SB2005050301 - Multiple vulnerabilities in PostgreSQL 

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2005050301

SB2005050301 - Multiple vulnerabilities in PostgreSQL

Published: May 3, 2005 Updated: June 23, 2025

Security Bulletin ID SB2005050301
Severity
Medium
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 50% Low 50%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 secuirty vulnerabilities.


1) Input validation error (CVE-ID: CVE-2005-1409)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

PostgreSQL 7.3.x through 8.0.x gives public EXECUTE access to certain character conversion functions, which allows unprivileged users to call those functions with malicious values, with unknown impact, aka the "Character conversion vulnerability."


2) Input validation error (CVE-ID: CVE-2005-1410)

The vulnerability allows a local user to perform service disruption.

The tsearch2 module in PostgreSQL 7.4 through 8.0.x declares the (1) dex_init, (2) snb_en_init, (3) snb_ru_init, (4) spell_init, and (5) syn_init functions as "internal" even when they do not take an internal argument, which allows attackers to cause a denial of service (application crash) and possibly have other impacts via SQL commands that call other functions that accept internal arguments.


Remediation

Install update from vendor's website.

References