Every CVE Search/ Get API key

CVE-2009-4136

PostgreSQL 7.4.x before 7.4.27, 8.0.x before 8.0.23, 8.1.x before 8.1.19, 8.2.x before 8.2.15, 8...

6.5 MediumFix available

CVE-2009-4136 is a medium vulnerability (CVSS 6.5) in Postgresql, published December 15, 2009. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.64%, the 89th percentile. Fixed in postgresql-8.1 8.1.19-0etch1.

PostgreSQL 7.4.x before 7.4.27, 8.0.x before 8.0.23, 8.1.x before 8.1.19, 8.2.x before 8.2.15, 8.3.x before 8.3.9, and 8.4.x before 8.4.2 does not properly manage session-local state during execution of an index function by a database superuser, which allows remote authenticated users to gain privileges via a table with crafted index functions, as demonstrated by functions that modify (1) search_path or (2) a prepared statement, a related issue to CVE-2007-6600 and CVE-2009-3230.

Exploit likelihood

3.64%Down 5.4 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 6.5

PostgreSQL 7.4.x before 7.4.27, 8.0.x before 8.0.23, 8.1.x before 8.1.19, 8.2.x before 8.2.15, 8.3.x before 8.3.9, and 8.4.x before 8.4.2 does not properly manage session-local state during execution of an index function by a database superuser, which allows remote authenticated users to gain privileges via a table with crafted index functions, as demonstrated by functions that modify (1) search_path or (2) a prepared statement, a related issue to CVE-2007-6600 and CVE-2009-3230.

Record
CVE-2009-4136
CVSS 2.0
6.5 MediumAV:N/AC:L/Au:S/C:P/I:P/A:P
Updated
2026-11-02
CVE List No score

PostgreSQL 7.4.x before 7.4.27, 8.0.x before 8.0.23, 8.1.x before 8.1.19, 8.2.x before 8.2.15, 8.3.x before 8.3.9, and 8.4.x before 8.4.2 does not properly manage session-local state during execution of an index function by a database superuser, which allows remote authenticated users to gain privileges via a table with crafted index functions, as demonstrated by functions that modify (1) search_path or (2) a prepared statement, a related issue to CVE-2007-6600 and CVE-2009-3230.

Record
CVE-2009-4136
Updated
2026-11-02
EUVDEUVD-2009-4106 No score

PostgreSQL 7.4.x before 7.4.27, 8.0.x before 8.0.23, 8.1.x before 8.1.19, 8.2.x before 8.2.15, 8.3.x before 8.3.9, and 8.4.x before 8.4.2 does not properly manage session-local state during execution of an index function by a database superuser, which allows remote authenticated users to gain privileges via a table with crafted index functions, as demonstrated by functions that modify (1) search_path or (2) a prepared statement, a related issue to CVE-2007-6600 and CVE-2009-3230.

Record
EUVD-2009-4106
Updated
2026-11-03
GitHub AdvisoriesGHSA-p8jm-5754-gqxq No score

PostgreSQL 7.4.x before 7.4.27, 8.0.x before 8.0.23, 8.1.x before 8.1.19, 8.2.x before 8.2.15, 8...

PostgreSQL 7.4.x before 7.4.27, 8.0.x before 8.0.23, 8.1.x before 8.1.19, 8.2.x before 8.2.15, 8.3.x before 8.3.9, and 8.4.x before 8.4.2 does not properly manage session-local state during execution of an index function by a database superuser, which allows remote authenticated users to gain privileges via a table with crafted index functions, as demonstrated by functions that modify (1) search_path or (2) a prepared statement, a related issue to CVE-2007-6600 and CVE-2009-3230.

Record
GHSA-p8jm-5754-gqxq
Updated
2026-11-02
OSVopenSUSE-SU-2024:10030-1 No score

postgresql94-9.4.10-1.1 on GA media

These are all security issues fixed in the postgresql94-9.4.10-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10030-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:10256-1 No score

postgresql93-9.3.15-1.1 on GA media

These are all security issues fixed in the postgresql93-9.3.15-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10256-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:10273-1 No score

libecpg6-32bit-9.5.4-1.2 on GA media

These are all security issues fixed in the libecpg6-32bit-9.5.4-1.2 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10273-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
postgresql-8.1
Debian:4.0
before 8.1.19-0etch1, plus listed versions
8.1.10-0etch18.1.10-18.1.11-0etch18.1.11-18.1.13-0etch1
Show 8 moreShow less
8.1.15-0etch18.1.17-0etch18.1.18-0etch18.1.8-18.1.8-28.1.9-0etch18.1.9-0etch28.1.9-1
8.1.19-0etch1
postgresql-7.4
Debian:4.0
before 1:7.4.27-0etch1, plus listed versions
1:7.4.16-11:7.4.17-0etch11:7.4.17-11:7.4.19-0etch11:7.4.23-0etch11:7.4.26-0etch1
1:7.4.27-0etch1
postgresql-8.3
Debian:5.0
before 8.3.9-0lenny1, plus listed versions
8.3.5-18.3.5-28.3.6-18.3.6-1~bpo40+18.3.7-0lenny1
Show 11 moreShow less
8.3.7-0lenny1~bpo40+18.3.7-18.3.7-28.3.7-38.3.7-48.3.8-0lenny18.3.8-0lenny1~bpo40+18.3.8-0lenny1~bpo40+28.3.8-18.3.8-1+sh48.3.9-0lenny1~bpo40+1
8.3.9-0lenny1
rh-postgresql
Red Hat:enterprise_linux:3::as
before 0:7.3.21-3
0:7.3.21-3
rh-postgresql-contrib
Red Hat:enterprise_linux:3::as
before 0:7.3.21-3
0:7.3.21-3
rh-postgresql-debuginfo
Red Hat:enterprise_linux:3::as
before 0:7.3.21-3
0:7.3.21-3
rh-postgresql-devel
Red Hat:enterprise_linux:3::as
before 0:7.3.21-3
0:7.3.21-3
rh-postgresql-docs
Red Hat:enterprise_linux:3::as
before 0:7.3.21-3
0:7.3.21-3
rh-postgresql-jdbc
Red Hat:enterprise_linux:3::as
before 0:7.3.21-3
0:7.3.21-3
rh-postgresql-libs
Red Hat:enterprise_linux:3::as
before 0:7.3.21-3
0:7.3.21-3
Show 120 moreShow less
Affected packages
PackageAffectedFixed
rh-postgresql-pl
Red Hat:enterprise_linux:3::as
before 0:7.3.21-3
0:7.3.21-3
rh-postgresql-python
Red Hat:enterprise_linux:3::as
before 0:7.3.21-3
0:7.3.21-3
rh-postgresql-server
Red Hat:enterprise_linux:3::as
before 0:7.3.21-3
0:7.3.21-3
rh-postgresql-tcl
Red Hat:enterprise_linux:3::as
before 0:7.3.21-3
0:7.3.21-3
rh-postgresql-test
Red Hat:enterprise_linux:3::as
before 0:7.3.21-3
0:7.3.21-3
rh-postgresql
Red Hat:enterprise_linux:3::desktop
before 0:7.3.21-3
0:7.3.21-3
rh-postgresql-contrib
Red Hat:enterprise_linux:3::desktop
before 0:7.3.21-3
0:7.3.21-3
rh-postgresql-debuginfo
Red Hat:enterprise_linux:3::desktop
before 0:7.3.21-3
0:7.3.21-3
rh-postgresql-devel
Red Hat:enterprise_linux:3::desktop
before 0:7.3.21-3
0:7.3.21-3
rh-postgresql-docs
Red Hat:enterprise_linux:3::desktop
before 0:7.3.21-3
0:7.3.21-3
rh-postgresql-jdbc
Red Hat:enterprise_linux:3::desktop
before 0:7.3.21-3
0:7.3.21-3
rh-postgresql-libs
Red Hat:enterprise_linux:3::desktop
before 0:7.3.21-3
0:7.3.21-3
rh-postgresql-pl
Red Hat:enterprise_linux:3::desktop
before 0:7.3.21-3
0:7.3.21-3
rh-postgresql-python
Red Hat:enterprise_linux:3::desktop
before 0:7.3.21-3
0:7.3.21-3
rh-postgresql-server
Red Hat:enterprise_linux:3::desktop
before 0:7.3.21-3
0:7.3.21-3
rh-postgresql-tcl
Red Hat:enterprise_linux:3::desktop
before 0:7.3.21-3
0:7.3.21-3
rh-postgresql-test
Red Hat:enterprise_linux:3::desktop
before 0:7.3.21-3
0:7.3.21-3
rh-postgresql
Red Hat:enterprise_linux:3::es
before 0:7.3.21-3
0:7.3.21-3
rh-postgresql-contrib
Red Hat:enterprise_linux:3::es
before 0:7.3.21-3
0:7.3.21-3
rh-postgresql-debuginfo
Red Hat:enterprise_linux:3::es
before 0:7.3.21-3
0:7.3.21-3
rh-postgresql-devel
Red Hat:enterprise_linux:3::es
before 0:7.3.21-3
0:7.3.21-3
rh-postgresql-docs
Red Hat:enterprise_linux:3::es
before 0:7.3.21-3
0:7.3.21-3
rh-postgresql-jdbc
Red Hat:enterprise_linux:3::es
before 0:7.3.21-3
0:7.3.21-3
rh-postgresql-libs
Red Hat:enterprise_linux:3::es
before 0:7.3.21-3
0:7.3.21-3
rh-postgresql-pl
Red Hat:enterprise_linux:3::es
before 0:7.3.21-3
0:7.3.21-3
rh-postgresql-python
Red Hat:enterprise_linux:3::es
before 0:7.3.21-3
0:7.3.21-3
rh-postgresql-server
Red Hat:enterprise_linux:3::es
before 0:7.3.21-3
0:7.3.21-3
rh-postgresql-tcl
Red Hat:enterprise_linux:3::es
before 0:7.3.21-3
0:7.3.21-3
rh-postgresql-test
Red Hat:enterprise_linux:3::es
before 0:7.3.21-3
0:7.3.21-3
rh-postgresql
Red Hat:enterprise_linux:3::ws
before 0:7.3.21-3
0:7.3.21-3
rh-postgresql-contrib
Red Hat:enterprise_linux:3::ws
before 0:7.3.21-3
0:7.3.21-3
rh-postgresql-debuginfo
Red Hat:enterprise_linux:3::ws
before 0:7.3.21-3
0:7.3.21-3
rh-postgresql-devel
Red Hat:enterprise_linux:3::ws
before 0:7.3.21-3
0:7.3.21-3
rh-postgresql-docs
Red Hat:enterprise_linux:3::ws
before 0:7.3.21-3
0:7.3.21-3
rh-postgresql-jdbc
Red Hat:enterprise_linux:3::ws
before 0:7.3.21-3
0:7.3.21-3
rh-postgresql-libs
Red Hat:enterprise_linux:3::ws
before 0:7.3.21-3
0:7.3.21-3
rh-postgresql-pl
Red Hat:enterprise_linux:3::ws
before 0:7.3.21-3
0:7.3.21-3
rh-postgresql-python
Red Hat:enterprise_linux:3::ws
before 0:7.3.21-3
0:7.3.21-3
rh-postgresql-server
Red Hat:enterprise_linux:3::ws
before 0:7.3.21-3
0:7.3.21-3
rh-postgresql-tcl
Red Hat:enterprise_linux:3::ws
before 0:7.3.21-3
0:7.3.21-3
rh-postgresql-test
Red Hat:enterprise_linux:3::ws
before 0:7.3.21-3
0:7.3.21-3
postgresql
Red Hat:enterprise_linux:4::as
before 0:7.4.29-1.el4_8.1
0:7.4.29-1.el4_8.1
postgresql-contrib
Red Hat:enterprise_linux:4::as
before 0:7.4.29-1.el4_8.1
0:7.4.29-1.el4_8.1
postgresql-debuginfo
Red Hat:enterprise_linux:4::as
before 0:7.4.29-1.el4_8.1
0:7.4.29-1.el4_8.1
postgresql-devel
Red Hat:enterprise_linux:4::as
before 0:7.4.29-1.el4_8.1
0:7.4.29-1.el4_8.1
postgresql-docs
Red Hat:enterprise_linux:4::as
before 0:7.4.29-1.el4_8.1
0:7.4.29-1.el4_8.1
postgresql-jdbc
Red Hat:enterprise_linux:4::as
before 0:7.4.29-1.el4_8.1
0:7.4.29-1.el4_8.1
postgresql-libs
Red Hat:enterprise_linux:4::as
before 0:7.4.29-1.el4_8.1
0:7.4.29-1.el4_8.1
postgresql-pl
Red Hat:enterprise_linux:4::as
before 0:7.4.29-1.el4_8.1
0:7.4.29-1.el4_8.1
postgresql-python
Red Hat:enterprise_linux:4::as
before 0:7.4.29-1.el4_8.1
0:7.4.29-1.el4_8.1
postgresql-server
Red Hat:enterprise_linux:4::as
before 0:7.4.29-1.el4_8.1
0:7.4.29-1.el4_8.1
postgresql-tcl
Red Hat:enterprise_linux:4::as
before 0:7.4.29-1.el4_8.1
0:7.4.29-1.el4_8.1
postgresql-test
Red Hat:enterprise_linux:4::as
before 0:7.4.29-1.el4_8.1
0:7.4.29-1.el4_8.1
postgresql
Red Hat:enterprise_linux:4::desktop
before 0:7.4.29-1.el4_8.1
0:7.4.29-1.el4_8.1
postgresql-contrib
Red Hat:enterprise_linux:4::desktop
before 0:7.4.29-1.el4_8.1
0:7.4.29-1.el4_8.1
postgresql-debuginfo
Red Hat:enterprise_linux:4::desktop
before 0:7.4.29-1.el4_8.1
0:7.4.29-1.el4_8.1
postgresql-devel
Red Hat:enterprise_linux:4::desktop
before 0:7.4.29-1.el4_8.1
0:7.4.29-1.el4_8.1
postgresql-docs
Red Hat:enterprise_linux:4::desktop
before 0:7.4.29-1.el4_8.1
0:7.4.29-1.el4_8.1
postgresql-jdbc
Red Hat:enterprise_linux:4::desktop
before 0:7.4.29-1.el4_8.1
0:7.4.29-1.el4_8.1
postgresql-libs
Red Hat:enterprise_linux:4::desktop
before 0:7.4.29-1.el4_8.1
0:7.4.29-1.el4_8.1
postgresql-pl
Red Hat:enterprise_linux:4::desktop
before 0:7.4.29-1.el4_8.1
0:7.4.29-1.el4_8.1
postgresql-python
Red Hat:enterprise_linux:4::desktop
before 0:7.4.29-1.el4_8.1
0:7.4.29-1.el4_8.1
postgresql-server
Red Hat:enterprise_linux:4::desktop
before 0:7.4.29-1.el4_8.1
0:7.4.29-1.el4_8.1
postgresql-tcl
Red Hat:enterprise_linux:4::desktop
before 0:7.4.29-1.el4_8.1
0:7.4.29-1.el4_8.1
postgresql-test
Red Hat:enterprise_linux:4::desktop
before 0:7.4.29-1.el4_8.1
0:7.4.29-1.el4_8.1
postgresql
Red Hat:enterprise_linux:4::es
before 0:7.4.29-1.el4_8.1
0:7.4.29-1.el4_8.1
postgresql-contrib
Red Hat:enterprise_linux:4::es
before 0:7.4.29-1.el4_8.1
0:7.4.29-1.el4_8.1
postgresql-debuginfo
Red Hat:enterprise_linux:4::es
before 0:7.4.29-1.el4_8.1
0:7.4.29-1.el4_8.1
postgresql-devel
Red Hat:enterprise_linux:4::es
before 0:7.4.29-1.el4_8.1
0:7.4.29-1.el4_8.1
postgresql-docs
Red Hat:enterprise_linux:4::es
before 0:7.4.29-1.el4_8.1
0:7.4.29-1.el4_8.1
postgresql-jdbc
Red Hat:enterprise_linux:4::es
before 0:7.4.29-1.el4_8.1
0:7.4.29-1.el4_8.1
postgresql-libs
Red Hat:enterprise_linux:4::es
before 0:7.4.29-1.el4_8.1
0:7.4.29-1.el4_8.1
postgresql-pl
Red Hat:enterprise_linux:4::es
before 0:7.4.29-1.el4_8.1
0:7.4.29-1.el4_8.1
postgresql-python
Red Hat:enterprise_linux:4::es
before 0:7.4.29-1.el4_8.1
0:7.4.29-1.el4_8.1
postgresql-server
Red Hat:enterprise_linux:4::es
before 0:7.4.29-1.el4_8.1
0:7.4.29-1.el4_8.1
postgresql-tcl
Red Hat:enterprise_linux:4::es
before 0:7.4.29-1.el4_8.1
0:7.4.29-1.el4_8.1
postgresql-test
Red Hat:enterprise_linux:4::es
before 0:7.4.29-1.el4_8.1
0:7.4.29-1.el4_8.1
postgresql
Red Hat:enterprise_linux:4::ws
before 0:7.4.29-1.el4_8.1
0:7.4.29-1.el4_8.1
postgresql-contrib
Red Hat:enterprise_linux:4::ws
before 0:7.4.29-1.el4_8.1
0:7.4.29-1.el4_8.1
postgresql-debuginfo
Red Hat:enterprise_linux:4::ws
before 0:7.4.29-1.el4_8.1
0:7.4.29-1.el4_8.1
postgresql-devel
Red Hat:enterprise_linux:4::ws
before 0:7.4.29-1.el4_8.1
0:7.4.29-1.el4_8.1
postgresql-docs
Red Hat:enterprise_linux:4::ws
before 0:7.4.29-1.el4_8.1
0:7.4.29-1.el4_8.1
postgresql-jdbc
Red Hat:enterprise_linux:4::ws
before 0:7.4.29-1.el4_8.1
0:7.4.29-1.el4_8.1
postgresql-libs
Red Hat:enterprise_linux:4::ws
before 0:7.4.29-1.el4_8.1
0:7.4.29-1.el4_8.1
postgresql-pl
Red Hat:enterprise_linux:4::ws
before 0:7.4.29-1.el4_8.1
0:7.4.29-1.el4_8.1
postgresql-python
Red Hat:enterprise_linux:4::ws
before 0:7.4.29-1.el4_8.1
0:7.4.29-1.el4_8.1
postgresql-server
Red Hat:enterprise_linux:4::ws
before 0:7.4.29-1.el4_8.1
0:7.4.29-1.el4_8.1
postgresql-tcl
Red Hat:enterprise_linux:4::ws
before 0:7.4.29-1.el4_8.1
0:7.4.29-1.el4_8.1
postgresql-test
Red Hat:enterprise_linux:4::ws
before 0:7.4.29-1.el4_8.1
0:7.4.29-1.el4_8.1
postgresql
Red Hat:enterprise_linux:5::client_workstation
before 0:8.1.21-1.el5_5.1
0:8.1.21-1.el5_5.1
postgresql-debuginfo
Red Hat:enterprise_linux:5::client_workstation
before 0:8.1.21-1.el5_5.1
0:8.1.21-1.el5_5.1
postgresql-devel
Red Hat:enterprise_linux:5::client_workstation
before 0:8.1.21-1.el5_5.1
0:8.1.21-1.el5_5.1
postgresql-pl
Red Hat:enterprise_linux:5::client_workstation
before 0:8.1.21-1.el5_5.1
0:8.1.21-1.el5_5.1
postgresql-server
Red Hat:enterprise_linux:5::client_workstation
before 0:8.1.21-1.el5_5.1
0:8.1.21-1.el5_5.1
postgresql-test
Red Hat:enterprise_linux:5::client_workstation
before 0:8.1.21-1.el5_5.1
0:8.1.21-1.el5_5.1
postgresql
Red Hat:enterprise_linux:5::client
before 0:8.1.21-1.el5_5.1
0:8.1.21-1.el5_5.1
postgresql-contrib
Red Hat:enterprise_linux:5::client
before 0:8.1.21-1.el5_5.1
0:8.1.21-1.el5_5.1
postgresql-debuginfo
Red Hat:enterprise_linux:5::client
before 0:8.1.21-1.el5_5.1
0:8.1.21-1.el5_5.1
postgresql-devel
Red Hat:enterprise_linux:5::client
before 0:8.1.21-1.el5_5.1
0:8.1.21-1.el5_5.1
postgresql-docs
Red Hat:enterprise_linux:5::client
before 0:8.1.21-1.el5_5.1
0:8.1.21-1.el5_5.1
postgresql-libs
Red Hat:enterprise_linux:5::client
before 0:8.1.21-1.el5_5.1
0:8.1.21-1.el5_5.1
postgresql-pl
Red Hat:enterprise_linux:5::client
before 0:8.1.21-1.el5_5.1
0:8.1.21-1.el5_5.1
postgresql-python
Red Hat:enterprise_linux:5::client
before 0:8.1.21-1.el5_5.1
0:8.1.21-1.el5_5.1
postgresql-server
Red Hat:enterprise_linux:5::client
before 0:8.1.21-1.el5_5.1
0:8.1.21-1.el5_5.1
postgresql-tcl
Red Hat:enterprise_linux:5::client
before 0:8.1.21-1.el5_5.1
0:8.1.21-1.el5_5.1
postgresql-test
Red Hat:enterprise_linux:5::client
before 0:8.1.21-1.el5_5.1
0:8.1.21-1.el5_5.1
postgresql
Red Hat:enterprise_linux:5::server
before 0:8.1.21-1.el5_5.1
0:8.1.21-1.el5_5.1
postgresql-contrib
Red Hat:enterprise_linux:5::server
before 0:8.1.21-1.el5_5.1
0:8.1.21-1.el5_5.1
postgresql-debuginfo
Red Hat:enterprise_linux:5::server
before 0:8.1.21-1.el5_5.1
0:8.1.21-1.el5_5.1
postgresql-devel
Red Hat:enterprise_linux:5::server
before 0:8.1.21-1.el5_5.1
0:8.1.21-1.el5_5.1
postgresql-docs
Red Hat:enterprise_linux:5::server
before 0:8.1.21-1.el5_5.1
0:8.1.21-1.el5_5.1
postgresql-libs
Red Hat:enterprise_linux:5::server
before 0:8.1.21-1.el5_5.1
0:8.1.21-1.el5_5.1
postgresql-pl
Red Hat:enterprise_linux:5::server
before 0:8.1.21-1.el5_5.1
0:8.1.21-1.el5_5.1
postgresql-python
Red Hat:enterprise_linux:5::server
before 0:8.1.21-1.el5_5.1
0:8.1.21-1.el5_5.1
postgresql-server
Red Hat:enterprise_linux:5::server
before 0:8.1.21-1.el5_5.1
0:8.1.21-1.el5_5.1
postgresql-tcl
Red Hat:enterprise_linux:5::server
before 0:8.1.21-1.el5_5.1
0:8.1.21-1.el5_5.1
postgresql-test
Red Hat:enterprise_linux:5::server
before 0:8.1.21-1.el5_5.1
0:8.1.21-1.el5_5.1
postgresql94
openSUSE:Tumbleweed
before 9.4.10-1.1
9.4.10-1.1
postgresql93
openSUSE:Tumbleweed
before 9.3.15-1.1
9.3.15-1.1
postgresql95
openSUSE:Tumbleweed
before 9.5.4-1.2
9.5.4-1.2

History

History
WhenChangedSources
2026-11-03aliasesEUVD
2026-11-02createdCVE List, GitHub Advisories, NVD, OSV

References

Show 89 moreShow less
MoveEnter Open