8.8

CVE-2023-5869

Postgresql: buffer overrun from integer overflow in array modification

A flaw was found in PostgreSQL that allows authenticated database users to execute arbitrary code through missing overflow checks during SQL array value modification. This issue exists due to an integer overflow during array modification where a remote user can trigger the overflow by providing specially crafted data. This enables the execution of arbitrary code on the target system, allowing users to write arbitrary bytes to memory and extensively read the server's memory.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Postgresql ≫ Postgresql Version >= 11.0 < 11.22
Postgresql ≫ Postgresql Version >= 12.0 < 12.17
Postgresql ≫ Postgresql Version >= 13.0 < 13.13
Postgresql ≫ Postgresql Version >= 14.0 < 14.10
Postgresql ≫ Postgresql Version >= 15.0 < 15.5
Postgresql ≫ Postgresql Version 16.0
Redhat ≫ Software Collections Version 1.0
Redhat ≫ Enterprise Linux Version 8.0
Redhat ≫ Enterprise Linux Version 9.0
Redhat ≫ Enterprise Linux Eus Version 8.6
Redhat ≫ Enterprise Linux Eus Version 8.8
Redhat ≫ Enterprise Linux Eus Version 9.0
Redhat ≫ Enterprise Linux Eus Version 9.2
Redhat ≫ Enterprise Linux For Arm 64 Version 8.8_aarch64
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 4.32% 0.899
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 8.8 2.8 5.9
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
RedHat 8.8 2.8 5.9
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-190 Integer Overflow or Wraparound

The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.

https://access.redhat.com/errata/RHSA-2023:7545
Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:7579
Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:7580
Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:7581
Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:7616
Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:7656
Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:7666
Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:7667
Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:7694
Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:7695
Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:7714
Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:7770
Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:7772
Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:7784
https://access.redhat.com/errata/RHSA-2023:7785
https://access.redhat.com/errata/RHSA-2023:7883
https://access.redhat.com/errata/RHSA-2023:7884
https://access.redhat.com/errata/RHSA-2023:7885
https://access.redhat.com/errata/RHSA-2024:0304
https://access.redhat.com/errata/RHSA-2024:0332
https://access.redhat.com/errata/RHSA-2024:0337
https://www.postgresql.org/about/news/postgresql-161-155-1410-1313-1217-and-1122-released-2749/
Release Notes
https://security.netapp.com/advisory/ntap-20240119-0003/
https://access.redhat.com/errata/RHSA-2023:7771
Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:7778
Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:7783
Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:7786
https://access.redhat.com/errata/RHSA-2023:7788
https://access.redhat.com/errata/RHSA-2023:7789
https://access.redhat.com/errata/RHSA-2023:7790
https://access.redhat.com/errata/RHSA-2023:7878
https://access.redhat.com/security/cve/CVE-2023-5869
Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2247169
Issue Tracking
https://www.postgresql.org/support/security/CVE-2023-5869/
Vendor Advisory
https://lists.debian.org/debian-lts-announce/2023/11/msg00007.html