A buffer over-read vulnerability exists in PostgreSQL parallel B-tree scans that allows an object creator to read server memory chosen by an attacker. This occurs due to a function incorrectly marked as PARALLEL SAFE or STABLE, causing different scan-key arrays to be built by participating workers. The issue affects PostgreSQL major versions 17 and 18, specifically versions before 17.12 and 18.7. Versions prior to 17 are not affected.
A type confusion vulnerability exists in PostgreSQL materialized set-returning functions, including json_populate_recordset(), that allows a database user to execute arbitrary code with the privileges of the operating system user running the database. This affects PostgreSQL versions prior to 18.7, 17.12, 16.16, 15.20, and 14.25. The vulnerability is classified as high severity with a CVSS score of 8.8.
A type confusion vulnerability in PostgreSQL's min/max aggregate optimization allows an object creator to execute arbitrary code with the privileges of the operating system user running the database. This occurs when a user-defined aggregate uses the SORTOP option, causing the planner to treat the aggregate's input and result as the same type even when they differ. Versions prior to PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
An integer wraparound vulnerability in PostgreSQL's in-memory tuple-size calculations allows a database user with limited privileges to execute arbitrary code with the operating system privileges of the database process. This affects PostgreSQL versions prior to 18.7, 17.12, 16.16, 15.20, and 14.25. The vulnerability has a high severity with a CVSS score of 8.8.
A type confusion vulnerability in PostgreSQL operator commutator and negator links allows an object creator with privileges to execute arbitrary code as the operating system user running the database. This occurs via linking operators that have different result types or by creating inconsistent reciprocal links. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
A type confusion vulnerability in PostgreSQL anonymous RECORD types allows an object creator to execute arbitrary code with the privileges of the operating system user running the database. This occurs due to row types having dropped attributes in the same positions but with different widths or alignments. The issue affects PostgreSQL major versions 17 and 18, specifically versions before 17.12 and 18.7. Versions prior to 17 are not affected.
A vulnerability in PostgreSQL's pg_dump tar-format restore.sql allows a compromised origin server to execute arbitrary code as the client OS user running psql. This issue arises from untrusted data inclusion via a predictable restriction key in restore.sql, which is undocumented. Versions prior to PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
An integer wraparound vulnerability in PostgreSQL generation memory contexts allows a database user to execute arbitrary code as the operating system user running the database. This occurs by freeing an allocation larger than 1 GB and causing its memory block to be reused for smaller chunks, where the back-pointer offset cannot represent the correct position. The vulnerability affects PostgreSQL major versions 16 through 18, specifically minor versions before 18.7, 17.12, and 16.16. Versions prior to 16 are not affected.
A vulnerability in PostgreSQL security_barrier processing allows a database user with limited privileges to infer sensitive information that should be hidden by a security_barrier view. This occurs by applying a leaky function to a CASE test value or internal parameter indirectly representing a protected column. Versions prior to PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
A vulnerability in PostgreSQL prior to versions 18.7, 17.12, 16.16, 15.20, and 14.25 allows an object creator to execute arbitrary SQL as the caller of a security-restricted operation. This occurs due to improper protection of an alternate path involving domain, enum, or range types created in the temporary schema pg_temp. The exploit requires the victim session to run a query with an unqualified type name, which common security-restricted operations like autovacuum do not perform.
A SQL injection vulnerability exists in PostgreSQL's reindexdb utility that allows an object creator to execute arbitrary SQL commands as the database user running reindexdb. This occurs via a crafted index name embedded in the parallel catalog query when using the --jobs option with --index. The vulnerability affects PostgreSQL major versions 17 and 18, specifically versions before 18.7 and 17.12. Versions prior to 17 are not affected.
A heap-based buffer overflow vulnerability exists in the PostgreSQL function tsvector_delete(). This flaw allows a database user with limited privileges to execute arbitrary code with the operating system user privileges running the database. The issue arises when processing a tsvector containing lexeme data with a nonstandard but valid ordering that triggers additional alignment padding. Versions prior to PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected. The vulnerability has a high severity score of 8.8 and impacts confidentiality, integrity, and availability.
A vulnerability in PostgreSQL version 18 prior to 18.7 allows an unauthenticated network client to cause a server restart by exploiting improper locking during startup processing. This issue arises when the client triggers authentication_timeout while holding a spinlock during cancel handling.
A heap-based buffer overflow vulnerability exists in the ts_rank_cd() function of PostgreSQL. This flaw may allow a database user to execute arbitrary code with the privileges of the operating system user running the database. The vulnerability is triggered by an invalid tsvector containing duplicate positions. Versions prior to PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
A use-after-free vulnerability exists in the PostgreSQL pltcl extension that allows an object creator to execute arbitrary code as the operating system user running the database. This occurs via a domain CHECK constraint that re-enters the Tcl interpreter and manipulates a string that is still in use during result conversion. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
A vulnerability in PostgreSQL prior to versions 18.7, 17.12, 16.16, 15.20, and 14.25 allows a database user to disclose server memory due to improper null termination in array element assignment. This occurs when the final byte of a fixed-length name value is changed to a nonzero byte and then processed as a C string.
A use-after-free vulnerability exists in the PostgreSQL plperl procedural language component. This flaw allows an object creator to execute arbitrary code with the privileges of the operating system user running the database. The vulnerability is triggered via reentrant return_next() calls. Versions prior to PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
A SQL injection vulnerability exists in PostgreSQL's pg_dump utility that allows an object creator to execute arbitrary SQL commands as the user restoring the dump. This occurs when an inherited column has a child-local not-null constraint with a name requiring quoting. The issue affects PostgreSQL major version 18, specifically minor versions before 18.7. Versions prior to 18 are not affected.
A use-after-free vulnerability exists in the PostgreSQL plperl procedural language, allowing an object creator to execute arbitrary code as the operating system user running the database. This occurs when the final reference to a Perl array or hash is dropped during PostgreSQL's object conversion process. Versions prior to PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
Uncaught exceptions in the PostgreSQL plperl procedural language handler can lead to use of a stale sigjmp_buf when an object creator uses a tied Perl object or a Perl object whose overloaded conversion throws during error handling. This flaw affects PostgreSQL versions prior to 18.7, 17.12, 16.16, 15.20, and 14.25. The vulnerability has a high severity with a CVSS score of 8.8 and may allow arbitrary code execution on some platforms.