Wind River Support Network

HomeDefectsLIN6-9989
Fixed

LIN6-9989 : Security Advisory - postgresql - CVE-2015-0242

Created: Jun 12, 2015    Updated: Dec 3, 2018
Resolved Date: Jul 8, 2015
Previous ID: LIN4-32728
Found In Version: 6.0.0.20
Fix Version: 6.0.0.23
Severity: Standard
Applicable for: Wind River Linux 6
Component/s: Userspace

Description

The PostgreSQL project reports the following issue:

PostgreSQL includes a replacement implementation of printf and related functions. This code will overrun a stack buffer when formatting a floating point number (conversion specifiers e, E, f, F, g or G) with requested precision greater than about 500. This will crash the server, and we have not ruled out the possibility of attacks that lead to privilege escalation. A database user can trigger such a buffer overrun through the to_char() SQL function. While that is the only affected core PostgreSQL functionality, extension modules that use printf-family functions may be at risk as well.

This issue primarily affects PostgreSQL on Windows. PostgreSQL uses the system implementation of these functions where adequate, which it is on other modern platforms.

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0242

Other Downloads


Live chat
Online