Matthieu Denais

Untrusted data inclusion in the `pg dump` utility allows a malicious superuser of the origin server to inject arbitrary code. This code is executed during the restore process as the client operating system account running `psql` to restore the dump, achieved through the use of `psql` meta-commands. The `pg dumpall` utility is also affected, as is `pg restore` when it is used to generate a plain-format dump.

A difficult-to-exploit issue exists in the MySQL Client component (mysqldump) of Oracle MySQL. Successful attacks require human interaction from a person other than the attacker and network access via multiple protocols. Exploitation can lead to unauthorized data modification (update, insert, delete) and read access to some MySQL Client accessible data.