CVE-2016-0766

原始描述

PostgreSQL before 9.1.20, 9.2.x before 9.2.15, 9.3.x before 9.3.11, 9.4.x before 9.4.6, and 9.5.x before 9.5.1 does not properly restrict access to unspecified custom configuration settings (GUCS) for PL/Java, which allows attackers to gain privileges via unspecified vectors.

受影响的软件

• PostgreSQL ≥ 9.3 < 9.3.11≥ 9.4 < 9.4.6≥ 9.2 < 9.2.15= 9.5≥ 9.1.0 < 9.1.20 修复版本: 9.3.11, 9.4.6, 9.2.15, 9.1.20 精确匹配

详情

发布日期

2016-02-18

最后修改

2024-08-06

CVSS 向量

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

参考资料

• cve.org/CVE-2016-0766
• nvd.nist.gov/vuln/detail/CVE-2016-0766
• lists.opensuse.org/opensuse-security-announce/2016-02/msg00054.html
• www.postgresql.org/docs/current/static/release-9-3-11.html
• lists.opensuse.org/opensuse-security-announce/2016-03/msg00016.html
• lists.opensuse.org/opensuse-security-announce/2016-02/msg00052.html
• www.postgresql.org/docs/current/static/release-9-2-15.html
• www.postgresql.org/docs/current/static/release-9-5-1.html
• security.gentoo.org/glsa/201701-33
• www.postgresql.org/about/news/1644/
• www.securitytracker.com/id/1035005
• www.securityfocus.com/bid/83184
• lists.opensuse.org/opensuse-security-announce/2016-02/msg00056.html
• www.postgresql.org/docs/current/static/release-9-4-6.html