Threats Tagged 'cve-2025-12817'

This update for postgresql13 fixes the following issues: Security fixes: - CVE-2025-12817: Fixed missing check for CREATE privileges on the schema in CREATE STATISTICS allowed table owners to create statistics in any schema, potentially leading to unexpected naming conflicts (bsc#1253332) - CVE-2025-12818: Fixed several places in libpq were not sufficiently careful about computing the required size of a memory allocation. Sufficiently large inputs could cause integer overflow, resulting in an undersized buffer, which would then lead to writing past the end of the buffer (bsc#1253333) Other fixes: - Update to 13.23 * https://www.postgresql.org/about/news/p-3171/ * https://www.postgresql.org/docs/release/13.23

This update for postgresql13 fixes the following issues: Security fixes: - CVE-2025-12817: Fixed missing check for CREATE privileges on the schema in CREATE STATISTICS allowed table owners to create statistics in any schema, potentially leading to unexpected naming conflicts (bsc#1253332) - CVE-2025-12818: Fixed several places in libpq were not sufficiently careful about computing the required size of a memory allocation. Sufficiently large inputs could cause integer overflow, resulting in an undersized buffer, which would then lead to writing past the end of the buffer (bsc#1253333) Other fixes: - Update to 13.23 * https://www.postgresql.org/about/news/p-3171/ * https://www.postgresql.org/docs/release/13.23

PostgreSQL is an advanced object-relational database management system (DBMS). Security Fix(es): * postgresql: CREATE STATISTICS does not check for schema CREATE privilege (CVE-2025-12817) * postgresql: libpq undersizes allocations, via integer wraparound (CVE-2025-12818) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

PostgreSQL is an advanced object-relational database management system (DBMS). Security Fix(es): * postgresql: CREATE STATISTICS does not check for schema CREATE privilege (CVE-2025-12817) * postgresql: libpq undersizes allocations, via integer wraparound (CVE-2025-12818) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

PostgreSQL is an advanced object-relational database management system (DBMS). Security Fix(es): * postgresql: CREATE STATISTICS does not check for schema CREATE privilege (CVE-2025-12817) * postgresql: libpq undersizes allocations, via integer wraparound (CVE-2025-12818) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

CVE-2025-12817 is a low-severity vulnerability in PostgreSQL affecting versions prior to 18.1, 17.7, 16.11, 15.15, 14.20, and 13.23. It involves missing authorization checks in the CREATE STATISTICS command, allowing a table owner to cause denial of service (DoS) against other users by creating statistics objects in any schema. This prevents other users with CREATE privileges from creating statistics with the same name, leading to failed operations. Exploitation requires low privileges (table owner) but no user interaction.

LowVulnerabilityGermanyFranceNetherlands+5#cve#cve-2025-12817