MGASA-2019-0225: postgresql9.6 Mageia

Vulnerability summary

MGASA-2019-0225 is a vulnerability in postgresql9.6 Mageia with no CVSS score yet.

Timeline

1. 18-08-2019
   PublishedVulnerability first disclosed.
2. 16-04-2026
   Last modifiedVulnerability information updated.

Description

Updated postgresql packages fix security vulnerabilities Updated postgresql packages fix security vulnerabilities: Given a suitable SECURITY DEFINER function, an attacker can execute arbitrary SQL under the identity of the function owner. An attack requires EXECUTE permission on the function, which must itself contain a function call having inexact argument type match. For example, length('foo'::varchar) and length('foo') are inexact, while length('foo'::text) is exact (CVE-2019-10208). In a database containing hypothetical, user-defined hash equality operators, an attacker could read arbitrary bytes of server memory. For an attack to become possible, a superuser would need to create unusual operators. It is possible for operators not purpose-crafted for attack to have the properties that enable an attack, but we are not aware of specific examples (CVE-2019-10209). This update also fixes over 40 bugs that were reported in the last several months. See the upstream release notes for details.

No weakness data has been published for this record.