NVD Vulnerability Detail

CVE-2015-0243

Summary	Multiple buffer overflows in contrib/pgcrypto in PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1 allow remote authenticated users to cause a denial of service (crash) and possibly execute arbitrary code via unspecified vectors.
Publication Date	Jan. 28, 2020, 1:15 a.m.
Registration Date	Jan. 26, 2021, 2:43 p.m.
Last Update	Nov. 21, 2024, 11:22 a.m.

Affected software configurations

Related information, measures and tools

No	URL	タグ
1	http://www.debian.org/security/2015/dsa-3155	Third Party Advisory
2	http://www.debian.org/security/2015/dsa-3155	Third Party Advisory
3	http://www.postgresql.org/about/news/1569/	Vendor Advisory
4	http://www.postgresql.org/about/news/1569/	Vendor Advisory
5	http://www.postgresql.org/docs/9.4/static/release-9-4-1.html	Release Notes Vendor Advisory
6	http://www.postgresql.org/docs/9.4/static/release-9-4-1.html	Release Notes Vendor Advisory
7	http://www.postgresql.org/docs/current/static/release-9-0-19.html	Release Notes Vendor Advisory
8	http://www.postgresql.org/docs/current/static/release-9-0-19.html	Release Notes Vendor Advisory
9	http://www.postgresql.org/docs/current/static/release-9-1-15.html	Release Notes Vendor Advisory
10	http://www.postgresql.org/docs/current/static/release-9-1-15.html	Release Notes Vendor Advisory
11	http://www.postgresql.org/docs/current/static/release-9-2-10.html	Release Notes Vendor Advisory
12	http://www.postgresql.org/docs/current/static/release-9-2-10.html	Release Notes Vendor Advisory
13	http://www.postgresql.org/docs/current/static/release-9-3-6.html	Release Notes Vendor Advisory
14	http://www.postgresql.org/docs/current/static/release-9-3-6.html	Release Notes Vendor Advisory

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-120	古典的バッファオーバーフロー	https://cwe.mitre.org/data/definitions/120.html

JVN Vulnerability Information

PostgreSQL における古典的バッファオーバーフローの脆弱性

Title	PostgreSQL における古典的バッファオーバーフローの脆弱性
Summary	PostgreSQL には、古典的バッファオーバーフローの脆弱性が存在します。
Possible impacts	情報を取得される、情報を改ざんされる、およびサービス運用妨害 (DoS) 状態にされる可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	Feb. 5, 2015, midnight
Registration Date	Feb. 14, 2020, 11:07 a.m.
Last Update	Feb. 14, 2020, 11:07 a.m.

Affected System

PostgreSQL.org

PostgreSQL 9.0.19 未満

PostgreSQL 9.1.15 未満の 9.1.x

PostgreSQL 9.2.10 未満の 9.2.x

PostgreSQL 9.3.6 未満の 9.3.x

PostgreSQL 9.4.1 未満の 9.4.x

Debian

Debian GNU/Linux

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2015-0243	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0243
National Vulnerability Database (NVD)
2	CVE-2015-0243	https://nvd.nist.gov/vuln/detail/CVE-2015-0243

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-120	https://cwe.mitre.org/data/definitions/120.html

ベンダー情報

No	Name	URL
Debian Security Advisory
1	DSA-3155	http://www.debian.org/security/2015/dsa-3155
PostgreSQL NEWS
2	PostgreSQL 9.4.1, 9.3.6, 9.2.10, 9.1.15 & 9.0.19 Released	http://www.postgresql.org/about/news/1569/
PostgreSQL Release Notes
3	E.10. Release 9.1.15	http://www.postgresql.org/docs/current/static/release-9-1-15.html
4	E.15. Release 9.2.10	http://www.postgresql.org/docs/current/static/release-9-2-10.html
5	E.20. Release 9.3.6	http://www.postgresql.org/docs/current/static/release-9-3-6.html
6	E.25. Release 9.4.1	http://www.postgresql.org/docs/9.4/static/release-9-4-1.html
7	E.5. Release 9.0.19	http://www.postgresql.org/docs/current/static/release-9-0-19.html

Change Log

No	Changed Details	Date of change
1	[2020年02月14日] 掲載	Feb. 14, 2020, 11:07 a.m.