CVE-2007-2138: canonical ubuntu_linux

CVSS: 6.0v2.0MediumModified

AliasesRHSA-2007:0336RHSA-2007:0337DSA-1309-1+1 more

Published 24-04-2007Last modified 07-08-2024

Vulnerability summary

CVE-2007-2138 is a medium (CVSS 6.0) vulnerability in canonical ubuntu_linux. EPSS estimates a 3.69% chance of exploitation in the next 30 days, higher than 89.5% of scored vulnerabilities.

Overall risk

25/100

0100

Medium · default modelHow is this calculated?

CVSS score

6.0/10

010

Medium · v2.0 (NVD)

EPSS score

3.69%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Timeline

24-04-2007
PublishedVulnerability first disclosed.
07-08-2024
Last modifiedVulnerability information updated.

Description

Untrusted search path vulnerability in PostgreSQL before 7.3.19, 7.4.x before 7.4.17, 8.0.x before 8.0.13, 8.1.x before 8.1.9, and 8.2.x before 8.2.4 allows remote authenticated users, when permitted to call a SECURITY DEFINER function, to gain the privileges of the function owner, related to "search_path settings."

CVSS metrics

1 score · 1 source · 1 version

v2.06.0

EPSS trend

Probability

3.69%

Chance of exploitation in the next 30 days

Percentile

90%

Versus all other CVEs

30-day change

0.00 pp

From 3.69% on 20-09-2026

20-09-202620-10-2026

EPSS score

3.69%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-264Permissions, Privileges, and Access ControlsWeaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.

Affected systems

Redhat24 products

postgresql< 0:7.4.17-1.RHEL4.1 | < 0:8.1.9-1.el5 | < 0:8.1.9-1.el4s1.1
postgresql-contrib< 0:7.4.17-1.RHEL4.1 | < 0:8.1.9-1.el5 | < 0:8.1.9-1.el4s1.1
postgresql-debuginfo< 0:7.4.17-1.RHEL4.1 | < 0:8.1.9-1.el5 | < 0:8.1.9-1.el4s1.1
postgresql-devel< 0:7.4.17-1.RHEL4.1 | < 0:8.1.9-1.el5 | < 0:8.1.9-1.el4s1.1
postgresql-docs< 0:7.4.17-1.RHEL4.1 | < 0:8.1.9-1.el5 | < 0:8.1.9-1.el4s1.1

Show all 24

Debian4 products

postgresql< 7.4.7-6sarge5
postgresql-7.4< 1:7.4.17-0etch1
postgresql-8.1< 8.1.9-0etch1
debian_linuxEOL3.1 | 4.0

Canonical1 product

ubuntu_linuxEOL6.06 | 6.10 | 7.04

Postgresql1 product

postgresql< 7.3.19 | ≥ 7.4, < 7.4.17 | ≥ 8.0, < 8.0.13 | ≥ 8.1, < 8.1.9 | ≥ 8.2, < 8.2.4

4 vendors · 30 products

References

42 links

secunia.com/advisories/25334Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/25717Third Party AdvisoryX Refsource SECUNIA
www.trustix.org/errata/2007/0015/Vendor AdvisoryX Refsource TRUSTIXBroken Link
www.postgresql.org/about/news.791X Refsource CONFIRMPatchVendor Advisory
secunia.com/advisories/25058Third Party AdvisoryX Refsource SECUNIA
security.gentoo.org/glsa/glsa-200705-12.xmlVendor AdvisoryX Refsource GENTOOThird Party Advisory
www.mandriva.com/security/advisories?name=MDKSA-2007:094Vendor AdvisoryX Refsource MANDRIVAThird Party Advisory
issues.rpath.com/browse/RPL-1292X Refsource CONFIRMBroken Link
secunia.com/advisories/24999Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/25037Third Party AdvisoryX Refsource SECUNIA

Show all 42 references

secunia.com/advisories/24989Third Party AdvisoryX Refsource SECUNIA
www.securityfocus.com/bid/23618VDB EntryX Refsource BIDThird Party Advisory
support.avaya.com/elmodocs2/security/ASA-2007-190.htmX Refsource CONFIRMThird Party Advisory
www.redhat.com/support/errata/RHSA-2007-0337.htmlVendor AdvisoryX Refsource REDHATThird Party Advisory
secunia.com/advisories/25725Third Party AdvisoryX Refsource SECUNIA
www.postgresql.org/support/security.htmlX Refsource CONFIRMPatchVendor Advisory
www.securitytracker.com/id?1017974VDB EntryX Refsource SECTRACKThird Party Advisory
exchange.xforce.ibmcloud.com/vulnerabilities/33842VDB EntryX Refsource XFThird Party Advisory
secunia.com/advisories/25720Third Party AdvisoryX Refsource SECUNIA
www.debian.org/security/2007/dsa-1311Vendor AdvisoryX Refsource DEBIANThird Party Advisory
www.debian.org/security/2007/dsa-1309Vendor AdvisoryX Refsource DEBIANThird Party Advisory
www.vupen.com/english/advisories/2007/1549VDB EntryX Refsource VUPENThird Party Advisory
secunia.com/advisories/25019Third Party AdvisoryX Refsource SECUNIA
www.ubuntu.com/usn/usn-454-1Vendor AdvisoryX Refsource UBUNTUThird Party Advisory
secunia.com/advisories/25238Third Party AdvisoryX Refsource SECUNIA
rhn.redhat.com/errata/RHSA-2007-0336.htmlVendor AdvisoryX Refsource REDHATThird Party Advisory
sunsolve.sun.com/search/document.do?assetkey=1-26-102894-1Vendor AdvisoryX Refsource SUNALERTBroken Link
secunia.com/advisories/25184Third Party AdvisoryX Refsource SECUNIA
www.vupen.com/english/advisories/2007/1497VDB EntryX Refsource VUPENThird Party Advisory
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10090VDB EntrySignatureX Refsource OVALThird Party Advisory
secunia.com/advisories/25005Third Party AdvisoryX Refsource SECUNIA
access.redhat.com/errata/RHSA-2007:0336Advisory
access.redhat.com/security/updates/classification/ARTICLE
bugzilla.redhat.com/show_bug.cgi?id=237680REPORT
security.access.redhat.com/data/csaf/v2/advisories/2007/rhsa-2007_0336.jsonAdvisory
access.redhat.com/security/cve/CVE-2007-2138REPORT
bugzilla.redhat.com/show_bug.cgi?id=237682REPORT
www.cve.org/CVERecord?id=CVE-2007-2138Advisory
nvd.nist.gov/vuln/detail/CVE-2007-2138Advisory
access.redhat.com/errata/RHSA-2007:0337Advisory
bugzilla.redhat.com/show_bug.cgi?id=237681REPORT
security.access.redhat.com/data/csaf/v2/advisories/2007/rhsa-2007_0337.jsonAdvisory

Vulnerability summary

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities