Bug 1364001 (CVE-2016-5423)
| Summary: | CVE-2016-5423 postgresql: CASE/WHEN with inlining can cause untrusted pointer dereference | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Martin Prpič <mprpic> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | bkearney, cpelland, dajohnso, gblomqui, gmccullo, gnaik, gtanzill, hhorak, hhudgeon, jfrey, jhardy, jorton, jprause, obarenbo, praiskup, roliveri, security-response-team, tkasparek, tlestach |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | postgresql 9.5.4, postgresql 9.4.9, postgresql 9.3.14, postgresql 9.2.18, postgresql 9.1.23 | Doc Type: | If docs needed, set a value |
| Doc Text: |
A flaw was found in the way PostgreSQL server handled certain SQL statements containing CASE/WHEN commands. A remote, authenticated attacker could use a specially crafted SQL statement to cause PostgreSQL to crash or disclose a few bytes of server memory or possibly execute arbitrary code.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2019-06-08 02:57:16 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1366344, 1367640, 1367704, 1367705, 1367707, 1367708, 1367709, 1367710 | ||
| Bug Blocks: | 1323912, 1364007 | ||
|
Description
Martin Prpič
2016-08-04 09:05:42 UTC
Acknowledgments: Name: the PostgreSQL project Upstream: Heikki Linnakangas Public via: https://www.postgresql.org/about/news/1688/ Created postgresql tracking bugs for this issue: Affects: fedora-all [bug 1366344] Upstream patch: https://git.postgresql.org/gitweb/?p=postgresql.git;a=commitdiff;h=f0c7b789ab12fbc8248b671c7882dd96ac932ef4 postgresql-9.5.4-1.fc24 has been pushed to the Fedora 24 stable repository. If problems still persist, please make note of it in this bug report. postgresql-9.4.9-1.fc23 has been pushed to the Fedora 23 stable repository. If problems still persist, please make note of it in this bug report. postgresql-9.5.4-1.fc25 has been pushed to the Fedora 25 stable repository. If problems still persist, please make note of it in this bug report. This issue has been addressed in the following products: Red Hat Software Collections for Red Hat Enterprise Linux 6.6 EUS Red Hat Software Collections for Red Hat Enterprise Linux 6.7 EUS Red Hat Software Collections for Red Hat Enterprise Linux 6 Red Hat Software Collections for Red Hat Enterprise Linux 7 Red Hat Software Collections for Red Hat Enterprise Linux 7.2 EUS Red Hat Software Collections for Red Hat Enterprise Linux 7.1 EUS Via RHSA-2016:1781 https://rhn.redhat.com/errata/RHSA-2016-1781.html This issue has been addressed in the following products: Red Hat Software Collections for Red Hat Enterprise Linux 6.6 EUS Red Hat Software Collections for Red Hat Enterprise Linux 6.7 EUS Red Hat Software Collections for Red Hat Enterprise Linux 6 Red Hat Software Collections for Red Hat Enterprise Linux 7 Red Hat Software Collections for Red Hat Enterprise Linux 7.2 EUS Red Hat Software Collections for Red Hat Enterprise Linux 7.1 EUS Via RHSA-2016:1821 https://rhn.redhat.com/errata/RHSA-2016-1821.html This issue has been addressed in the following products: Red Hat Software Collections for Red Hat Enterprise Linux 6.6 EUS Red Hat Software Collections for Red Hat Enterprise Linux 6.7 EUS Red Hat Software Collections for Red Hat Enterprise Linux 6 Red Hat Software Collections for Red Hat Enterprise Linux 7 Red Hat Software Collections for Red Hat Enterprise Linux 7.2 EUS Red Hat Software Collections for Red Hat Enterprise Linux 7.1 EUS Via RHSA-2016:1820 https://rhn.redhat.com/errata/RHSA-2016-1820.html This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2016:2606 https://rhn.redhat.com/errata/RHSA-2016-2606.html This issue has been addressed in the following products: Red Hat Satellite 5.7 Via RHSA-2017:2425 https://access.redhat.com/errata/RHSA-2017:2425 |