CVE-2015-0242
published 2020-01-27CVE-2015-0242: Stack-based buffer overflow in the *printf function implementations in PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6…
PriorityP351high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
EPSS
5.14%
91.5th percentile
Stack-based buffer overflow in the *printf function implementations in PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1, when running on a Windows system, allows remote authenticated users to cause a denial of service (crash) and possibly execute arbitrary code via a floating point number with a large precision, as demonstrated by using the to_char function.
Affected
14 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apple | os_x_server_v5.0.3 | — | — |
| apple | os_x_yosemite_v10.10.5_and_security_update_2015-006 | — | — |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| postgresql | postgresql | < 9.0.19 | 9.0.19 |
| postgresql | postgresql | >= 9.1.0 < 9.1.15 | 9.1.15 |
| postgresql | postgresql | >= 9.2.0 < 9.2.10 | 9.2.10 |
| postgresql | postgresql | >= 9.3.0 < 9.3.6 | 9.3.6 |
| postgresql | postgresql | >= 9.4.0 < 9.4.1 | 9.4.1 |
| postgresql_global_development_group | postgresql | — | — |
| postgresql_global_development_group | postgresql | — | — |
| postgresql_global_development_group | postgresql | — | — |
| postgresql_global_development_group | postgresql | — | — |
| postgresql_global_development_group | postgresql | — | — |
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.06.5MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P
vendor_redhat8.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
postgresql: buffer overflow flaws in replacement *printf() functions
vendor_redhat·2015-02-16·CVSS 8.8
CVE-2015-0242 [HIGH] CWE-122 postgresql: buffer overflow flaws in replacement *printf() functions
postgresql: buffer overflow flaws in replacement *printf() functions
Stack-based buffer overflow in the *printf function implementations in PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1, when running on a Windows system, allows remote authenticated users to cause a denial of service (crash) and possibly execute arbitrary code via a floating point number with a large precision, as demonstrated by using the to_char function.
A buffer overflow flaw was found in the PostgreSQL's internal printf() implementation. An authenticated database user could use a specially crafted string in an SQL query to cause PostgreSQL to crash or, potentially, lead to privilege escalation.
Statement: Not vulnerable. This issue does not affect the
Apple
CVE-2015-0242: OS X Yosemite v10.10.5 and Security Update 2015-006
vendor_apple·CVSS 8.8
CVE-2015-0242 [HIGH] CVE-2015-0242: OS X Yosemite v10.10.5 and Security Update 2015-006
Apple Security Update: About the security content of OS X Yosemite v10.10.5 and Security Update 2015-006
Product: OS X Yosemite v10.10.5 and Security Update 2015-006
CVE: CVE-2015-0242
Component: CVE-2015-0242
Apple
CVE-2015-0242: OS X Server v5.0.3
vendor_apple·CVSS 8.8
CVE-2015-0242 [HIGH] CVE-2015-0242: OS X Server v5.0.3
Apple Security Update: About the security content of OS X Server v5.0.3
Product: OS X Server v5.0.3
CVE: CVE-2015-0242
Component: CVE-2015-0242
GHSA
GHSA-484w-vg65-78pg: Stack-based buffer overflow in the *printf function implementations in PostgreSQL before 9
ghsa_unreviewed·2022-05-24
CVE-2015-0242 [MEDIUM] GHSA-484w-vg65-78pg: Stack-based buffer overflow in the *printf function implementations in PostgreSQL before 9
Stack-based buffer overflow in the *printf function implementations in PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1, when running on a Windows system, allows remote authenticated users to cause a denial of service (crash) and possibly execute arbitrary code via a floating point number with a large precision, as demonstrated by using the to_char function.
No detection rules found.
No public exploits indexed.
http://www.debian.org/security/2015/dsa-3155http://www.postgresql.org/about/news/1569/http://www.postgresql.org/docs/9.4/static/release-9-4-1.htmlhttp://www.postgresql.org/docs/current/static/release-9-0-19.htmlhttp://www.postgresql.org/docs/current/static/release-9-1-15.htmlhttp://www.postgresql.org/docs/current/static/release-9-2-10.htmlhttp://www.postgresql.org/docs/current/static/release-9-3-6.htmlhttp://www.debian.org/security/2015/dsa-3155http://www.postgresql.org/about/news/1569/http://www.postgresql.org/docs/9.4/static/release-9-4-1.htmlhttp://www.postgresql.org/docs/current/static/release-9-0-19.htmlhttp://www.postgresql.org/docs/current/static/release-9-1-15.htmlhttp://www.postgresql.org/docs/current/static/release-9-2-10.htmlhttp://www.postgresql.org/docs/current/static/release-9-3-6.html
2020-01-27
Published