4 allow remote authenticated u…
PostgreSQL before 9.1.23, 9.2.x before 9.2.18, 9.3.x before 9.3.14, 9.4.x before 9.4.9, and 9.5.x before 9.5.4 allow remote authenticated users to cause a denial of service (NULL pointer dereference and server crash), obtain sensitive memory information, or possibly execute arbitrary code via (1) a CASE expression within the test value subexpression of another CASE or (2) inlining of an SQL function that implements the equality operator used for a CASE expression involving values of different types.
The product dereferences a pointer that it expects to be valid but is NULL.
https://cwe.mitre.org/data/definitions/476.html →Open in CWE collection →The product obtains a value from an untrusted source, converts this value to a pointer, and dereferences the resulting pointer.
https://cwe.mitre.org/data/definitions/822.html →Open in CWE collection →The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
https://cwe.mitre.org/data/definitions/94.html →Open in CWE collection →An attack of this type exploits a system's trust in configuration and resource files. When the executable loads the resource (such as an image file or configuration file) the attacker has modified the file to either execute malicious code directly or manipulate the target process (e.g. application server) to execute based on the malicious configuration parameters. Since systems are increasingly interrelated mashing up resources from local and remote sources the possibility of this attack occurring is high.
https://capec.mitre.org/data/definitions/35.html →Open in CAPEC collection →This attack targets user controlled variables (DEBUG=1, PHP Globals, and So Forth). An adversary can override variables leveraging user-supplied, untrusted query variables directly used on the application server without any data sanitization. In extreme cases, the adversary can change variables controlling the business logic of the application. For instance, in languages like PHP, a number of poorly set default configurations may allow the user to override variables.
https://capec.mitre.org/data/definitions/77.html →Open in CAPEC collection →This attack pattern involves an adversary manipulating a pointer within a target application resulting in the application accessing an unintended memory location. This can result in the crashing of the application or, for certain pointer values, access to data that would not normally be possible or the execution of arbitrary code. Since pointers are simply integer variables, Integer Attacks may often be used in Pointer Attacks.
https://capec.mitre.org/data/definitions/129.html →Open in CAPEC collection →An adversary exploits a weakness in input validation on the target to inject new code into that which is currently executing. This differs from code inclusion in that code inclusion involves the addition or replacement of a reference to a code file, which is subsequently loaded by the target and used as part of the code of some application.
https://capec.mitre.org/data/definitions/242.html →Open in CAPEC collection →| Product | Vendor | Status |
|---|---|---|
| i586-libecpg6.7 | Tracked | |
| i586-libecpg6.7-devel | Tracked | |
| i586-libecpg6.7-devel-static | Tracked | |
| i586-libpq5.8 | Tracked | |
| i586-libpq5.8-devel | Tracked | |
| i586-libpq5.8-devel-static | Tracked | |
| i586-postgresql9.5-contrib | Tracked | |
| i586-postgresql9.5-devel-static | Tracked | |
| i586-postgresql9.5-perl | Tracked | |
| i586-postgresql9.5-python | Tracked | |
| i586-postgresql9.5-server | Tracked | |
| i586-postgresql9.5-tcl | Tracked | |
| libecpg6.7 | Tracked | |
| libecpg6.7-devel | Tracked | |
| libecpg6.7-devel-static | Tracked | |
| libpq5.8 | Tracked | |
| libpq5.8-devel | Tracked | |
| libpq5.8-devel-static | Tracked | |
| postgresql | Tracked | |
| postgresql-9.1 | Tracked |