postgresql
Page content
- Author: kikadf
- Vulnerable: 9.1.12-1
- Unaffected: 9.1.15-1rigel2
A user with limited clearance on a table might have access to information in columns without SELECT rights on through server error messages. The function to_char() might read/write past the end of a buffer. This might crash the server when a formatting template is processed. The pgcrypto module is vulnerable to stack buffer overrun that might crash the server. Emil Lenngren reported that an attacker can inject SQL commands when the synchronization between client and server is lost.