CVE-2016-0766

원문 설명

PostgreSQL before 9.1.20, 9.2.x before 9.2.15, 9.3.x before 9.3.11, 9.4.x before 9.4.6, and 9.5.x before 9.5.1 does not properly restrict access to unspecified custom configuration settings (GUCS) for PL/Java, which allows attackers to gain privileges via unspecified vectors.

영향받는 소프트웨어

• PostgreSQL ≥ 9.3 < 9.3.11≥ 9.4 < 9.4.6≥ 9.2 < 9.2.15= 9.5≥ 9.1.0 < 9.1.20 수정 버전: 9.3.11, 9.4.6, 9.2.15, 9.1.20 정확 일치

상세

공개일

2016-02-18

최종 수정

2024-08-06

CVSS 벡터

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

참고 자료

• cve.org/CVE-2016-0766
• nvd.nist.gov/vuln/detail/CVE-2016-0766
• lists.opensuse.org/opensuse-security-announce/2016-02/msg00054.html
• www.postgresql.org/docs/current/static/release-9-3-11.html
• lists.opensuse.org/opensuse-security-announce/2016-03/msg00016.html
• lists.opensuse.org/opensuse-security-announce/2016-02/msg00052.html
• www.postgresql.org/docs/current/static/release-9-2-15.html
• www.postgresql.org/docs/current/static/release-9-5-1.html
• security.gentoo.org/glsa/201701-33
• www.postgresql.org/about/news/1644/
• www.securitytracker.com/id/1035005
• www.securityfocus.com/bid/83184
• lists.opensuse.org/opensuse-security-announce/2016-02/msg00056.html
• www.postgresql.org/docs/current/static/release-9-4-6.html