Bug 1065230 (CVE-2014-0064)

Summary:	CVE-2014-0064 postgresql: integer overflows leading to buffer overflows
Product:	[Other] Security Response	Reporter:	Murray McAllister <mmcallis>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	dajohnso, gmollett, praiskup, security-response-team, xlecauch
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-10-20 10:43:25 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1065839, 1065840, 1065841, 1065842, 1065843, 1065844, 1065845, 1065855, 1065861, 1069071, 1069072
Bug Blocks:	1065240, 1095075

Description Murray McAllister 2014-02-14 07:31:58 UTC

Multiple integer overflow flaws, leading to buffer overflows, were found in PostgreSQL. An authenticated database user could possibly use these flaws to crash the PostgreSQL server or execute arbitrary code.

Acknowledgements:

Red Hat would like to thank the PostgreSQL project for reporting this issue. Upstream acknowledges Heikki Linnakangas and Noah Misch as the original reporters.

Comment 5 Vincent Danen 2014-02-18 23:16:15 UTC

This is now public:

https://github.com/postgres/postgres/commit/31400a673325147e1205326008e32135a78b4d8a

Comment 7 errata-xmlrpc 2014-02-25 16:44:23 UTC

This issue has been addressed in following products:

  Red Hat Enterprise Linux 6
  Red Hat Enterprise Linux 5

Via RHSA-2014:0211 https://rhn.redhat.com/errata/RHSA-2014-0211.html

Comment 8 errata-xmlrpc 2014-02-27 18:23:41 UTC

This issue has been addressed in following products:

  Red Hat Software Collections for RHEL-6

Via RHSA-2014:0221 https://rhn.redhat.com/errata/RHSA-2014-0221.html

Comment 9 errata-xmlrpc 2014-03-04 19:11:49 UTC

This issue has been addressed in following products:

  Red Hat Enterprise Linux 5

Via RHSA-2014:0249 https://rhn.redhat.com/errata/RHSA-2014-0249.html

Comment 10 Vincent Danen 2014-03-28 20:24:05 UTC

MITRE split this and created CVE-2014-2669 for the hstore_io.c issues; see bug #1082154 for details.

Comment 12 errata-xmlrpc 2014-05-12 18:16:45 UTC

This issue has been addressed in following products:

  CloudForms Management Engine 5.x

Via RHSA-2014:0469 https://rhn.redhat.com/errata/RHSA-2014-0469.html