rhsa-2005_150
Vulnerability from csaf_redhat
Published
2005-02-16 16:25
Modified
2024-09-15 15:13
Summary
Red Hat Security Advisory: postgresql security update
Notes
Topic
Updated PostgreSQL packages to fix various security flaws are now available
for Red Hat Enterprise Linux 2.1AS.
This update has been rated as having important security impact by the Red
Hat Security Response Team.
Details
PostgreSQL is an advanced Object-Relational database management system
(DBMS).
A flaw in the LOAD command in PostgreSQL was discovered. A local user
could use this flaw to load arbitrary shared libraries and therefore
execute arbitrary code, gaining the privileges of the PostgreSQL server.
The Common Vulnerabilities and Exposures project (cve.mitre.org) has
assigned the name CAN-2005-0227 to this issue.
Multiple buffer overflows were found in PL/PgSQL. A database user who has
permissions to create plpgsql functions could trigger this flaw which could
lead to arbitrary code execution, gaining the privileges of the PostgreSQL
server. The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the names CAN-2005-0245 and CAN-2005-0247 to these issues.
Users of PostgreSQL are advised to update to these erratum packages which
are not vulnerable to these issues.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_vex",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Updated PostgreSQL packages to fix various security flaws are now available\nfor Red Hat Enterprise Linux 2.1AS.\n\nThis update has been rated as having important security impact by the Red\nHat Security Response Team.",
"title": "Topic"
},
{
"category": "general",
"text": "PostgreSQL is an advanced Object-Relational database management system\n(DBMS).\n\nA flaw in the LOAD command in PostgreSQL was discovered. A local user\ncould use this flaw to load arbitrary shared libraries and therefore\nexecute arbitrary code, gaining the privileges of the PostgreSQL server. \nThe Common Vulnerabilities and Exposures project (cve.mitre.org) has\nassigned the name CAN-2005-0227 to this issue.\n\nMultiple buffer overflows were found in PL/PgSQL. A database user who has\npermissions to create plpgsql functions could trigger this flaw which could\nlead to arbitrary code execution, gaining the privileges of the PostgreSQL\nserver. The Common Vulnerabilities and Exposures project (cve.mitre.org)\nhas assigned the names CAN-2005-0245 and CAN-2005-0247 to these issues.\n\nUsers of PostgreSQL are advised to update to these erratum packages which\nare not vulnerable to these issues.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat offerings.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2005:150",
"url": "https://access.redhat.com/errata/RHSA-2005:150"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "130818",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=130818"
},
{
"category": "external",
"summary": "147703",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=147703"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/data/csaf/v2/advisories/2005/rhsa-2005_150.json"
}
],
"title": "Red Hat Security Advisory: postgresql security update",
"tracking": {
"current_release_date": "2024-09-15T15:13:34+00:00",
"generator": {
"date": "2024-09-15T15:13:34+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "3.33.3"
}
},
"id": "RHSA-2005:150",
"initial_release_date": "2005-02-16T16:25:00+00:00",
"revision_history": [
{
"date": "2005-02-16T16:25:00+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2005-02-16T00:00:00+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-09-15T15:13:34+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux AS (Advanced Server) version 2.1 ",
"product": {
"name": "Red Hat Enterprise Linux AS (Advanced Server) version 2.1 ",
"product_id": "Red Hat Enterprise Linux AS (Advanced Server) version 2.1 ",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:2.1::as"
}
}
},
{
"category": "product_name",
"name": "Red Hat Linux Advanced Workstation 2.1",
"product": {
"name": "Red Hat Linux Advanced Workstation 2.1",
"product_id": "Red Hat Linux Advanced Workstation 2.1",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:2.1::aw"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux ES version 2.1",
"product": {
"name": "Red Hat Enterprise Linux ES version 2.1",
"product_id": "Red Hat Enterprise Linux ES version 2.1",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:2.1::es"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux WS version 2.1",
"product": {
"name": "Red Hat Enterprise Linux WS version 2.1",
"product_id": "Red Hat Enterprise Linux WS version 2.1",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:2.1::ws"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
}
],
"category": "vendor",
"name": "Red Hat"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2005-0227",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1617499"
}
],
"notes": [
{
"category": "description",
"text": "PostgreSQL (pgsql) 7.4.x, 7.2.x, and other versions allows local users to load arbitrary shared libraries and execute code via the LOAD extension.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "security flaw",
"title": "Vulnerability summary"
}
],
"product_status": {
"fixed": [
"Red Hat Enterprise Linux AS (Advanced Server) version 2.1 ",
"Red Hat Enterprise Linux ES version 2.1",
"Red Hat Enterprise Linux WS version 2.1",
"Red Hat Linux Advanced Workstation 2.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2005-0227"
},
{
"category": "external",
"summary": "RHBZ#1617499",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1617499"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2005-0227",
"url": "https://www.cve.org/CVERecord?id=CVE-2005-0227"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2005-0227",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2005-0227"
}
],
"release_date": "2005-01-21T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied. Use Red Hat\nNetwork to download and update your packages. To launch the Red Hat\nUpdate Agent, use the following command:\n\n up2date\n\nFor information on how to install packages manually, refer to the\nfollowing Web page for the System Administration or Customization\nguide specific to your system:\n\n http://www.redhat.com/docs/manuals/enterprise/",
"product_ids": [
"Red Hat Enterprise Linux AS (Advanced Server) version 2.1 ",
"Red Hat Enterprise Linux ES version 2.1",
"Red Hat Enterprise Linux WS version 2.1",
"Red Hat Linux Advanced Workstation 2.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2005:150"
}
],
"title": "security flaw"
},
{
"cve": "CVE-2005-0245",
"discovery_date": "2005-02-07T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1617506"
}
],
"notes": [
{
"category": "description",
"text": "Buffer overflow in gram.y for PostgreSQL 8.0.0 and earlier may allow attackers to execute arbitrary code via a large number of arguments to a refcursor function (gram.y), which leads to a heap-based buffer overflow, a different vulnerability than CVE-2005-0247.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "security flaw",
"title": "Vulnerability summary"
}
],
"product_status": {
"fixed": [
"Red Hat Enterprise Linux AS (Advanced Server) version 2.1 ",
"Red Hat Enterprise Linux ES version 2.1",
"Red Hat Enterprise Linux WS version 2.1",
"Red Hat Linux Advanced Workstation 2.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2005-0245"
},
{
"category": "external",
"summary": "RHBZ#1617506",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1617506"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2005-0245",
"url": "https://www.cve.org/CVERecord?id=CVE-2005-0245"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2005-0245",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2005-0245"
}
],
"release_date": "2005-01-20T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied. Use Red Hat\nNetwork to download and update your packages. To launch the Red Hat\nUpdate Agent, use the following command:\n\n up2date\n\nFor information on how to install packages manually, refer to the\nfollowing Web page for the System Administration or Customization\nguide specific to your system:\n\n http://www.redhat.com/docs/manuals/enterprise/",
"product_ids": [
"Red Hat Enterprise Linux AS (Advanced Server) version 2.1 ",
"Red Hat Enterprise Linux ES version 2.1",
"Red Hat Enterprise Linux WS version 2.1",
"Red Hat Linux Advanced Workstation 2.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2005:150"
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "security flaw"
},
{
"cve": "CVE-2005-0247",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1617508"
}
],
"notes": [
{
"category": "description",
"text": "Multiple buffer overflows in gram.y for PostgreSQL 8.0.1 and earlier may allow attackers to execute arbitrary code via (1) a large number of variables in a SQL statement being handled by the read_sql_construct function, (2) a large number of INTO variables in a SELECT statement being handled by the make_select_stmt function, (3) a large number of arbitrary variables in a SELECT statement being handled by the make_select_stmt function, and (4) a large number of INTO variables in a FETCH statement being handled by the make_fetch_stmt function, a different set of vulnerabilities than CVE-2005-0245.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "security flaw",
"title": "Vulnerability summary"
}
],
"product_status": {
"fixed": [
"Red Hat Enterprise Linux AS (Advanced Server) version 2.1 ",
"Red Hat Enterprise Linux ES version 2.1",
"Red Hat Enterprise Linux WS version 2.1",
"Red Hat Linux Advanced Workstation 2.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2005-0247"
},
{
"category": "external",
"summary": "RHBZ#1617508",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1617508"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2005-0247",
"url": "https://www.cve.org/CVERecord?id=CVE-2005-0247"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2005-0247",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2005-0247"
}
],
"release_date": "2005-02-01T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied. Use Red Hat\nNetwork to download and update your packages. To launch the Red Hat\nUpdate Agent, use the following command:\n\n up2date\n\nFor information on how to install packages manually, refer to the\nfollowing Web page for the System Administration or Customization\nguide specific to your system:\n\n http://www.redhat.com/docs/manuals/enterprise/",
"product_ids": [
"Red Hat Enterprise Linux AS (Advanced Server) version 2.1 ",
"Red Hat Enterprise Linux ES version 2.1",
"Red Hat Enterprise Linux WS version 2.1",
"Red Hat Linux Advanced Workstation 2.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2005:150"
}
],
"title": "security flaw"
}
]
}
Loading...