CVE-2013-0255 Information disclosure in n/a
Authenticated users can crash the server or read sensitive memory via crafted SQL commands due to an array index error in PostgreSQL.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2013-0255?
CVE-2013-0255 is a medium-severity vulnerability in Postgresql Postgresql, published on 13 Feb 2013. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
PostgreSQL 9.2.x before 9.2.3, 9.1.x before 9.1.8, 9.0.x before 9.0.12, 8.4.x before 8.4.16, and 8.3.x before 8.3.23 does not properly declare the enum_recv function in backend/utils/adt/enum.c, which causes it to be invoked with incorrect arguments and allows remote authenticated users to cause a denial of service (server crash) or read sensitive process memory via a crafted SQL command, which triggers an array index error and an out-of-bounds read.
Weakness: CWE-20
Which versions are affected by CVE-2013-0255?
It affects 1 product.
Products include Postgresql Postgresql.
How do I fix CVE-2013-0255?
Upgrade to a fixed version.
Is CVE-2013-0255 being exploited?
There is no known exploitation of CVE-2013-0255 in the wild and no public exploit code.
Other vulnerabilities in Postgresql Postgresql
Sources
Also known as DSA-2630-1, GHSA-gqfc-2mjg-94r3.