|
|
| |
|
| |
postgresql: multiple vulnerabilities
| Package(s): | postgresql |
CVE #(s): | CVE-2012-0866
CVE-2012-0867
CVE-2012-0868
|
| Created: | February 27, 2012 |
Updated: | September 28, 2012 |
| Description: |
From the Debian advisory:
CVE-2012-0866:
It was discovered that the permissions of a function called by a
trigger are not checked. This could result in privilege escalation.
CVE-2012-0867:
It was discovered that only the first 32 characters of a host name
are checked when validating host names through SSL certificates.
This could result in spoofing the connection in limited
circumstances.
CVE-2012-0868:
It was discovered that pg_dump did not sanitise object names.
This could result in arbitrary SQL command execution if a
malformed dump file is opened.
See the PostgreSQL 9.1.3, 9.0.7, 8.4.11 and 8.3.18 update announcement for more information. |
| Alerts: |
|
( Log in to post comments)
|
|
|