Multiple vulnerabilities in PostgreSQL

Description

Multiple serious vulnerabilities have been found in PostgreSQL. Malicious users can exploit these vulnerabilities to cause denial of service or obtain sensitive information.

Below is a complete list of vulnerabilities

1. An unknown vulnerability can be exploited via a specially designed user input to cause denial of service;
2. An unknown vulnerability at pgCrypto can be exploited to obtain sensitive information.

---

Technical details

Vulnerability (1) caused by erroneous json or jsonb construction from input.

(2) caused by crypt function and can be triggered via ‘too-short’ salt to read arbitrary server memory.

Original advisories

• Release note

Related products

• PostgreSQL

CVE list

• CVE-2015-5289
  high
• CVE-2015-5288
  high

Read more

Find out the statistics of the vulnerabilities spreading in your region on statistics.securelist.com