diff --git a/security/vuxml/vuln.xml b/security/vuxml/vuln.xml index 1e6d0cebf521..d9315af51412 100644 --- a/security/vuxml/vuln.xml +++ b/security/vuxml/vuln.xml @@ -58,6 +58,56 @@ Notes: * Do not forget port variants (linux-f10-libxml2, libxml2, etc.) --> + + PostgreSQL -- SQL injection in pg_upgrade and pg_dump + + + postgresql10-server + 10.6 + + + postgresql96-server + 9.6.11 + + + postgresql95-server + 9.5.15 + + + postgresql94-server + 9.4.20 + + + postgresql93-server + 9.3.25 + + + + +

The PostgreSQL project reports:

+
+

CVE-2018-16850: SQL injection in pg_upgrade and pg_dump, + via CREATE TRIGGER ... REFERENCING.

+

Using a purpose-crafted trigger definition, an attacker can run + arbitrary SQL statements with superuser privileges when a superuser + runs pg_upgrade on the database or during a pg_dump dump/restore + cycle. This attack requires a CREATE privilege on some non-temporary + schema or a TRIGGER privilege on a table. This is exploitable in the + default PostgreSQL configuration, where all users have CREATE + privilege on public schema.

+
+ + + + https://www.postgresql.org/about/news/1905/ + CVE-2018-16850 + + + 2018-11-08 + 2018-11-08 + + + NGINX -- Multiple vulnerabilities