CVEvulnerability
CVE-2007-2138
6.0 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2007-04-24
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 6.0 MEDIUM — AV:N/AC:M/Au:S/C:P/I:P/A:P
- Weaknesses
- CWE-264
Description
Untrusted search path vulnerability in PostgreSQL before 7.3.19, 7.4.x before 7.4.17, 8.0.x before 8.0.13, 8.1.x before 8.1.9, and 8.2.x before 8.2.4 allows remote authenticated users, when permitted to call a SECURITY DEFINER function, to gain the privileges of the function owner, related to "search_path settings."
Affected configurations
• postgresql postgresql (< 7.3.19)
• postgresql postgresql (>= 7.4 < 7.4.17)
• postgresql postgresql (>= 8.0 < 8.0.13)
• postgresql postgresql (>= 8.1 < 8.1.9)
• postgresql postgresql (>= 8.2 < 8.2.4)
• debian debian linux 3.1
• debian debian linux 4.0
• canonical ubuntu linux 6.06
• canonical ubuntu linux 6.10
• canonical ubuntu linux 7.04
Related
Weakness · not in database (1)
References
- http://rhn.redhat.com/errata/RHSA-2007-0336.html Third Party Advisory
- http://secunia.com/advisories/24989 Third Party Advisory
- http://secunia.com/advisories/24999 Third Party Advisory
- http://secunia.com/advisories/25005 Third Party Advisory
- http://secunia.com/advisories/25019 Third Party Advisory
- http://secunia.com/advisories/25037 Third Party Advisory
- http://secunia.com/advisories/25058 Third Party Advisory
- http://secunia.com/advisories/25184 Third Party Advisory
- http://secunia.com/advisories/25238 Third Party Advisory
- http://secunia.com/advisories/25334 Third Party Advisory
- http://secunia.com/advisories/25717 Third Party Advisory
- http://secunia.com/advisories/25720 Third Party Advisory
- http://secunia.com/advisories/25725 Third Party Advisory
- http://security.gentoo.org/glsa/glsa-200705-12.xml Third Party Advisory
- http://sunsolve.sun.com/search/document.do?assetkey=1-26-102894-1 Broken Link
- http://support.avaya.com/elmodocs2/security/ASA-2007-190.htm Third Party Advisory
- http://www.debian.org/security/2007/dsa-1309 Third Party Advisory
- http://www.debian.org/security/2007/dsa-1311 Third Party Advisory
- http://www.mandriva.com/security/advisories?name=MDKSA-2007:094 Third Party Advisory
- http://www.postgresql.org/about/news.791 Patch, Vendor Advisory
- http://www.postgresql.org/support/security.html Patch, Vendor Advisory
- http://www.redhat.com/support/errata/RHSA-2007-0337.html Third Party Advisory
- http://www.securityfocus.com/bid/23618 Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id?1017974 Third Party Advisory, VDB Entry
- http://www.trustix.org/errata/2007/0015/ Broken Link
- http://www.ubuntu.com/usn/usn-454-1 Third Party Advisory
- http://www.vupen.com/english/advisories/2007/1497 Third Party Advisory
- http://www.vupen.com/english/advisories/2007/1549 Third Party Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/33842 Third Party Advisory, VDB Entry
- https://issues.rpath.com/browse/RPL-1292 Broken Link
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10090 Third Party Advisory
- http://rhn.redhat.com/errata/RHSA-2007-0336.html Third Party Advisory
- http://secunia.com/advisories/24989 Third Party Advisory
- http://secunia.com/advisories/24999 Third Party Advisory
- http://secunia.com/advisories/25005 Third Party Advisory
- http://secunia.com/advisories/25019 Third Party Advisory
- http://secunia.com/advisories/25037 Third Party Advisory
- http://secunia.com/advisories/25058 Third Party Advisory
- http://secunia.com/advisories/25184 Third Party Advisory
- http://secunia.com/advisories/25238 Third Party Advisory
- http://secunia.com/advisories/25334 Third Party Advisory
- http://secunia.com/advisories/25717 Third Party Advisory
- http://secunia.com/advisories/25720 Third Party Advisory
- http://secunia.com/advisories/25725 Third Party Advisory
- http://security.gentoo.org/glsa/glsa-200705-12.xml Third Party Advisory
- http://sunsolve.sun.com/search/document.do?assetkey=1-26-102894-1 Broken Link
- http://support.avaya.com/elmodocs2/security/ASA-2007-190.htm Third Party Advisory
- http://www.debian.org/security/2007/dsa-1309 Third Party Advisory
- http://www.debian.org/security/2007/dsa-1311 Third Party Advisory
- http://www.mandriva.com/security/advisories?name=MDKSA-2007:094 Third Party Advisory
- http://www.postgresql.org/about/news.791 Patch, Vendor Advisory
- http://www.postgresql.org/support/security.html Patch, Vendor Advisory
- http://www.redhat.com/support/errata/RHSA-2007-0337.html Third Party Advisory
- http://www.securityfocus.com/bid/23618 Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id?1017974 Third Party Advisory, VDB Entry
- http://www.trustix.org/errata/2007/0015/ Broken Link
- http://www.ubuntu.com/usn/usn-454-1 Third Party Advisory
- http://www.vupen.com/english/advisories/2007/1497 Third Party Advisory
- http://www.vupen.com/english/advisories/2007/1549 Third Party Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/33842 Third Party Advisory, VDB Entry
- https://issues.rpath.com/browse/RPL-1292 Broken Link
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10090 Third Party Advisory