CVE-2016-0767 PostgreSQL PL/Java Improper Privilege Management

Medium 6.5 Published 6 Jun 2017 Updated 5 Aug 2024

Authenticated users with public schema usage can alter the classpath, potentially leading to privilege escalation or code execution.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2016-0767?

CVE-2016-0767 is a medium-severity vulnerability in n/a, published on 6 Jun 2017. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

PostgreSQL PL/Java before 1.5.0 allows remote authenticated users with USAGE permission on the public schema to alter the public schema classpath.

Weakness: CWE-269

Which versions are affected by CVE-2016-0767?

2 open source packages ship an affected version, including postgresql:pljava-public. It affects 1 product.

Package	Affected	Fixed in
`postgresql:pljava-public` Maven	All versions	`1.5.0`
`postgresql:pljava-public` Maven	All versions	`1.5.0`

Products include Pl\/Java Project Pl\/Java.

How do I fix CVE-2016-0767?

Upgrade postgresql:pljava-public to 1.5.0 or later.

Is CVE-2016-0767 being exploited?

There is no known exploitation of CVE-2016-0767 in the wild and no public exploit code.

CVE-2016-2192 Privilege escalation in n/a Medium 6.5

Sources

Also known as GHSA-837x-xww6-7jqm.