CVE-2016-3065 Information disclosure in n/a
Attackers can bypass access restrictions to read sensitive server memory or crash the server via crafted BRIN index pages in the pageinspect extension.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2016-3065?
CVE-2016-3065 is a critical vulnerability in Postgresql Postgresql, published on 11 Apr 2016. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The (1) brin_page_type and (2) brin_metapage_info functions in the pageinspect extension in PostgreSQL before 9.5.x before 9.5.2 allows attackers to bypass intended access restrictions and consequently obtain sensitive server memory information or cause a denial of service (server crash) via a crafted bytea value in a BRIN index page.
Weakness: CWE-264
Which versions are affected by CVE-2016-3065?
It affects 1 product.
Products include Postgresql Postgresql.
How do I fix CVE-2016-3065?
Upgrade to a fixed version.
Is CVE-2016-3065 being exploited?
There is no known exploitation of CVE-2016-3065 in the wild and no public exploit code.
Other vulnerabilities in Postgresql Postgresql
Sources
Also known as GHSA-8v7w-4wg8-q7v4.