PostgreSQL CVE-2017-7484 Information Disclosure Vulnerability

Bugtraq ID:	98459
Class:	Design Error
CVE:	CVE-2017-7484
Remote:	Yes
Local:	No
Published:	May 11 2017 12:00AM
Updated:	Aug 02 2017 11:09AM
Credit:	The vendor reported this issue.
Vulnerable:	Redhat Software Collections for RHEL 0 Redhat Satellite Managed DB ELS (for RHEL 6) 5.8 Redhat Satellite Managed DB (for RHEL 6) 5.8 Redhat Satellite ELS (for RHEL 6) 5.8 Redhat Satellite (for RHEL 6) 5.8 Redhat Satellite 5 PostgreSQL PostgreSQL 9.5.6 PostgreSQL PostgreSQL 9.5.4 PostgreSQL PostgreSQL 9.5.1 PostgreSQL PostgreSQL 9.5 PostgreSQL PostgreSQL 9.4.11 PostgreSQL PostgreSQL 9.4.9 PostgreSQL PostgreSQL 9.4.6 PostgreSQL PostgreSQL 9.4.5 PostgreSQL PostgreSQL 9.4.4 PostgreSQL PostgreSQL 9.4.3 PostgreSQL PostgreSQL 9.4.2 PostgreSQL PostgreSQL 9.4.1 PostgreSQL PostgreSQL 9.3.16 PostgreSQL PostgreSQL 9.3.14 PostgreSQL PostgreSQL 9.3.11 PostgreSQL PostgreSQL 9.3.10 PostgreSQL PostgreSQL 9.3.8 PostgreSQL PostgreSQL 9.3.7 PostgreSQL PostgreSQL 9.3.6 PostgreSQL PostgreSQL 9.3.5 PostgreSQL PostgreSQL 9.3.4 PostgreSQL PostgreSQL 9.3.3 PostgreSQL PostgreSQL 9.3.2 PostgreSQL PostgreSQL 9.2.20 PostgreSQL PostgreSQL 9.2.18 PostgreSQL PostgreSQL 9.2.15 PostgreSQL PostgreSQL 9.2.14 PostgreSQL PostgreSQL 9.2.13 PostgreSQL PostgreSQL 9.2.12 PostgreSQL PostgreSQL 9.2.11 PostgreSQL PostgreSQL 9.2.10 PostgreSQL PostgreSQL 9.2.7 PostgreSQL PostgreSQL 9.2.6 PostgreSQL PostgreSQL 9.2.5 PostgreSQL PostgreSQL 9.2.3 PostgreSQL PostgreSQL 9.6.2 PostgreSQL PostgreSQL 9.6.1 PostgreSQL PostgreSQL 9.5.2 PostgreSQL PostgreSQL 9.4.1-1 PostgreSQL PostgreSQL 9.4 PostgreSQL PostgreSQL 9.3.1 PostgreSQL PostgreSQL 9.3 PostgreSQL PostgreSQL 9.2.4-1 PostgreSQL PostgreSQL 9.2.4 PostgreSQL PostgreSQL 9.2.2-1 PostgreSQL PostgreSQL 9.2.2 PostgreSQL PostgreSQL 9.2.1 PostgreSQL PostgreSQL 9.2 Debian Linux 6.0 sparc Debian Linux 6.0 s/390 Debian Linux 6.0 powerpc Debian Linux 6.0 mips Debian Linux 6.0 ia-64 Debian Linux 6.0 ia-32 Debian Linux 6.0 arm Debian Linux 6.0 amd64
Not Vulnerable:	PostgreSQL PostgreSQL 9.5.7 PostgreSQL PostgreSQL 9.4.12 PostgreSQL PostgreSQL 9.3.17 PostgreSQL PostgreSQL 9.2.21 PostgreSQL PostgreSQL 9.6.3

PostgreSQL CVE-2017-7484 Information Disclosure Vulnerability

PostgreSQL is prone to an information-disclosure vulnerability.

An attacker can exploit this issue to gain access to sensitive information that may lead to further attacks.

PostgreSQL 9.2.x through 9.2.21, 9.3.x through 9.3.17, 9.4.x through 9.4.12, 9.5.x through 9.5.7, 9.6.x thorugh 9.6.3 are vulnerable.

PostgreSQL CVE-2017-7484 Information Disclosure Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

PostgreSQL CVE-2017-7484 Information Disclosure Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

PostgreSQL CVE-2017-7484 Information Disclosure Vulnerability

References:

• Add security checks to selectivity estimation functions (PostgreSQL)
  
• Fix possibly-uninitialized variable. (PostgreSQL)
  
• Further patch rangetypes_selfuncs.c's statistics slot management. (PostgreSQL)
  
• PostgreSQL - Homepage (PostgreSQL)
  
• 2017-05-11 Security Update Release (PostgreSQL)
  
• Bug 1448078 -CVE-2017-7484 postgresql: Selectivity estimators bypass SELECT priv (Redhat)