Sven Klemm

Integer wraparound in multiple server features allows an unprivileged database user to cause the server to undersize an allocation and write out-of-bounds. This can lead to arbitrary code execution as the operating system user running the database. In applications that pass gigabyte-scale user inputs to the relevant database functions, the input provider may cause a segmentation fault, which is an error occurring when a program attempts to access a memory location that it is not allowed to access.

A vulnerability was found in PostgreSQL that allows an attacker to run arbitrary code as the victim role, which may be a superuser. This attack requires permission to create non-temporary objects in at least one schema, the ability to lure or wait for an administrator to create or update an affected extension in that schema, and the ability to lure or wait for a victim to use the object targeted in CREATE OR REPLACE or CREATE IF NOT EXISTS. The flaw is related to errors when using OR commands with extensions, which can allow a remote attacker to elevate their privileges and replace arbitrary objects in the database.

A flaw was found in PostgreSQL that allows a user with SELECT privilege on one column to craft a special query that returns all columns of the table. The highest threat from this vulnerability is to confidentiality. This issue is related to shortcomings in the authorization mechanism, which can be exploited by a remote attacker to gain unauthorized access to protected information.