| Package | Affected versions | Patched versions |
|---|---|---|
| postgresql | ≥ 7.4, < 7.4.28≥ 8.0, < 8.0.24≥ 8.1, < 8.1.20≥ 8.2, < 8.2.16≥ 8.3, < 8.3.10≥ 8.4, < 8.4.3 | 7.4.288.0.248.1.208.2.168.3.108.4.3 |
The bitsubstr function in backend/utils/adt/varbit.c in PostgreSQL 8.0.23, 8.1.11, and 8.3.8 allows remote authenticated users to cause a denial of service (daemon crash) or have unspecified other impact via vectors involving a negative integer in the third argument, as demonstrated by a SELECT statement that contains a call to the substring function for a bit string, related to an "overflow."
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free