{"id":"CVE-2018-10925","aliases":["ALPINE-CVE-2018-10925","BELL-CVE-2018-10925","DSA-4269-1","EUVD-2018-2979","GHSA-mr45-mwhc-fw72","MGASA-2018-0446","RHSA-2018:2511","RHSA-2018:2565","RHSA-2018:2566","RHSA-2018:3816","SUSE-SU-2018:2564-1","SUSE-SU-2018:3377-1","UBUNTU-CVE-2018-10925","USN-3744-1","openSUSE-SU-2020:1227-1","openSUSE-SU-2024:11184-1","openSUSE-SU-2024:11185-1"],"status":"published","title":"It was discovered that PostgreSQL versions before 10.5, 9.6.10, 9.5.14, 9.4.19, and 9.3.24 failed...","description":"It was discovered that PostgreSQL versions before 10.5, 9.6.10, 9.5.14, 9.4.19, and 9.3.24 failed to properly check authorization on certain statements involved with \"INSERT ... ON CONFLICT DO UPDATE\". An attacker with \"CREATE TABLE\" privileges could exploit this to read arbitrary bytes server memory. If the attacker also had certain \"INSERT\" and limited \"UPDATE\" privileges to a particular table, they could exploit this to update other columns in the same table.","severity":{"version":"3.0","score":7.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-08","score":0.02241,"percentile":0.82959,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-863"],"published":"2018-08-09T00:00:00Z","modified":"2026-10-23T17:17:55Z","fixes":[{"ecosystem":"Alpine:v3.10","package":"postgresql","fixed_in":["10.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.11","package":"postgresql","fixed_in":["10.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"postgresql","fixed_in":["10.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"postgresql","fixed_in":["10.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"postgresql","fixed_in":["10.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.5","package":"postgresql","fixed_in":["9.6.10-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.6","package":"postgresql","fixed_in":["9.6.10-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.7","package":"postgresql","fixed_in":["10.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.8","package":"postgresql","fixed_in":["10.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.9","package":"postgresql","fixed_in":["10.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"postgresql14","fixed_in":["10.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"postgresql14","fixed_in":["10.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"postgresql14","fixed_in":["10.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"postgresql14","fixed_in":["10.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"postgresql15","fixed_in":["10.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"postgresql15","fixed_in":["10.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"postgresql15","fixed_in":["10.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"postgresql15","fixed_in":["10.5-r0"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"postgresql-9.5","fixed_in":["9.5.14-0ubuntu0.16.04"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"postgresql-10","fixed_in":["10.5-0ubuntu0.18.04"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.10","package":"postgresql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.5.0"},{"fixed":"10.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"postgresql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.5.0"},{"fixed":"10.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"postgresql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.5.0"},{"fixed":"10.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"postgresql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.5.0"},{"fixed":"10.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"postgresql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.5.0"},{"fixed":"10.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.5","package":"postgresql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.5.0"},{"fixed":"9.6.10-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.6","package":"postgresql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.5.0"},{"fixed":"9.6.10-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.7","package":"postgresql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.5.0"},{"fixed":"10.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.8","package":"postgresql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.5.0"},{"fixed":"10.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.9","package":"postgresql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.5.0"},{"fixed":"10.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"postgresql14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"postgresql14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"postgresql14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"postgresql14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"postgresql15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"postgresql15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"postgresql15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"postgresql15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.5-r0"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"postgresql-9.6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.6.10-0+deb9u1"}]}],"versions":["9.6.3-3","9.6.3-4","9.6.4-0+deb9u1","9.6.4-1","9.6.5-0+deb9u1","9.6.5-0+deb9u1~bpo8+1","9.6.5-1","9.6.6-0+deb9u1","9.6.6-0+deb9u1~bpo8+1","9.6.7-0+deb9u1","9.6.8-0+deb9u1","9.6.9-0+deb9u1"],"bundled":2},{"source":"osv","ecosystem":"Mageia:6","package":"postgresql9.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.19-1.mga6"}]}],"bundled":4},{"source":"osv","ecosystem":"Mageia:6","package":"postgresql9.6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.6.10-3.mga6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"rh-postgresql95-postgresql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.5.14-1.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"rh-postgresql95-postgresql-contrib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.5.14-1.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"rh-postgresql95-postgresql-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.5.14-1.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"rh-postgresql95-postgresql-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.5.14-1.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"rh-postgresql95-postgresql-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.5.14-1.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"rh-postgresql95-postgresql-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.5.14-1.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"rh-postgresql95-postgresql-plperl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.5.14-1.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"rh-postgresql95-postgresql-plpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.5.14-1.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"rh-postgresql95-postgresql-pltcl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.5.14-1.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"rh-postgresql95-postgresql-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.5.14-1.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"rh-postgresql95-postgresql-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.5.14-1.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"rh-postgresql95-postgresql-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.5.14-1.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-postgresql95-postgresql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.5.14-1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-postgresql95-postgresql-contrib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.5.14-1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-postgresql95-postgresql-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.5.14-1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-postgresql95-postgresql-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.5.14-1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-postgresql95-postgresql-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.5.14-1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-postgresql95-postgresql-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.5.14-1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-postgresql95-postgresql-plperl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.5.14-1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-postgresql95-postgresql-plpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.5.14-1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-postgresql95-postgresql-pltcl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.5.14-1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-postgresql95-postgresql-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.5.14-1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-postgresql95-postgresql-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.5.14-1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-postgresql95-postgresql-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.5.14-1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-postgresql10-postgresql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.5-1.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-postgresql10-postgresql-contrib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.5-1.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-postgresql10-postgresql-contrib-syspaths","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.5-1.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-postgresql10-postgresql-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.5-1.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-postgresql10-postgresql-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.5-1.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-postgresql10-postgresql-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.5-1.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-postgresql10-postgresql-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.5-1.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-postgresql10-postgresql-plperl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.5-1.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-postgresql10-postgresql-plpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.5-1.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-postgresql10-postgresql-pltcl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.5-1.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-postgresql10-postgresql-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.5-1.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-postgresql10-postgresql-server-syspaths","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.5-1.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-postgresql10-postgresql-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.5-1.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-postgresql10-postgresql-syspaths","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.5-1.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-postgresql10-postgresql-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.5-1.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"rh-postgresql96-postgresql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.6.10-1.el6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"rh-postgresql96-postgresql-contrib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.6.10-1.el6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"rh-postgresql96-postgresql-contrib-syspaths","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.6.10-1.el6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"rh-postgresql96-postgresql-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.6.10-1.el6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"rh-postgresql96-postgresql-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.6.10-1.el6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"rh-postgresql96-postgresql-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.6.10-1.el6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"rh-postgresql96-postgresql-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.6.10-1.el6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"rh-postgresql96-postgresql-plperl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.6.10-1.el6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"rh-postgresql96-postgresql-plpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.6.10-1.el6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"rh-postgresql96-postgresql-pltcl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.6.10-1.el6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"rh-postgresql96-postgresql-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.6.10-1.el6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"rh-postgresql96-postgresql-server-syspaths","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.6.10-1.el6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"rh-postgresql96-postgresql-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.6.10-1.el6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"rh-postgresql96-postgresql-syspaths","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.6.10-1.el6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"rh-postgresql96-postgresql-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.6.10-1.el6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-postgresql96-postgresql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.6.10-1.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-postgresql96-postgresql-contrib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.6.10-1.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-postgresql96-postgresql-contrib-syspaths","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.6.10-1.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-postgresql96-postgresql-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.6.10-1.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-postgresql96-postgresql-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.6.10-1.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-postgresql96-postgresql-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.6.10-1.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-postgresql96-postgresql-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.6.10-1.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-postgresql96-postgresql-plperl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.6.10-1.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-postgresql96-postgresql-plpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.6.10-1.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-postgresql96-postgresql-pltcl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.6.10-1.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-postgresql96-postgresql-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.6.10-1.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-postgresql96-postgresql-server-syspaths","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.6.10-1.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-postgresql96-postgresql-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.6.10-1.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-postgresql96-postgresql-syspaths","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.6.10-1.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-postgresql96-postgresql-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.6.10-1.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5.9::el7","package":"cfme","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.9.6.5-3.el7cf"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5.9::el7","package":"cfme-amazon-smartstate","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.9.6.5-2.el7cf"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5.9::el7","package":"cfme-appliance","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.9.6.5-1.el7cf"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5.9::el7","package":"cfme-appliance-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.9.6.5-1.el7cf"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5.9::el7","package":"cfme-appliance-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.9.6.5-1.el7cf"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5.9::el7","package":"cfme-appliance-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.9.6.5-1.el7cf"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5.9::el7","package":"cfme-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.9.6.5-3.el7cf"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5.9::el7","package":"cfme-gemset","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.9.6.5-2.el7cf"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5.9::el7","package":"cfme-gemset-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.9.6.5-2.el7cf"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5.9::el7","package":"dbus-api-service","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.1-3.1.el7cf"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5.9::el7","package":"httpd-configmap-generator","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.2.2-1.2.el7cf"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5.9::el7","package":"postgresql96","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.6.10-1PGDG.el7at"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5.9::el7","package":"postgresql96-contrib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.6.10-1PGDG.el7at"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5.9::el7","package":"postgresql96-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.6.10-1PGDG.el7at"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5.9::el7","package":"postgresql96-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.6.10-1PGDG.el7at"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5.9::el7","package":"postgresql96-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.6.10-1PGDG.el7at"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5.9::el7","package":"postgresql96-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.6.10-1PGDG.el7at"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5.9::el7","package":"postgresql96-plperl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.6.10-1PGDG.el7at"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5.9::el7","package":"postgresql96-plpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.6.10-1PGDG.el7at"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5.9::el7","package":"postgresql96-pltcl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.6.10-1PGDG.el7at"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5.9::el7","package":"postgresql96-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.6.10-1PGDG.el7at"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5.9::el7","package":"postgresql96-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.6.10-1PGDG.el7at"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15","package":"postgresql10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.5-4.5.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15","package":"postgresql10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.5-4.5.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"postgresql96","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.6.10-3.22.7"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"postgresql96-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.6.10-3.22.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"postgresql96","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.6.10-3.22.7"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"postgresql96-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.6.10-3.22.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"postgresql96","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.6.10-3.22.7"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"postgresql96-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.6.10-3.22.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"postgresql96","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.6.10-3.22.7"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"postgresql96-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.6.10-3.22.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP3","package":"postgresql96-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.6.10-3.22.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12-LTSS","package":"postgresql96","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.6.10-3.22.7"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12-LTSS","package":"postgresql96-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.6.10-3.22.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1-LTSS","package":"postgresql96","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.6.10-3.22.7"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1-LTSS","package":"postgresql96-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.6.10-3.22.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-LTSS","package":"postgresql96","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.6.10-3.22.7"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-LTSS","package":"postgresql96-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.6.10-3.22.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"postgresql96","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.6.10-3.22.7"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"postgresql96-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.6.10-3.22.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"postgresql96","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.6.10-3.22.7"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"postgresql96-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.6.10-3.22.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 4","package":"postgresql96","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.6.10-3.22.7"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 4","package":"postgresql96-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.6.10-3.22.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"postgresql-9.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.14-0ubuntu0.16.04"}]}],"versions":["9.5.0-1","9.5.0-2","9.5.0-3","9.5.1-1","9.5.2-1","9.5.3-0ubuntu0.16.04","9.5.4-0ubuntu0.16.04","9.5.5-0ubuntu0.16.04","9.5.6-0ubuntu0.16.04","9.5.7-0ubuntu0.16.04","9.5.8-0ubuntu0.16.04.1","9.5.9-0ubuntu0.16.04","9.5.10-0ubuntu0.16.04","9.5.11-0ubuntu0.16.04","9.5.12-0ubuntu0.16.04","9.5.13-0ubuntu0.16.04"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"postgresql-10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.5-0ubuntu0.18.04"}]}],"versions":["10.1-1","10.1-2","10.2-1","10.3-1","10.4-0ubuntu0.18.04"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"postgresql-9.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.3.24-0ubuntu0.14.04"}]}],"versions":["9.3.1-1","9.3.2-1","9.3.2-1ubuntu1","9.3.2-1ubuntu2","9.3.3-1","9.3.3-1bzr1","9.3.3-1bzr2","9.3.4-1","9.3.5-0ubuntu0.14.04.1","9.3.6-0ubuntu0.14.04","9.3.7-0ubuntu0.14.04","9.3.8-0ubuntu0.4.04","9.3.9-0ubuntu0.14.04","9.3.10-0ubuntu0.14.04","9.3.11-0ubuntu0.14.04","9.3.12-0ubuntu0.14.04","9.3.13-0ubuntu0.14.04","9.3.14-0ubuntu0.14.04","9.3.15-0ubuntu0.14.04","9.3.16-0ubuntu0.14.04","9.3.17-0ubuntu0.14.04","9.3.18-0ubuntu0.14.04.1","9.3.19-0ubuntu0.14.04","9.3.20-0ubuntu0.14.04","9.3.21-0ubuntu0.14.04","9.3.22-0ubuntu0.14.04","9.3.23-0ubuntu0.14.04"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"postgresql-9.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.14-0ubuntu0.16.04"}]}],"versions":["9.5.0-1","9.5.0-2","9.5.0-3","9.5.1-1","9.5.2-1","9.5.3-0ubuntu0.16.04","9.5.4-0ubuntu0.16.04","9.5.5-0ubuntu0.16.04","9.5.6-0ubuntu0.16.04","9.5.7-0ubuntu0.16.04","9.5.8-0ubuntu0.16.04.1","9.5.9-0ubuntu0.16.04","9.5.10-0ubuntu0.16.04","9.5.11-0ubuntu0.16.04","9.5.12-0ubuntu0.16.04","9.5.13-0ubuntu0.16.04"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"postgresql-10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.5-0ubuntu0.18.04"}]}],"versions":["10.1-1","10.1-2","10.2-1","10.3-1","10.4-0ubuntu0.18.04"],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"postgresql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.0.1-lp151.6.9.1"}]}],"bundled":7},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"postgresql10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.13-lp151.2.14.1"}]}],"bundled":7},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"postgresql12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.3-lp151.2.1"}]}],"bundled":7},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"postgresql96","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.6.19-lp151.3.3.1"}]}],"bundled":7},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"postgresql10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.18-1.3"}]}],"bundled":20},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"postgresql11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.13-1.3"}]}],"bundled":18}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"debian","product":"debian_linux"},{"vendor":"postgresql","product":"postgresql"},{"vendor":"postgresql global development group","product":"postgresql"}],"references":[{"url":"https://security.gentoo.org/glsa/201810-08","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory"]},{"url":"https://www.debian.org/security/2018/dsa-4269","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory","web"]},{"url":"http://www.securityfocus.com/bid/105052","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2018:2511","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory"]},{"url":"https://usn.ubuntu.com/3744-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10925","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Patch","Third Party Advisory","fix"]},{"url":"https://access.redhat.com/errata/RHSA-2018:2566","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2018:2565","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2018:3816","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory"]},{"url":"https://www.postgresql.org/about/news/1878/","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web","article","report"]},{"url":"http://www.securitytracker.com/id/1041446","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00043.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-10925","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-mr45-mwhc-fw72"},{"url":"https://security.alpinelinux.org/vuln/CVE-2018-10925","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2018-10925","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2018-0446.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=22687","tags":["report"]},{"url":"https://www.postgresql.org/docs/9.4/static/release-9-4-17.html","tags":["web"]},{"url":"https://www.postgresql.org/docs/9.4/static/release-9-4-18.html","tags":["web"]},{"url":"https://www.postgresql.org/docs/9.4/static/release-9-4-19.html","tags":["web"]},{"url":"https://www.postgresql.org/docs/9.6/static/release-9-6-8.html","tags":["web"]},{"url":"https://www.postgresql.org/docs/9.6/static/release-9-6-9.html","tags":["web"]},{"url":"https://www.postgresql.org/docs/9.6/static/release-9-6-10.html","tags":["web"]},{"url":"https://www.postgresql.org/about/news/1834/","tags":["web","article"]},{"url":"https://www.postgresql.org/about/news/1851/","tags":["web"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1508820","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1508823","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1539619","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1547044","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1609891","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1612619","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_2511.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-15098","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-15098","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-15098","tags":["advisory"]},{"url":"https://www.postgresql.org/about/news/1801/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-15099","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-15099","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-15099","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-1053","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-1053","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-1053","tags":["advisory"]},{"url":"https://www.postgresql.org/about/news/1829/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-1058","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-1058","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-1058","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-10915","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-10915","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-10915","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-10925","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-10925","tags":["advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1573276","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_2565.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-1115","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-1115","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-1115","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_2566.json","tags":["advisory"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_cloudforms/4.6/html/release_notes","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1610547","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1618836","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1623562","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1634809","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1635034","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1635255","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1635759","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1635788","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1638501","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1639351","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1639353","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1639364","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1640194","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1640258","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1640629","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1640631","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1641771","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1643042","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1643261","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1643263","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1643539","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1643959","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1644410","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1645198","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1645204","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1646435","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1646561","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1646564","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1646571","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1646599","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1646604","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1646605","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1646606","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1646613","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1646629","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1646646","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1647056","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1647108","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1647188","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1647489","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1648674","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1648948","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1648955","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1648991","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1649033","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1649380","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1649419","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1650691","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1651291","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1651347","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1651391","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1653417","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1653710","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1654436","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1654463","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1655081","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1655143","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1655773","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1656168","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1656169","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_3816.json","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20182564-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1091610","tags":["report"]},{"url":"https://bugzilla.suse.com/1104199","tags":["report"]},{"url":"https://bugzilla.suse.com/1104202","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-10915","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-10925","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1115","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20183377-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2018-10925","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3744-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2018-10915","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/RPLLEO7T4JPO4J5JMG2O4ZTONMNDEL64/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1134689","tags":["report"]},{"url":"https://bugzilla.suse.com/1145092","tags":["report"]},{"url":"https://bugzilla.suse.com/1148643","tags":["report"]},{"url":"https://bugzilla.suse.com/1163985","tags":["report"]},{"url":"https://bugzilla.suse.com/1171924","tags":["report"]},{"url":"https://bugzilla.suse.com/1175194","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-10130","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-10208","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-14350","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-1720","tags":["web"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2017-15098","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-15099","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1052","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1053","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1058","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16850","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-10164","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-14349","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-25694","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-25695","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-25696","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-32027","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-32028","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-10129","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-10209","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-32029","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3393","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3677","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2018-10925","description":"It was discovered that PostgreSQL versions before 10.5, 9.6.10, 9.5.14, 9.4.19, and 9.3.24 failed to properly check authorization on certain statements involved with \"INSERT ... ON CONFLICT DO UPDATE\". An attacker with \"CREATE TABLE\" privileges could exploit this to read arbitrary bytes server memory. If the attacker also had certain \"INSERT\" and limited \"UPDATE\" privileges to a particular table, they could exploit this to update other columns in the same table.","status":"published","published":"2018-08-09T21:00:00Z","modified":"2024-08-05T07:54:36.061Z","cvss":[{"version":"3.0","score":7.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:35:01.952568Z"}],"euvd":[{"id":"EUVD-2018-2979","description":"It was discovered that PostgreSQL versions before 10.5, 9.6.10, 9.5.14, 9.4.19, and 9.3.24 failed to properly check authorization on certain statements involved with \"INSERT ... ON CONFLICT DO UPDATE\". An attacker with \"CREATE TABLE\" privileges could exploit this to read arbitrary bytes server memory. If the attacker also had certain \"INSERT\" and limited \"UPDATE\" privileges to a particular table, they could exploit this to update other columns in the same table.","status":"published","published":"2018-08-09T21:00:00Z","modified":"2024-08-05T07:54:36Z","cvss":[{"version":"3.0","score":7.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","level":"high"}],"updated_at":"2026-11-03T02:39:57.009215Z"}],"ghsa":[{"id":"GHSA-mr45-mwhc-fw72","title":"It was discovered that PostgreSQL versions before 10.5, 9.6.10, 9.5.14, 9.4.19, and 9.3.24 failed...","description":"It was discovered that PostgreSQL versions before 10.5, 9.6.10, 9.5.14, 9.4.19, and 9.3.24 failed to properly check authorization on certain statements involved with \"INSERT ... ON CONFLICT DO UPDATE\". An attacker with \"CREATE TABLE\" privileges could exploit this to read arbitrary bytes server memory. If the attacker also had certain \"INSERT\" and limited \"UPDATE\" privileges to a particular table, they could exploit this to update other columns in the same table.","status":"published","published":"2022-05-13T01:23:19Z","modified":"2023-02-01T05:07:08Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:50:29.480738Z"}],"nvd":[{"id":"CVE-2018-10925","description":"It was discovered that PostgreSQL versions before 10.5, 9.6.10, 9.5.14, 9.4.19, and 9.3.24 failed to properly check authorization on certain statements involved with \"INSERT ... ON CONFLICT DO UPDATE\". An attacker with \"CREATE TABLE\" privileges could exploit this to read arbitrary bytes server memory. If the attacker also had certain \"INSERT\" and limited \"UPDATE\" privileges to a particular table, they could exploit this to update other columns in the same table.","status":"published","published":"2018-08-09T21:29:00.227Z","modified":"2026-06-17T01:34:56.17Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"primary"},{"version":"3.0","score":7.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","level":"high","assessor":"secondary"},{"version":"2.0","score":5.5,"vector":"AV:N/AC:L/Au:S/C:P/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:04:35.310988Z"}],"osv":[{"id":"ALPINE-CVE-2018-10925","description":"It was discovered that PostgreSQL versions before 10.5, 9.6.10, 9.5.14, 9.4.19, and 9.3.24 failed to properly check authorization on certain statements involved with \"INSERT ... ON CONFLICT DO UPDATE\". An attacker with \"CREATE TABLE\" privileges could exploit this to read arbitrary bytes server memory. If the attacker also had certain \"INSERT\" and limited \"UPDATE\" privileges to a particular table, they could exploit this to update other columns in the same table.","status":"published","published":"2018-08-09T21:29:00.227Z","modified":"2026-10-23T17:17:55.202272288Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:27:47.187336Z"},{"id":"BELL-CVE-2018-10925","title":"CVE-2018-10925 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:14:52.677958Z","modified":"2026-01-26T09:49:40.29626Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:28:14.701973Z"},{"id":"CVE-2018-10925","description":"It was discovered that PostgreSQL versions before 10.5, 9.6.10, 9.5.14, 9.4.19, and 9.3.24 failed to properly check authorization on certain statements involved with \"INSERT ... ON CONFLICT DO UPDATE\". An attacker with \"CREATE TABLE\" privileges could exploit this to read arbitrary bytes server memory. If the attacker also had certain \"INSERT\" and limited \"UPDATE\" privileges to a particular table, they could exploit this to update other columns in the same table.","status":"published","published":"2018-08-09T21:29:00.227Z","modified":"2026-04-16T06:21:23.930448139Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:07.641418Z"},{"id":"RHSA-2018:2511","title":"Red Hat Security Advisory: rh-postgresql95-postgresql security update","status":"published","published":"2024-09-13T16:52:18Z","modified":"2026-08-05T10:05:33Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:05.383061Z"},{"id":"RHSA-2018:2565","title":"Red Hat Security Advisory: rh-postgresql10-postgresql security update","status":"published","published":"2024-09-13T16:52:31Z","modified":"2026-08-05T10:05:36Z","cvss":[{"version":"3.0","score":8.5,"vector":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:05.383061Z"},{"id":"RHSA-2018:2566","title":"Red Hat Security Advisory: rh-postgresql96-postgresql security update","status":"published","published":"2024-09-13T16:52:24Z","modified":"2026-08-05T10:05:37Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:05.383061Z"},{"id":"RHSA-2018:3816","title":"Red Hat Security Advisory: CloudForms 4.6.6 security, bug fix and enhancement update","status":"published","published":"2024-09-13T16:54:07Z","modified":"2026-08-05T10:05:51Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:05.383061Z"},{"id":"UBUNTU-CVE-2018-10925","description":"It was discovered that PostgreSQL versions before 10.5, 9.6.10, 9.5.14, 9.4.19, and 9.3.24 failed to properly check authorization on certain statements involved with \"INSERT ... ON CONFLICT DO UPDATE\". An attacker with \"CREATE TABLE\" privileges could exploit this to read arbitrary bytes server memory. If the attacker also had certain \"INSERT\" and limited \"UPDATE\" privileges to a particular table, they could exploit this to update other columns in the same table.","status":"published","published":"2018-08-09T00:00:00Z","modified":"2026-04-22T11:41:20.664355Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"},{"version":"3.0","score":7.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","level":"high"},{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:54:16.544091Z"},{"id":"DSA-4269-1","title":"postgresql-9.6 - security update","status":"published","published":"2018-08-10T00:00:00Z","modified":"2026-03-09T02:09:45.667519Z","updated_at":"2026-11-02T15:46:16.862196Z"},{"id":"MGASA-2018-0446","title":"Updated postgresql9.4|6 packages fix security vulnerabilities","description":"A flaw was found in the way Postgresql allowed a user to modify the\nbehavior of a query for other users. An attacker with a user account\ncould use this flaw to execute code with the permissions of superuser in\nthe database (CVE-2018-1058).\n\nPostgresql 9.6.x before 9.6.9 is vulnerable in the adminpack extension,\nthe pg_catalog.pg_logfile_rotate() function doesn't follow the same ACLs\nthan pg_rorate_logfile. If the adminpack is added to a database, an\nattacker able to connect to it could exploit this to force log rotation\n(CVE-2018-1115).\n\nAndrew Krasichkov discovered that libpq did not reset all its connection\nstate during reconnects (CVE-2018-10915).\n\nIt was discovered that some \"CREATE TABLE\" statements could disclose\nserver memory (CVE-2018-10925).\n\nFully fixing these security issues requires manual intervention.  See\nthe upstream advisories for details.\n","status":"published","published":"2018-11-15T22:04:32Z","modified":"2026-04-16T06:25:43.242988846Z","updated_at":"2026-11-02T15:49:40.793816Z"},{"id":"openSUSE-SU-2020:1227-1","title":"Security update for postgresql96, postgresql10 and postgresql12 ","description":"This update for postgresql96, postgresql10 and postgresql12 fixes the following issues:\n\npostgresql10 was updated to 10.13 (bsc#1171924).\n\n  https://www.postgresql.org/about/news/2038/\n  https://www.postgresql.org/docs/10/release-10-13.html\n\npostgresql10 was updated to 10.12 (CVE-2020-1720, bsc#1163985)\n\n- https://www.postgresql.org/about/news/2011/\n- https://www.postgresql.org/docs/10/release-10-12.html\n\npostgresql10 was updated to 10.11:\n\n- https://www.postgresql.org/about/news/1994/\n- https://www.postgresql.org/docs/10/release-10-11.html\n\n\npostgresql12 was updated to 12.3 (bsc#1171924).\n\nBug Fixes and Improvements:\n\n- Several fixes for GENERATED columns, including an issue where it was possible to crash or corrupt data in a table when the output of the generated column was the exact copy of a physical column on the table, e.g. if the expression called a function which could return its own input.\n- Several fixes for ALTER TABLE, including ensuring the SET STORAGE directive is propagated to a table's indexes.\n- Fix a potential race condition when using DROP OWNED BY while another session is deleting the same objects.\n- Allow for a partition to be detached when it has inherited ROW triggers.\n- Several fixes for REINDEX CONCURRENTLY, particularly with issues when a REINDEX CONCURRENTLY operation fails.\n- Fix crash when COLLATE is applied to an uncollatable type in a partition bound expression.\n- Fix performance regression in floating point overflow/underflow detection.\n- Several fixes for full text search, particularly with phrase searching.\n- Fix query-lifespan memory leak for a set-returning function used in a query's FROM clause.\n- Several reporting fixes for the output of VACUUM VERBOSE.\n- Allow input of type circle to accept the format (x,y),r, which is specified in the documentation.\n- Allow for the get_bit() and set_bit() functions to not fail on bytea strings longer than 256MB.\n- Avoid premature recycling of WAL segments during crash recovery, which could lead to WAL segments being recycled before being archived.\n- Avoid attempting to fetch nonexistent WAL files from archive storage during recovery by skipping irrelevant timelines.\n- Several fixes for logical replication and replication slots.\n- Fix several race conditions in synchronous standby management, including one that occurred when changing the synchronous_standby_names setting.\n- Several fixes for GSSAPI support, include a fix for a memory leak that occurred when using GSSAPI encryption.\n- Ensure that members of the pg_read_all_stats role can read all statistics views.\n- Fix performance regression in information_schema.triggers view.\n- Fix memory leak in libpq when using sslmode=verify-full.\n- Fix crash in psql when attempting to re-establish a failed connection.\n- Allow tab-completion of the filename argument to \\gx command in psql.\n- Add pg_dump support for ALTER ... DEPENDS ON EXTENSION.\n- Several other fixes for pg_dump, which include dumping comments on RLS policies and postponing restore of event triggers until the end.\n- Ensure pg_basebackup generates valid tar files.\n- pg_checksums skips tablespace subdirectories that belong to a different PostgreSQL major version\n- Several Windows compatibility fixes\n\nThis update also contains timezone tzdata release 2020a for DST law changes in Morocco and the Canadian Yukon, plus historical corrections for Shanghai. The America/Godthab zone has been renamed to America/Nuuk to reflect current English usage ; however, the old name remains available as a compatibility link. This also updates initdb's list of known Windows time zone names to include recent additions.\n\nFor more details, check out:\n\n-  https://www.postgresql.org/docs/12/release-12-3.html\n\nOther fixes:\n\n- Let postgresqlXX conflict with postgresql-noarch \u003c 12.0.1 to get\n  a clean and complete cutover to the new packaging schema.\n\n\npostgresql96 was updated to 9.6.19:\n\n  * CVE-2020-14350, boo#1175194: Make contrib modules' installation\n    scripts more secure.\n  * https://www.postgresql.org/docs/9.6/release-9-6-19.html\n\n- Pack the /usr/lib/postgresql symlink only into the main package.\n\n- Let postgresqlXX conflict with postgresql-noarch \u003c 12.0.1 to get\n  a clean and complete cutover to the new packaging schema.\n\n- update to 9.6.18 (boo#1171924).\n  https://www.postgresql.org/about/news/2038/\n  https://www.postgresql.org/docs/9.6/release-9-6-18.html\n- Unify the spec file to work across all current PostgreSQL\n  versions to simplify future maintenance.\n- Move from the 'libs' build flavour to a 'mini' package that will\n  only be used inside the build service and not get shipped, to\n  avoid confusion with the debuginfo packages (boo#1148643).\n\n- update to 9.6.17 (CVE-2020-1720, boo#1163985)\n  https://www.postgresql.org/about/news/2011/\n  https://www.postgresql.org/docs/9.6/release-9-6-17.html\n\n- use and package the sha256 checksum for for source\n\n- update to 9.6.16:\n  https://www.postgresql.org/about/news/1994/\n  https://www.postgresql.org/docs/9.6/release-9-6-16.html\n\n- add requires to the devel package for the libs that are returned\n  by pg_config --libs\n\n- Update to 9.6.15:\n  * https://www.postgresql.org/about/news/1960/\n  * https://www.postgresql.org/docs/9.6/release-9-6-15.html\n  * CVE-2019-10208, boo#1145092: TYPE in pg_temp executes arbitrary\n    SQL during SECURITY DEFINER execution.\n\n- Use FAT LTO objects in order to provide proper static library.\n\n- Update to 9.6.14:\n  https://www.postgresql.org/docs/9.6/release-9-6-14.html\n\n- Update to 9.6.13:\n  * https://www.postgresql.org/docs/9.6/release-9-6-13.html\n  * https://www.postgresql.org/about/news/1939/\n  * CVE-2019-10130, boo#1134689: Prevent row-level security\n    policies from being bypassed via selectivity estimators.\n\n- Make the server-devel package exclusive across versions.\n\n- Update to 9.6.12:\n  * https://www.postgresql.org/docs/9.6/release-9-6-12.html\n  * https://www.postgresql.org/about/news/1920/\n  * By default, panic instead of retrying after fsync() failure,\n    to avoid possible data corruption.\n  * Numerous other bug fixes.\n- Overhaul README.SUSE\n\n- Update to 9.6.11:\n  * Numerous bug fixes, see the release notes:\n    https://www.postgresql.org/docs/9.6/release-9-6-11.html\n  * Remove unneeded library dependencies from PGXS.\n\n- add provides for the new server-devel package that will be\n  introduced in postgresql 11\n\n- Update to 9.6.10:\n  https://www.postgresql.org/docs/current/static/release-9-6-10.html\n  * CVE-2018-10915, boo#1104199: Fix failure to reset libpq's state\n    fully between connection attempts.\n  * CVE-2018-10925, boo#1104202: Fix INSERT ... ON CONFLICT UPDATE\n    through a view that isn't just SELECT * FROM ...\n\n- Update to 9.6.9:\n  https://www.postgresql.org/about/news/1851/\n  https://www.postgresql.org/docs/current/static/release-9-6-9.html\n  A dump/restore is not required for those running 9.6.X.\n  However, if you use the adminpack extension, you should update\n  it as per the first changelog entry below.\n  Also, if the function marking mistakes mentioned in the second\n  and third changelog entries below affect you, you will want to\n  take steps to correct your database catalogs.\n  * CVE-2018-1115, boo#1091610: Remove public execute privilege\n    from contrib/adminpack's pg_logfile_rotate() function\n    pg_logfile_rotate() is a deprecated wrapper for the core\n    function pg_rotate_logfile(). When that function was changed\n    to rely on SQL privileges for access control rather than a\n    hard-coded superuser check, pg_logfile_rotate() should have\n    been updated as well, but the need for this was missed. Hence,\n    if adminpack is installed, any user could request a logfile\n    rotation, creating a minor security issue.\n    After installing this update, administrators should update\n    adminpack by performing ALTER EXTENSION adminpack UPDATE in\n    each database in which adminpack is installed.\n  * Fix incorrect volatility markings on a few built-in functions\n  * Fix incorrect parallel-safety markings on a few built-in\n    functions.\n\n\nThis update was imported from the SUSE:SLE-15-SP1:Update update project.","status":"published","published":"2020-08-17T10:30:27Z","modified":"2025-05-07T18:09:57.227337Z","updated_at":"2026-11-02T16:58:31.517538Z"},{"id":"openSUSE-SU-2024:11184-1","title":"postgresql10-10.18-1.3 on GA media","description":"These are all security issues fixed in the postgresql10-10.18-1.3 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:15:59.478865Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"openSUSE-SU-2024:11185-1","title":"postgresql11-11.13-1.3 on GA media","description":"These are all security issues fixed in the postgresql11-11.13-1.3 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:27:47.930292Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"SUSE-SU-2018:2564-1","title":"Security update for postgresql10","description":"This update for postgresql10 fixes the following issues:\n\nPostgreSQL 10 was updated to 10.5:\n\n- https://www.postgresql.org/about/news/1851/\n- https://www.postgresql.org/docs/current/static/release-10-5.html\n\n  A dump/restore is not required for those running 10.X.\n  However, if you use the adminpack extension, you should update\n  it as per the first changelog entry below.\n  Also, if the function marking mistakes mentioned in the second\n  and third changelog entries below affect you, you will want to\n  take steps to correct your database catalogs.\n\nSecurity issues fixed:\n\n- CVE-2018-1115: Remove public execute privilege\n  from contrib/adminpack's pg_logfile_rotate() function\n  pg_logfile_rotate() is a deprecated wrapper for the core\n  function pg_rotate_logfile(). When that function was changed\n  to rely on SQL privileges for access control rather than a\n  hard-coded superuser check, pg_logfile_rotate() should have\n  been updated as well, but the need for this was missed. Hence,\n  if adminpack is installed, any user could request a logfile\n  rotation, creating a minor security issue.\n  After installing this update, administrators should update\n  adminpack by performing ALTER EXTENSION adminpack UPDATE in\n  each database in which adminpack is installed (bsc#1091610).\n- CVE-2018-10915: libpq failed to properly reset its internal state between\n  connections. If an affected version of libpq was used with 'host' or 'hostaddr'\n  connection parameters from untrusted input, attackers could have bypassed\n  client-side connection security features, obtain access to higher privileged\n  connections or potentially cause other impact SQL injection, by causing the\n  PQescape() functions to malfunction (bsc#1104199)\n- CVE-2018-10925: Add missing authorization check on certain statements\n  involved with 'INSERT ... ON CONFLICT DO UPDATE'. An attacker with 'CREATE\n  TABLE' privileges could have exploited this to read arbitrary bytes server\n  memory. If the attacker also had certain 'INSERT' and limited 'UPDATE'\n  privileges to a particular table, they could have exploited this to update\n  other columns in the same table (bsc#1104202).\n","status":"published","published":"2018-08-30T14:11:30Z","modified":"2026-02-04T02:14:31.220801Z","updated_at":"2026-11-02T15:53:45.378228Z"},{"id":"SUSE-SU-2018:3377-1","title":"Security update for postgresql96","description":"This update for postgresql96 to 9.6.10 fixes the following issues:\n\nThese security issues were fixed:\n\n- CVE-2018-10915: libpq failed to properly reset its internal state between\n  connections. If an affected version of libpq was used with 'host' or 'hostaddr'\n  connection parameters from untrusted input, attackers could have bypassed\n  client-side connection security features, obtain access to higher privileged\n  connections or potentially cause other impact SQL injection, by causing the\n  PQescape() functions to malfunction (bsc#1104199)\n- CVE-2018-10925: Add missing authorization check on certain statements\n  involved with 'INSERT ... ON CONFLICT DO UPDATE'. An attacker with 'CREATE\n  TABLE' privileges could have exploited this to read arbitrary bytes server\n  memory. If the attacker also had certain 'INSERT' and limited 'UPDATE'\n  privileges to a particular table, they could have exploited this to update\n  other columns in the same table (bsc#1104202)\n\nFor addition details please see\nhttps://www.postgresql.org/docs/current/static/release-9-6-10.html\n","status":"published","published":"2018-10-24T09:13:45Z","modified":"2026-02-04T03:06:36.722077Z","updated_at":"2026-11-02T15:53:45.378228Z"},{"id":"USN-3744-1","title":"postgresql-10, postgresql-9.3, postgresql-9.5 vulnerabilities","description":"Andrew Krasichkov discovered that the PostgreSQL client library incorrectly\nreset its internal state between connections. A remote attacker could\npossibly use this issue to bypass certain client-side connection security\nfeatures. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS.\n(CVE-2018-10915)\n\nIt was discovered that PostgreSQL incorrectly checked authorization on\ncertain statements. A remote attacker could possibly use this issue to\nread arbitrary server memory or alter certain data. (CVE-2018-10925)\n","status":"published","published":"2018-08-16T13:09:23Z","modified":"2026-04-22T09:49:03.45971Z","updated_at":"2026-11-02T16:58:14.019824Z"}]}}