CVE-2014-2669 Integer overflow in n/a
Remote authenticated users can trigger integer overflows in PostgreSQL hstore functions, potentially leading to code execution or denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2014-2669?
CVE-2014-2669 is a medium-severity vulnerability in Postgresql Postgresql, published on 28 Mar 2014. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Multiple integer overflows in contrib/hstore/hstore_io.c in PostgreSQL 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 allow remote authenticated users to have unspecified impact via vectors related to the (1) hstore_recv, (2) hstore_from_arrays, and (3) hstore_from_array functions in contrib/hstore/hstore_io.c; and the (4) hstoreArrayToPairs function in contrib/hstore/hstore_op.c, which triggers a buffer overflow. NOTE: this issue was SPLIT from CVE-2014-0064 because it has a different set of affected versions.
Weakness: CWE-189
Which versions are affected by CVE-2014-2669?
It affects 1 product.
Products include Postgresql Postgresql.
How do I fix CVE-2014-2669?
Upgrade to a fixed version.
Is CVE-2014-2669 being exploited?
There is no known exploitation of CVE-2014-2669 in the wild and no public exploit code.
Other vulnerabilities in Postgresql Postgresql
Sources
Also known as GHSA-mjx6-524j-mf72, UBUNTU-CVE-2014-2669.