CVE-2007-4769 The regular expression parser in TCL before 8.4.17, as used in PostgreSQL 8.2 before 8.2.6, 8.1 before 8.1.11, 8.0 before 8.0.15, and 7.4 before 7.4.19, allows remote authenticated users to cause a de...
MediumCVSS 6.8
EPSS 3.6%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The regular expression parser in TCL before 8.4.17, as used in PostgreSQL 8.2 before 8.2.6, 8.1 before 8.1.11, 8.0 before 8.0.15, and 7.4 before 7.4.19, allows remote authenticated users to cause a denial of service (backend crash) via an out-of-bounds backref number.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| postgresql | = 7.3 | No fix listed |
| postgresql | = 7.3.1 | No fix listed |
| postgresql | = 7.3.2 | No fix listed |
| postgresql | = 7.3.3 | No fix listed |
| postgresql | = 7.3.4 | No fix listed |
| postgresql | = 7.3.6 | No fix listed |
| postgresql | = 7.3.8 | No fix listed |
| postgresql | = 7.3.9 | No fix listed |
| postgresql | = 7.3.10 | No fix listed |
| postgresql | = 7.3.11 | No fix listed |
| postgresql | = 7.3.12 | No fix listed |
| postgresql | = 7.3.13 | No fix listed |
| postgresql | = 7.3.14 | No fix listed |
| postgresql | = 7.3.15 | No fix listed |
| postgresql | = 7.3.16 | No fix listed |
| postgresql | = 7.3.19 | No fix listed |
| postgresql | = 7.4 | No fix listed |
| postgresql | = 7.4.1 | No fix listed |
| postgresql | = 7.4.2 | No fix listed |
| postgresql | = 7.4.3 | No fix listed |
| postgresql | = 7.4.4 | No fix listed |
| postgresql | = 7.4.5 | No fix listed |
| postgresql | = 7.4.6 | No fix listed |
| postgresql | = 7.4.7 | No fix listed |
| postgresql | = 7.4.8 | No fix listed |
Show 32 more
| Product | Affected versions | Fixed in |
|---|---|---|
| postgresql | = 7.4.9 | No fix listed |
| postgresql | = 7.4.10 | No fix listed |
| postgresql | = 7.4.11 | No fix listed |
| postgresql | = 7.4.12 | No fix listed |
| postgresql | = 7.4.13 | No fix listed |
| postgresql | = 7.4.14 | No fix listed |
| postgresql | = 7.4.16 | No fix listed |
| postgresql | = 7.4.17 | No fix listed |
| postgresql | = 8.0 | No fix listed |
| postgresql | = 8.0.1 | No fix listed |
| postgresql | = 8.0.2 | No fix listed |
| postgresql | = 8.0.3 | No fix listed |
| postgresql | = 8.0.4 | No fix listed |
| postgresql | = 8.0.5 | No fix listed |
| postgresql | = 8.0.7 | No fix listed |
| postgresql | = 8.0.8 | No fix listed |
| postgresql | = 8.0.9 | No fix listed |
| postgresql | = 8.0.11 | No fix listed |
| postgresql | = 8.0.13 | No fix listed |
| postgresql | = 8.0.317 | No fix listed |
| postgresql | = 8.1.1 | No fix listed |
| postgresql | = 8.1.3 | No fix listed |
| postgresql | = 8.1.4 | No fix listed |
| postgresql | = 8.1.5 | No fix listed |
| postgresql | = 8.1.7 | No fix listed |
| postgresql | = 8.1.8 | No fix listed |
| postgresql | = 8.1.9 | No fix listed |
| postgresql | = 8.2 | No fix listed |
| postgresql | = 8.2.2 | No fix listed |
| postgresql | = 8.2.3 | No fix listed |
| postgresql | = 8.2.4 | No fix listed |
| tcl tk | <= 8.4.16 | No fix listed |
References
- SSRT080006 vendor-advisory
- SUSE-SA:2008:005 vendor-advisory
- 28359 third-party-advisory vendor-advisory
- 28376 third-party-advisory vendor-advisory
- 28437 third-party-advisory vendor-advisory
- 28438 third-party-advisory vendor-advisory
- 28454 third-party-advisory vendor-advisory
- 28455 third-party-advisory vendor-advisory
- 28464 third-party-advisory vendor-advisory
- 28477 third-party-advisory
- 28479 third-party-advisory vendor-advisory
- 28679 third-party-advisory vendor-advisory
- 28698 third-party-advisory vendor-advisory
- 29638 third-party-advisory vendor-advisory
- GLSA-200801-15 vendor-advisory
- 1019157 vdb-entry
- sourceforge.net
- sourceforge.net
- 103197 vendor-advisory
- 200559 vendor-advisory
- DSA-1460 vendor-advisory
- DSA-1463 vendor-advisory
- MDVSA-2008:004 vendor-advisory
- www.postgresql.org
- RHSA-2008:0038 vendor-advisory
- RHSA-2008:0040 vendor-advisory
- 20080107 PostgreSQL 2007-01-07 Cumulative Security Release mailing-list
- 20080115 rPSA-2008-0016-1 postgresql postgresql-server mailing-list
- 27163 patch vdb-entry
- ADV-2008-0061 vdb-entry vendor-advisory
- ADV-2008-0109 vdb-entry vendor-advisory
- ADV-2008-1071 vdb-entry
- postgresql-backref-dos(39499) vdb-entry
- issues.rpath.com
- oval:org.mitre.oval:def:9804 signature vdb-entry
- USN-568-1 vendor-advisory
- FEDORA-2008-0478 vendor-advisory
- FEDORA-2008-0552 vendor-advisory