CVE-2017-18359 PostGIS 2.x before 2.3.3, as used with PostgreSQL, allows remote attackers to cause a denial of service via crafted ST_AsX3D function input, as demonstrated by an abnormal server termination for "SELE...
HighCVSS 7.5
EPSS 3.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
PostGIS 2.x before 2.3.3, as used with PostgreSQL, allows remote attackers to cause a denial of service via crafted ST_AsX3D function input, as demonstrated by an abnormal server termination for "SELECT ST_AsX3D('LINESTRING EMPTY');" because empty geometries are mishandled.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/postgis(Debian:12) | < 2.3.3+dfsg-1 | 2.3.3+dfsg-1 |
| debian/postgis(Debian:13) | < 2.3.3+dfsg-1 | 2.3.3+dfsg-1 |
| debian/postgis(Debian:14) | < 2.3.3+dfsg-1 | 2.3.3+dfsg-1 |
| postgis/postgis | >= 2.0.0, < 2.3.3 | 2.3.3 |
| debian linux | = 8.0 | No fix listed |
| debian linux | = 9.0 | No fix listed |
References
- Debian Security Tracker CVE-2017-18359 vendor-advisory
- [debian-lts-announce] 20190131 [SECURITY] [DLA 1653-1] postgis security update mailing-list third-party-advisory
- [debian-lts-announce] 20211227 [SECURITY] [DLA 2857-1] postgis security update mailing-list third-party-advisory
- trac.osgeo.org patch third-party-advisory
- trac.osgeo.org patch third-party-advisory
- trac.osgeo.org exploit third-party-advisory