An array index error, leading to a heap-based out-of-bounds buffer read flaw, was found in the way PostgreSQL performed certain error processing using enumeration types. An unprivileged database user could issue a specially crafted SQL query that, when processed by the server component of the PostgreSQL service, would lead to a denial of service (daemon crash) or disclosure of certain portions of server memory. (CVE-2013-0255)

A flaw was found in the way the pgcrypto contrib module of PostgreSQL (re)initialized its internal random number generator. This could lead to random numbers with less bits of entropy being used by certain pgcrypto functions, possibly allowing an attacker to conduct other attacks. (CVE-2013-1900)

Mitsumasa Kondo and Kyotaro Horiguchi discovered that PostgreSQL incorrectly handled certain connection requests containing database names starting with a dash. A remote attacker could use this flaw to damage or destroy files within a server's data directory. This issue only applied to Ubuntu 11.10, Ubuntu 12.04 LTS, and Ubuntu 12.10.
(CVE-2013-1899)

Marko Kreen discovered that PostgreSQL incorrectly generated random numbers. An authenticated attacker could use this flaw to possibly guess another database user's random numbers. (CVE-2013-1900)

Noah Misch discovered that PostgreSQL incorrectly handled certain privilege checks. An unprivileged attacker could use this flaw to possibly interfere with in-progress backups. This issue only applied to Ubuntu 11.10, Ubuntu 12.04 LTS, and Ubuntu 12.10. (CVE-2013-1901).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Update to PostgreSQL 9.2.4, for various fixes described     at     http://www.postgresql.org/docs/9.2/static/release-9-2-4.
    html including the fixes for CVE-2013-1899,     CVE-2013-1900, CVE-2013-1901

  - fix build for aarch64 and ppc64p7

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update to version 9.1.9 fixes :

  - Fix insecure parsing of server command-line switches.
    (CVE-2013-1899)

  - Reset OpenSSL randomness state in each postmaster child     process. (CVE-2013-1900)

  - Make REPLICATION privilege checks test current user not     authenticated user. (CVE-2013-1901)

The version of PostgreSQL installed on the remote host is 8.4.x prior to 8.4.17, 9.0.x prior to 9.0.13, 9.1.x prior to 9.1.9, or 9.2.x prior to 9.2.4.  As such, it is potentially affected by an issue where random numbers generated by contrib/pgcrypto functions may be easy for another database user to guess.

The Rocky Linux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_0478 advisory.

    This advisory aggregates security fixes for the postgresql SRPM in CIQ LTS 9.2. It addresses 34 CVEs:
    CVE-2007-0555, CVE-2025-8714, CVE-2012-2655, CVE-2007-6067, CVE-2012-0867, and 29 more.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An array index error, leading to a heap-based out-of-bounds buffer read flaw, was found in the way PostgreSQL performed certain error processing using enumeration types. An unprivileged database user could issue a specially crafted SQL query that, when processed by the server component of the PostgreSQL service, would lead to a denial of service (daemon crash) or disclosure of certain portions of server memory. (CVE-2013-0255)

A flaw was found in the way the pgcrypto contrib module of PostgreSQL (re)initialized its internal random number generator. This could lead to random numbers with less bits of entropy being used by certain pgcrypto functions, possibly allowing an attacker to conduct other attacks. (CVE-2013-1900)

These updated packages upgrade PostgreSQL to version 8.4.18, which fixes these issues as well as several non-security issues. Refer to the PostgreSQL Release Notes for a full list of changes :

http://www.postgresql.org/docs/8.4/static/release-8-4-18.html

After installing this update, it is advisable to rebuild, using the REINDEX command, Generalized Search Tree (GiST) indexes that meet one or more of the following conditions :

    - GiST indexes on box, polygon, circle, or point columns

    - GiST indexes for variable-width data types, that is       text, bytea, bit, and numeric

    - GiST multi-column indexes

If the postgresql service is running, it will be automatically restarted after installing this update.

The remote MiracleLinux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2014-004:01 advisory.

    PostgreSQL is an advanced Object-Relational database management system (DBMS) that supports almost all SQL     constructs (including transactions, subselects and user-defined types and functions). The postgresql     package includes the client programs and libraries that you'll need to access a PostgreSQL DBMS server.
    These PostgreSQL client programs are programs that directly manipulate the internal structure of     PostgreSQL databases on a PostgreSQL server. These client programs can be located on the same machine with     the PostgreSQL server, or may be on a remote machine which accesses a PostgreSQL server over a network     connection. This package contains the docs in HTML for the whole package, as well as command-line     utilities for managing PostgreSQL databases on a PostgreSQL server.
    If you want to manipulate a PostgreSQL database on a local or remote PostgreSQL server, you need this     package. You also need to install this package if you're installing the postgresql-server package.
    Security issues fixed with this release:
     CVE-2013-0255     PostgreSQL 9.2.x before 9.2.3, 9.1.x before 9.1.8, 9.0.x before 9.0.12, 8.4.x before 8.4.16, and 8.3.x     before 8.3.23 does not properly declare the enum_recv function in backend/utils/adt/enum.c, which causes     it to be invoked with incorrect arguments and allows remote authenticated users to cause a denial of     service (server crash) or read sensitive process memory via a crafted SQL command, which triggers an array     index error and an out-of-bounds read.
     CVE-2013-1900      PostgreSQL 9.2.x before 9.2.4, 9.1.x before 9.1.9, 9.0.x before 9.0.13, and 8.4.x before 8.4.17, when     using OpenSSL, generates insufficiently random numbers, which might allow remote authenticated users to     have an unspecified impact via vectors related to the contrib/pgcrypto functions.
     CVE-2014-0060      CVE-2014-0061      CVE-2014-0062      CVE-2014-0063      CVE-2014-0064      CVE-2014-0065      CVE-2014-0066     No information available at the time of writing, please refer to the CVE links below.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
70906	Amazon Linux AMI : postgresql8 (ALAS-2013-244)	Nessus	Amazon Linux Local Security Checks	2013/11/14	2018/4/18	high
65818	Ubuntu 8.04 LTS / 10.04 LTS / 11.10 / 12.04 LTS / 12.10 : postgresql-8.3, postgresql-8.4, postgresql-9.1 vulnerabilities (USN-1789-1)	Nessus	Ubuntu Local Security Checks	2013/4/5	2019/9/19	high
65827	Fedora 18 : postgresql-9.2.4-1.fc18 (2013-4951)	Nessus	Fedora Local Security Checks	2013/4/7	2021/1/11	high
65829	SuSE 11.2 Security Update : PostgreSQL (SAT Patch Number 7585)	Nessus	SuSE Local Security Checks	2013/4/7	2021/1/19	high
65856	PostgreSQL 8.4 < 8.4.17 / 9.0 < 9.0.13 / 9.1 < 9.1.9 / 9.2 < 9.2.4 Predictable Random Number Generator	Nessus	Databases	2013/4/8	2026/10/7	critical
356309	Rocky Linux 9.2 [CIQ] Security Update: postgresql / postgresql-contrib / postgresql-contrib-debuginfo / etc Multiple Vulnerabilities (ciqsa-2026_0478)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/12	high
70705	Scientific Linux Security Update : postgresql and postgresql84 on SL5.x, SL6.x i386/x86_64 (20131029)	Nessus	Scientific Linux Local Security Checks	2013/10/31	2021/1/14	high
289665	MiracleLinux 4 : postgresql-8.4.20-1.AXS4 (AXSA:2014-004:01)	Nessus	Miracle Linux Local Security Checks	2026/1/16	2026/1/16	critical

検出

プラグインの検索

high

high

high

high

critical

high

high

critical