{"id":"CVE-2014-2669","aliases":["DSA-2865-1","EUVD-2014-2701","GHSA-mjx6-524j-mf72","RHSA-2014:0221","RHSA-2014:0469","UBUNTU-CVE-2014-2669"],"status":"published","title":"Multiple integer overflows in contrib/hstore/hstore_io.c in PostgreSQL 9.0.x before 9.0.16, 9.1.x...","description":"Multiple integer overflows in contrib/hstore/hstore_io.c in PostgreSQL 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 allow remote authenticated users to have unspecified impact via vectors related to the (1) hstore_recv, (2) hstore_from_arrays, and (3) hstore_from_array functions in contrib/hstore/hstore_io.c; and the (4) hstoreArrayToPairs function in contrib/hstore/hstore_op.c, which triggers a buffer overflow.  NOTE: this issue was SPLIT from CVE-2014-0064 because it has a different set of affected versions.","severity":{"version":"2.0","score":6.5,"vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.03503,"percentile":0.89262,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-189"],"published":"2014-02-20T00:00:00Z","modified":"2026-06-29T10:06:42Z","fixes":[{"ecosystem":"Ubuntu:14.04:LTS","package":"postgresql-9.1","fixed_in":["9.1.12-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:7","package":"postgresql-9.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.1.12-0wheezy1"}]}],"versions":["9.1.10-0wheezy1","9.1.10-1","9.1.11-0wheezy1","9.1.11-1","9.1.11-1~bpo60+1","9.1.11-2","9.1.12-0wheezy1~bpo60+1","9.1.9-1","9.1.9-2","9.1.9-3","9.1.9-4","9.1.9-5"],"bundled":9},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:1::el6","package":"postgresql92-postgresql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.2.7-1.1.el6"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:1::el6","package":"postgresql92-postgresql-contrib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.2.7-1.1.el6"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:1::el6","package":"postgresql92-postgresql-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.2.7-1.1.el6"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:1::el6","package":"postgresql92-postgresql-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.2.7-1.1.el6"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:1::el6","package":"postgresql92-postgresql-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.2.7-1.1.el6"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:1::el6","package":"postgresql92-postgresql-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.2.7-1.1.el6"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:1::el6","package":"postgresql92-postgresql-plperl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.2.7-1.1.el6"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:1::el6","package":"postgresql92-postgresql-plpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.2.7-1.1.el6"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:1::el6","package":"postgresql92-postgresql-pltcl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.2.7-1.1.el6"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:1::el6","package":"postgresql92-postgresql-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.2.7-1.1.el6"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:1::el6","package":"postgresql92-postgresql-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.2.7-1.1.el6"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:1::el6","package":"postgresql92-postgresql-upgrade","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.2.7-1.1.el6"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5::el6","package":"cfme","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.2.3.2-1.el6cf"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5::el6","package":"cfme-appliance","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.2.3.2-1.el6cf"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5::el6","package":"cfme-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.2.3.2-1.el6cf"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5::el6","package":"cfme-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.2.3.2-1.el6cf"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5::el6","package":"mingw32-cfme-host","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.2.3.2-1.el6cf"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5::el6","package":"postgresql92-postgresql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.2.7-1.1.el6"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5::el6","package":"postgresql92-postgresql-contrib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.2.7-1.1.el6"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5::el6","package":"postgresql92-postgresql-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.2.7-1.1.el6"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5::el6","package":"postgresql92-postgresql-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.2.7-1.1.el6"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5::el6","package":"postgresql92-postgresql-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.2.7-1.1.el6"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5::el6","package":"postgresql92-postgresql-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.2.7-1.1.el6"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5::el6","package":"postgresql92-postgresql-plperl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.2.7-1.1.el6"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5::el6","package":"postgresql92-postgresql-plpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.2.7-1.1.el6"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5::el6","package":"postgresql92-postgresql-pltcl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.2.7-1.1.el6"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5::el6","package":"postgresql92-postgresql-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.2.7-1.1.el6"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5::el6","package":"postgresql92-postgresql-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.2.7-1.1.el6"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5::el6","package":"postgresql92-postgresql-upgrade","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.2.7-1.1.el6"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5::el6","package":"prince","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0r2-4.el6cf"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5::el6","package":"ruby193-rubygem-actionpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.2.13-6.el6cf"}]}],"bundled":11},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"postgresql-9.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.1.12-1"}]}],"versions":["9.1.10-1","9.1.10-1bzr1","9.1.11-1","9.1.11-2"]}],"products":[{"vendor":"postgresql","product":"postgresql"}],"references":[{"url":"http://rhn.redhat.com/errata/RHSA-2014-0221.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"http://rhn.redhat.com/errata/RHSA-2014-0469.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://github.com/postgres/postgres/commit/31400a673325147e1205326008e32135a78b4d8a","tags":["x_refsource_CONFIRM","x_transferred","report"]},{"url":"http://wiki.postgresql.org/wiki/20140220securityrelease","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","report"]},{"url":"http://www.debian.org/security/2014/dsa-2864","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","report"]},{"url":"http://www.postgresql.org/support/security/","tags":["x_refsource_CONFIRM","x_transferred","report"]},{"url":"http://www.postgresql.org/about/news/1506/","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","report"]},{"url":"http://www.debian.org/security/2014/dsa-2865","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-2669","tags":["advisory"]},{"url":"http://www.postgresql.org/about/news/1506"},{"url":"http://www.postgresql.org/support/security"},{"url":"https://github.com/advisories/GHSA-mjx6-524j-mf72"},{"url":"https://access.redhat.com/errata/RHSA-2014:0221","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"http://www.postgresql.org/docs/9.2/static/release-9-2-7.html","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1065219","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1065220","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1065222","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1065226","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1065230","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1065235","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1065236","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_0221.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-0060","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-0060","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-0060","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-0061","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-0061","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-0061","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-0062","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-0062","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-0062","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-0063","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-0063","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-0063","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-0064","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-0064","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-0064","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-0065","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-0065","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-0065","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-0066","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-0066","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-0066","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-2669","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1082154","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-2669","tags":["advisory","report"]},{"url":"https://access.redhat.com/errata/RHSA-2014:0469","tags":["advisory"]},{"url":"https://access.redhat.com/site/documentation/en-US/CloudForms/3.0/html/Management_Engine_5.2_Technical_Notes/index.html","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1036409","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1064556","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1076688","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_0469.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-6417","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-6417","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-6417","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-0078","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-0078","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-0078","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-0137","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-0137","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-0137","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2014-2669","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2014-2669","description":"Multiple integer overflows in contrib/hstore/hstore_io.c in PostgreSQL 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 allow remote authenticated users to have unspecified impact via vectors related to the (1) hstore_recv, (2) hstore_from_arrays, and (3) hstore_from_array functions in contrib/hstore/hstore_io.c; and the (4) hstoreArrayToPairs function in contrib/hstore/hstore_op.c, which triggers a buffer overflow.  NOTE: this issue was SPLIT from CVE-2014-0064 because it has a different set of affected versions.","status":"published","published":"2014-03-28T17:00:00Z","modified":"2024-08-06T10:21:35.93Z","updated_at":"2026-11-02T14:33:43.883586Z"}],"euvd":[{"id":"EUVD-2014-2701","description":"Multiple integer overflows in contrib/hstore/hstore_io.c in PostgreSQL 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 allow remote authenticated users to have unspecified impact via vectors related to the (1) hstore_recv, (2) hstore_from_arrays, and (3) hstore_from_array functions in contrib/hstore/hstore_io.c; and the (4) hstoreArrayToPairs function in contrib/hstore/hstore_op.c, which triggers a buffer overflow.  NOTE: this issue was SPLIT from CVE-2014-0064 because it has a different set of affected versions.","status":"published","published":"2014-03-28T17:00:00Z","modified":"2024-08-06T10:21:35Z","updated_at":"2026-11-03T01:57:13.484356Z"}],"ghsa":[{"id":"GHSA-mjx6-524j-mf72","title":"Multiple integer overflows in contrib/hstore/hstore_io.c in PostgreSQL 9.0.x before 9.0.16, 9.1.x...","description":"Multiple integer overflows in contrib/hstore/hstore_io.c in PostgreSQL 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 allow remote authenticated users to have unspecified impact via vectors related to the (1) hstore_recv, (2) hstore_from_arrays, and (3) hstore_from_array functions in contrib/hstore/hstore_io.c; and the (4) hstoreArrayToPairs function in contrib/hstore/hstore_op.c, which triggers a buffer overflow.  NOTE: this issue was SPLIT from CVE-2014-0064 because it has a different set of affected versions.","status":"published","published":"2022-05-17T00:13:47Z","modified":"2025-04-12T12:33:05Z","updated_at":"2026-11-02T15:01:17.411211Z"}],"nvd":[{"id":"CVE-2014-2669","description":"Multiple integer overflows in contrib/hstore/hstore_io.c in PostgreSQL 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 allow remote authenticated users to have unspecified impact via vectors related to the (1) hstore_recv, (2) hstore_from_arrays, and (3) hstore_from_array functions in contrib/hstore/hstore_io.c; and the (4) hstoreArrayToPairs function in contrib/hstore/hstore_op.c, which triggers a buffer overflow.  NOTE: this issue was SPLIT from CVE-2014-0064 because it has a different set of affected versions.","status":"published","published":"2014-03-31T14:58:19.6Z","modified":"2026-06-17T00:07:00.183Z","cvss":[{"version":"2.0","score":6.5,"vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-189"],"updated_at":"2026-11-02T14:02:53.710973Z"}],"osv":[{"id":"DSA-2865-1","title":"postgresql-9.1 - several","status":"published","published":"2014-02-20T00:00:00Z","modified":"2026-03-09T01:21:25.438578Z","updated_at":"2026-11-02T15:46:15.843838Z"},{"id":"RHSA-2014:0221","title":"Red Hat Security Advisory: postgresql92-postgresql security update","status":"published","published":"2024-09-13T08:52:04Z","modified":"2026-06-29T10:06:26Z","updated_at":"2026-11-02T15:53:01.993625Z"},{"id":"RHSA-2014:0469","title":"Red Hat Security Advisory: cfme security, bug fix, and enhancement update","status":"published","published":"2024-09-15T21:31:56Z","modified":"2026-06-29T10:06:42Z","updated_at":"2026-11-02T15:53:02.532052Z"},{"id":"UBUNTU-CVE-2014-2669","description":"Multiple integer overflows in contrib/hstore/hstore_io.c in PostgreSQL 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 allow remote authenticated users to have unspecified impact via vectors related to the (1) hstore_recv, (2) hstore_from_arrays, and (3) hstore_from_array functions in contrib/hstore/hstore_io.c; and the (4) hstoreArrayToPairs function in contrib/hstore/hstore_op.c, which triggers a buffer overflow.  NOTE: this issue was SPLIT from CVE-2014-0064 because it has a different set of affected versions.","status":"published","published":"2014-03-31T14:58:00Z","modified":"2025-07-18T16:43:00Z","updated_at":"2026-11-02T15:54:09.010095Z"}]}}