{"id":"CVE-2016-0766","aliases":["DSA-3475-1","DSA-3476-1","EUVD-2016-0783","GHSA-cr7c-24h8-pv37","MGASA-2016-0085","SUSE-SU-2016:0539-1","SUSE-SU-2016:0555-1","SUSE-SU-2016:0677-1","UBUNTU-CVE-2016-0766","USN-2894-1","openSUSE-SU-2024:10030-1","openSUSE-SU-2024:10256-1","openSUSE-SU-2024:10273-1"],"status":"published","title":"PostgreSQL before 9.1.20, 9.2.x before 9.2.15, 9.3.x before 9.3.11, 9.4.x before 9.4.6, and 9.5.x...","description":"PostgreSQL before 9.1.20, 9.2.x before 9.2.15, 9.3.x before 9.3.11, 9.4.x before 9.4.6, and 9.5.x before 9.5.1 does not properly restrict access to unspecified custom configuration settings (GUCS) for PL/Java, which allows attackers to gain privileges via unspecified vectors.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-06","score":0.04111,"percentile":0.90822,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-264"],"published":"2016-02-11T00:00:00Z","modified":"2026-06-17T00:38:11Z","fixes":[{"ecosystem":"Ubuntu:14.04:LTS","package":"postgresql-9.1","fixed_in":["9.1.20-0ubuntu0.14.04"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"postgresql-9.3","fixed_in":["9.3.11-0ubuntu0.14.04"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:7","package":"postgresql-9.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.1.20-0+deb7u1"}]}],"versions":["9.1.10-0wheezy1","9.1.10-1","9.1.11-0wheezy1","9.1.11-1","9.1.11-1~bpo60+1","9.1.11-2","9.1.12-0wheezy1","9.1.12-0wheezy1~bpo60+1","9.1.12-1","9.1.13-0wheezy1","9.1.13-0wheezy1~bpo60+1","9.1.13-1","9.1.14-0+deb7u1","9.1.14-0wheezy1","9.1.15-0+deb7u1","9.1.15-0+deb7u1~bpo60+1","9.1.16-0+deb7u1","9.1.16-0+deb7u2","9.1.17-0+deb7u1","9.1.18-0+deb7u1","9.1.19-0+deb7u1","9.1.9-1","9.1.9-2","9.1.9-3","9.1.9-4","9.1.9-5"],"bundled":3},{"source":"osv","ecosystem":"Debian:8","package":"postgresql-9.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.6-0+deb8u1"}]}],"versions":["9.4.1-1","9.4.2-0+deb8u1","9.4.2-1","9.4.3-0+deb8u1","9.4.3-1","9.4.4-0+deb8u1","9.4.4-1","9.4.4-2","9.4.5-0+deb8u1","9.4.5-0+deb8u1~bpo70+1","9.4.5-1","9.4.5-2","9.4.6-0+deb8u1~bpo70+1"],"bundled":2},{"source":"osv","ecosystem":"Mageia:5","package":"postgresql9.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.3.11-1.mga5"}]}],"bundled":2},{"source":"osv","ecosystem":"Mageia:5","package":"postgresql9.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.6-1.mga5"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12","package":"postgresql93","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.3.11-14.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12","package":"postgresql93-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.3.11-14.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12","package":"postgresql93","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.3.11-14.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12","package":"postgresql93","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.3.11-14.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12","package":"postgresql94","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.6-7.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12","package":"postgresql94-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.6-7.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP1","package":"postgresql94","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.6-7.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP1","package":"postgresql94-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.6-7.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12","package":"postgresql94-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.6-7.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP1","package":"postgresql94-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.6-7.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12","package":"postgresql94","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.6-7.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12","package":"postgresql94-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.6-7.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12","package":"postgresql94","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.6-7.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12","package":"postgresql94-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.6-7.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1","package":"postgresql94","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.6-7.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1","package":"postgresql94-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.6-7.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"postgresql94","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.6-7.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"postgresql94-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.6-7.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP4","package":"postgresql94-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.6-0.14.3"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 11 SP4","package":"postgresql94","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.6-0.14.3"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 11 SP4","package":"postgresql94-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.6-0.14.3"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"postgresql94","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.6-0.14.3"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"postgresql94-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.6-0.14.3"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"postgresql94","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.6-0.14.3"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"postgresql94-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.6-0.14.3"}]}],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"postgresql-9.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.1.20-0ubuntu0.14.04"}]}],"versions":["9.1.10-1","9.1.10-1bzr1","9.1.11-1","9.1.11-2","9.1.12-1","9.1.13-1","9.1.14-0ubuntu0.14.04","9.1.15-0ubuntu0.14.04","9.1.16-0ubuntu0.14.04","9.1.17-0ubuntu0.14.04","9.1.18-0ubuntu0.14.04","9.1.19-0ubuntu0.14.04"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"postgresql-9.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.3.11-0ubuntu0.14.04"}]}],"versions":["9.3.1-1","9.3.2-1","9.3.2-1ubuntu1","9.3.2-1ubuntu2","9.3.3-1","9.3.3-1bzr1","9.3.3-1bzr2","9.3.4-1","9.3.5-0ubuntu0.14.04.1","9.3.6-0ubuntu0.14.04","9.3.7-0ubuntu0.14.04","9.3.8-0ubuntu0.4.04","9.3.9-0ubuntu0.14.04","9.3.10-0ubuntu0.14.04"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"postgresql-9.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.3.11-0ubuntu0.14.04"}]}],"versions":["9.3.1-1","9.3.2-1","9.3.2-1ubuntu1","9.3.2-1ubuntu2","9.3.3-1","9.3.3-1bzr1","9.3.3-1bzr2","9.3.4-1","9.3.5-0ubuntu0.14.04.1","9.3.6-0ubuntu0.14.04","9.3.7-0ubuntu0.14.04","9.3.8-0ubuntu0.4.04","9.3.9-0ubuntu0.14.04","9.3.10-0ubuntu0.14.04"],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"postgresql94","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.10-1.1"}]}],"bundled":35},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"postgresql93","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.3.15-1.1"}]}],"bundled":40},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"postgresql95","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.4-1.2"}]}],"bundled":37}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"debian","product":"debian_linux"},{"vendor":"postgresql","product":"postgresql"}],"references":[{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00054.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory"]},{"url":"http://www.postgresql.org/docs/current/static/release-9-3-11.html","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00016.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00052.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory"]},{"url":"http://www.postgresql.org/docs/current/static/release-9-2-15.html","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory"]},{"url":"http://www.postgresql.org/docs/current/static/release-9-5-1.html","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory"]},{"url":"https://security.gentoo.org/glsa/201701-33","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory"]},{"url":"http://www.postgresql.org/about/news/1644/","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","report"]},{"url":"http://www.securitytracker.com/id/1035005","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","Third Party Advisory","VDB Entry"]},{"url":"http://www.securityfocus.com/bid/83184","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00056.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory"]},{"url":"http://www.postgresql.org/docs/current/static/release-9-4-6.html","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory"]},{"url":"http://www.ubuntu.com/usn/USN-2894-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00049.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory"]},{"url":"http://www.postgresql.org/docs/current/static/release-9-1-20.html","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory"]},{"url":"http://www.debian.org/security/2016/dsa-3476","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory"]},{"url":"http://www.debian.org/security/2016/dsa-3475","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-0766"},{"url":"http://www.postgresql.org/about/news/1644"},{"url":"https://github.com/advisories/GHSA-cr7c-24h8-pv37"},{"url":"https://advisories.mageia.org/MGASA-2016-0085.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=17744","tags":["report"]},{"url":"http://www.ubuntu.com/usn/usn-2894-1/","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20160539-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/966435","tags":["report"]},{"url":"https://bugzilla.suse.com/966436","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2007-4772","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-0766","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-0773","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20160555-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/578053","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20160677-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/949669","tags":["report"]},{"url":"https://bugzilla.suse.com/949670","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5288","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5289","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2016-0766","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-2894-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-0766","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-0773","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2007-6600","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2009-4034","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2009-4136","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2010-1169","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2010-1170","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2010-3433","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-0866","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-0867","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-0868","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-2143","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-2655","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-3488","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-3489","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-0255","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1899","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1900","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1901","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0060","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0061","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0062","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0063","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0064","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0065","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0066","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0067","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3165","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3166","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3167","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5423","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5424","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-8161","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-0241","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-0242","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-0243","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-0244","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2193","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-3065","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2016-0766","description":"PostgreSQL before 9.1.20, 9.2.x before 9.2.15, 9.3.x before 9.3.11, 9.4.x before 9.4.6, and 9.5.x before 9.5.1 does not properly restrict access to unspecified custom configuration settings (GUCS) for PL/Java, which allows attackers to gain privileges via unspecified vectors.","status":"published","published":"2016-02-17T15:00:00Z","modified":"2024-08-05T22:30:03.996Z","updated_at":"2026-11-02T14:33:37.12286Z"}],"euvd":[{"id":"EUVD-2016-0783","description":"PostgreSQL before 9.1.20, 9.2.x before 9.2.15, 9.3.x before 9.3.11, 9.4.x before 9.4.6, and 9.5.x before 9.5.1 does not properly restrict access to unspecified custom configuration settings (GUCS) for PL/Java, which allows attackers to gain privileges via unspecified vectors.","status":"published","published":"2016-02-17T15:00:00Z","modified":"2024-08-05T22:30:03Z","updated_at":"2026-11-03T02:23:00.426765Z"}],"ghsa":[{"id":"GHSA-cr7c-24h8-pv37","title":"PostgreSQL before 9.1.20, 9.2.x before 9.2.15, 9.3.x before 9.3.11, 9.4.x before 9.4.6, and 9.5.x...","description":"PostgreSQL before 9.1.20, 9.2.x before 9.2.15, 9.3.x before 9.3.11, 9.4.x before 9.4.6, and 9.5.x before 9.5.1 does not properly restrict access to unspecified custom configuration settings (GUCS) for PL/Java, which allows attackers to gain privileges via unspecified vectors.","status":"published","published":"2022-05-17T02:37:55Z","modified":"2025-04-12T12:57:05Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:01:25.795392Z"}],"nvd":[{"id":"CVE-2016-0766","description":"PostgreSQL before 9.1.20, 9.2.x before 9.2.15, 9.3.x before 9.3.11, 9.4.x before 9.4.6, and 9.5.x before 9.5.1 does not properly restrict access to unspecified custom configuration settings (GUCS) for PL/Java, which allows attackers to gain privileges via unspecified vectors.","status":"published","published":"2016-02-17T15:59:01.237Z","modified":"2026-06-17T00:38:11.043Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":9,"vector":"AV:N/AC:L/Au:S/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-264"],"updated_at":"2026-11-02T14:03:22.479119Z"}],"osv":[{"id":"UBUNTU-CVE-2016-0766","description":"PostgreSQL before 9.1.20, 9.2.x before 9.2.15, 9.3.x before 9.3.11, 9.4.x before 9.4.6, and 9.5.x before 9.5.1 does not properly restrict access to unspecified custom configuration settings (GUCS) for PL/Java, which allows attackers to gain privileges via unspecified vectors.","status":"published","published":"2016-02-11T00:00:00Z","modified":"2026-04-22T10:26:29.598703Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"},{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:11.100633Z"},{"id":"DSA-3475-1","title":"postgresql-9.1 - security update","status":"published","published":"2016-02-13T00:00:00Z","modified":"2026-03-09T01:21:04.98877Z","updated_at":"2026-11-02T15:46:16.199525Z"},{"id":"DSA-3476-1","title":"postgresql-9.4 - security update","status":"published","published":"2016-02-13T00:00:00Z","modified":"2026-03-09T01:19:32.443924Z","updated_at":"2026-11-02T15:46:16.199525Z"},{"id":"MGASA-2016-0085","title":"Updated postgresql packages fix security vulnerabilities","description":"Updated postgresql packages fix security vulnerabilities:\n\nPostgreSQL 9.3.x before 9.3.11 and 9.4.x before 9.4.6 does not properly\nrestrict access to unspecified custom configuration settings (GUCS) for\nPL/Java, which allows attackers to gain privileges via unspecified vectors\n(CVE-2016-0766).\n\nPostgreSQL 9.3.x before 9.3.11 and 9.4.x before 9.4.6 allows remote attackers\nto cause a denial of service (infinite loop or buffer overflow and crash) via\na large Unicode character range in a regular expression (CVE-2016-0773).\n","status":"published","published":"2016-03-02T18:28:46Z","modified":"2026-04-16T06:26:25.955217383Z","updated_at":"2026-11-02T15:49:39.792687Z"},{"id":"openSUSE-SU-2024:10030-1","title":"postgresql94-9.4.10-1.1 on GA media","description":"These are all security issues fixed in the postgresql94-9.4.10-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:28:08.668099Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"openSUSE-SU-2024:10256-1","title":"postgresql93-9.3.15-1.1 on GA media","description":"These are all security issues fixed in the postgresql93-9.3.15-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2025-05-07T18:08:24.407905Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"openSUSE-SU-2024:10273-1","title":"libecpg6-32bit-9.5.4-1.2 on GA media","description":"These are all security issues fixed in the libecpg6-32bit-9.5.4-1.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:33:24.576512Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"SUSE-SU-2016:0539-1","title":"Security update for postgresql93","description":"\nThis update for postgresql93 fixes the following issues: \n\n- Security and bugfix release 9.3.11:\n  * Fix infinite loops and buffer-overrun problems in regular\n    expressions (CVE-2016-0773, bsc#966436).\n  * Fix regular-expression compiler to handle loops of constraint\n    arcs (CVE-2007-4772).\n  * Prevent certain PL/Java parameters from being set by\n    non-superusers (CVE-2016-0766, bsc#966435).\n  * Fix many issues in pg_dump with specific object types\n  * Prevent over-eager pushdown of HAVING clauses for\n    GROUPING SETS\n  * Fix deparsing error with ON CONFLICT ... WHERE clauses\n  * Fix tableoid errors for postgres_fdw\n  * Prevent floating-point exceptions in pgbench\n  * Make \\det search Foreign Table names consistently\n  * Fix quoting of domain constraint names in pg_dump\n  * Prevent putting expanded objects into Const nodes\n  * Allow compile of PL/Java on Windows\n  * Fix 'unresolved symbol' errors in PL/Python execution\n  * Allow Python2 and Python3 to be used in the same database\n  * Add support for Python 3.5 in PL/Python\n  * Fix issue with subdirectory creation during initdb\n  * Make pg_ctl report status correctly on Windows\n  * Suppress confusing error when using pg_receivexlog with older\n    servers\n  * Multiple documentation corrections and additions\n  * Fix erroneous hash calculations in gin_extract_jsonb_path()\n- For the full release notse, see:\n  http://www.postgresql.org/docs/9.3/static/release-9-3-11.html\n","status":"published","published":"2016-02-22T10:07:15Z","modified":"2026-02-04T04:31:17.017906Z","updated_at":"2026-11-02T15:53:43.030986Z"},{"id":"SUSE-SU-2016:0555-1","title":"Security update for postgresql94","description":"\nThis update for postgresql94 fixes the following issues: \n\n- Security and bugfix release 9.4.6:\n  * *** IMPORTANT ***\n    Users of version 9.4 will need to reindex any jsonb_path_ops\n    indexes they have created, in order to fix a persistent issue\n    with missing index entries.\n  * Fix infinite loops and buffer-overrun problems in regular\n    expressions (CVE-2016-0773, bsc#966436).\n  * Fix regular-expression compiler to handle loops of constraint\n    arcs (CVE-2007-4772).\n  * Prevent certain PL/Java parameters from being set by\n    non-superusers (CVE-2016-0766, bsc#966435).\n  * Fix many issues in pg_dump with specific object types\n  * Prevent over-eager pushdown of HAVING clauses for\n    GROUPING SETS\n  * Fix deparsing error with ON CONFLICT ... WHERE clauses\n  * Fix tableoid errors for postgres_fdw\n  * Prevent floating-point exceptions in pgbench\n  * Make \\det search Foreign Table names consistently\n  * Fix quoting of domain constraint names in pg_dump\n  * Prevent putting expanded objects into Const nodes\n  * Allow compile of PL/Java on Windows\n  * Fix 'unresolved symbol' errors in PL/Python execution\n  * Allow Python2 and Python3 to be used in the same database\n  * Add support for Python 3.5 in PL/Python\n  * Fix issue with subdirectory creation during initdb\n  * Make pg_ctl report status correctly on Windows\n  * Suppress confusing error when using pg_receivexlog with older\n    servers\n  * Multiple documentation corrections and additions\n  * Fix erroneous hash calculations in gin_extract_jsonb_path()\n- For the full release notse, see:\n  http://www.postgresql.org/docs/9.4/static/release-9-4-6.html\n\n- PL/Perl still needs to be linked with rpath, so that it can find\n  libperl.so at runtime.\n  bsc#578053, postgresql-plperl-keep-rpath.patch\n","status":"published","published":"2016-02-24T09:01:11Z","modified":"2026-02-04T03:58:47.711973Z","updated_at":"2026-11-02T15:53:43.030986Z"},{"id":"SUSE-SU-2016:0677-1","title":"Security update for postgresql94","description":"\nThis update for postgresql94 fixes the following issues: \n\n- Security and bugfix release 9.4.6:\n  * *** IMPORTANT ***\n    Users of version 9.4 will need to reindex any jsonb_path_ops\n    indexes they have created, in order to fix a persistent issue\n    with missing index entries.\n  * Fix infinite loops and buffer-overrun problems in regular\n    expressions (CVE-2016-0773, bsc#966436).\n  * Fix regular-expression compiler to handle loops of constraint\n    arcs (CVE-2007-4772).\n  * Prevent certain PL/Java parameters from being set by\n    non-superusers (CVE-2016-0766, bsc#966435).\n  * Fix many issues in pg_dump with specific object types\n  * Prevent over-eager pushdown of HAVING clauses for\n    GROUPING SETS\n  * Fix deparsing error with ON CONFLICT ... WHERE clauses\n  * Fix tableoid errors for postgres_fdw\n  * Prevent floating-point exceptions in pgbench\n  * Make \\det search Foreign Table names consistently\n  * Fix quoting of domain constraint names in pg_dump\n  * Prevent putting expanded objects into Const nodes\n  * Allow compile of PL/Java on Windows\n  * Fix 'unresolved symbol' errors in PL/Python execution\n  * Allow Python2 and Python3 to be used in the same database\n  * Add support for Python 3.5 in PL/Python\n  * Fix issue with subdirectory creation during initdb\n  * Make pg_ctl report status correctly on Windows\n  * Suppress confusing error when using pg_receivexlog with older\n    servers\n  * Multiple documentation corrections and additions\n  * Fix erroneous hash calculations in gin_extract_jsonb_path()\n- For the full release notse, see:\n  http://www.postgresql.org/docs/9.4/static/release-9-4-6.html\n\n- Security and bugfix release 9.4.5:\n  * CVE-2015-5289, bsc#949670: json or jsonb input values\n    constructed from arbitrary user input can crash the PostgreSQL\n    server and cause a denial of service.\n  * CVE-2015-5288, bsc#949669: The crypt() function included with\n    the optional pgCrypto extension could be exploited to read a\n    few additional bytes of memory. No working exploit for this\n    issue has been developed.\n- For the full release notse, see:\n  http://www.postgresql.org/docs/current/static/release-9-4-5.html\n- Relax dependency on libpq to major version.\n","status":"published","published":"2016-03-07T14:09:05Z","modified":"2026-02-04T04:15:17.431876Z","updated_at":"2026-11-02T15:53:43.030986Z"},{"id":"USN-2894-1","title":"postgresql-9.1, postgresql-9.3, postgresql-9.4 vulnerabilities","description":"It was discovered that PostgreSQL incorrectly handled certain regular\nexpressions. A remote attacker could possibly use this issue to cause\nPostgreSQL to crash, resulting in a denial of service. (CVE-2016-0773)\n\nIt was discovered that PostgreSQL incorrectly handled certain configuration\nsettings (GUCS) for users of PL/Java. A remote attacker could possibly use\nthis issue to escalate privileges. (CVE-2016-0766)\n","status":"published","published":"2016-02-11T17:51:42Z","modified":"2026-04-22T09:21:02.789027Z","updated_at":"2026-11-02T16:58:10.303275Z"}]}}