This version update to 8.1.11 fixes among other things several security issues :

  - Index Functions Privilege Escalation: CVE-2007-6600

  - Regular Expression Denial-of-Service: CVE-2007-4772,     CVE-2007-6067, CVE-2007-4769

  - DBLink Privilege Escalation: CVE-2007-6601

This version update to 8.2.6 fixes among other things several security issues :

  - Index Functions Privilege Escalation: CVE-2007-6600

  - Regular Expression Denial-of-Service: CVE-2007-4772,     CVE-2007-6067, CVE-2007-4769

  - DBLink Privilege Escalation: CVE-2007-6601

Will Drewry discovered multiple flaws in PostgreSQL's regular expression engine. An authenticated attacker could use these flaws to cause a denial of service by causing the PostgreSQL server to crash, enter an infinite loop, or use extensive CPU and memory resources while processing queries containing specially crafted regular expressions. Applications that accept regular expressions from untrusted sources may expose this problem to unauthorized attackers.
(CVE-2007-4769, CVE-2007-4772, CVE-2007-6067)

A privilege escalation flaw was discovered in PostgreSQL. An authenticated attacker could create an index function that would be executed with administrator privileges during database maintenance tasks, such as database vacuuming. (CVE-2007-6600)

A privilege escalation flaw was discovered in PostgreSQL's Database Link library (dblink). An authenticated attacker could use dblink to possibly escalate privileges on systems with 'trust' or 'ident' authentication configured. Please note that dblink functionality is not enabled by default, and can only by enabled by a database administrator on systems with the postgresql-contrib package installed. (CVE-2007-3278, CVE-2007-6601)

From Red Hat Security Advisory 2008:0039 :

Updated postgresql packages that fix several security issues are now available for Red Hat Enterprise Linux 3.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

PostgreSQL is an advanced Object-Relational database management system (DBMS). The postgresql packages include the client programs and libraries needed to access a PostgreSQL DBMS server.

A privilege escalation flaw was discovered in PostgreSQL. An authenticated attacker could create an index function that would be executed with administrator privileges during database maintenance tasks, such as database vacuuming. (CVE-2007-6600)

A privilege escalation flaw was discovered in PostgreSQL's Database Link library (dblink). An authenticated attacker could use dblink to possibly escalate privileges on systems with 'trust' or 'ident' authentication configured. Please note that dblink functionality is not enabled by default, and can only by enabled by a database administrator on systems with the postgresql-contrib package installed. (CVE-2007-3278, CVE-2007-6601)

All postgresql users should upgrade to these updated packages, which include PostgreSQL 7.3.21 and resolve these issues.

Updated postgresql packages that fix two security issues are now available for Red Hat Enterprise Linux 4 and 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

PostgreSQL is an advanced object-relational database management system (DBMS).

It was discovered that the upstream patch for CVE-2007-6600 included in the Red Hat Security Advisory RHSA-2008:0038 did not include protection against misuse of the RESET ROLE and RESET SESSION AUTHORIZATION commands. An authenticated user could use this flaw to install malicious code that would later execute with superuser privileges. (CVE-2009-3230)

A flaw was found in the way PostgreSQL handled encoding conversion. A remote, authenticated user could trigger an encoding conversion failure, possibly leading to a temporary denial of service. Note: To exploit this issue, a locale and client encoding for which specific messages fail to translate must be selected (the availability of these is determined by an administrator-defined locale setting).
(CVE-2009-0922)

Note: For Red Hat Enterprise Linux 4, this update upgrades PostgreSQL to version 7.4.26. For Red Hat Enterprise Linux 5, this update upgrades PostgreSQL to version 8.1.18. Refer to the PostgreSQL Release Notes for a list of changes :

http://www.postgresql.org/docs/7.4/static/release.html http://www.postgresql.org/docs/8.1/static/release.html

All PostgreSQL users should upgrade to these updated packages, which resolve these issues. If the postgresql service is running, it will be automatically restarted after installing this update.

The Rocky Linux 8.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_1609 advisory.

    This advisory aggregates security fixes for the postgresql SRPM in CIQ LTS 8.6. It addresses 31 CVEs:
    CVE-2021-32027, CVE-2012-3489, CVE-2007-0555, CVE-2021-23214, CVE-2021-32028, and 26 more.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名稱	產品	系列	已發布	已更新	嚴重性
30198	openSUSE 10 Security Update : postgresql (postgresql-4958)	Nessus	SuSE Local Security Checks	2008/2/6	2021/1/14	medium
30251	openSUSE 10 Security Update : postgresql (postgresql-4955)	Nessus	SuSE Local Security Checks	2008/2/11	2021/1/14	medium
60343	Scientific Linux Security Update : postgresql on SL3.x, SL4.x, SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	2012/8/1	2021/1/14	high
67639	Oracle Linux 3 : postgresql (ELSA-2008-0039)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2021/1/14	high
43800	CentOS 4 / 5 : postgresql (CESA-2009:1484)	Nessus	CentOS Local Security Checks	2010/1/6	2021/1/4	medium
364612	Rocky Linux 8.6 [CIQ] Security Update: postgresql / postgresql-contrib / postgresql-docs / etc Multiple Vulnerabilities (ciqsa-2026_1609)	Nessus	Rocky Linux Local Security Checks	2026/10/12	2026/10/12	high

偵測

搜尋 Plugin

medium

medium

high

high

medium

high