CVE-2007-4639

MediumCVSS 6.5/10Last modified Jun 16, 2026

Description

EnterpriseDB Advanced Server 8.2 does not properly handle certain debugging function calls that occur before a call to pldbg_create_listener, which allows remote authenticated users to cause a denial of service (daemon crash) and possibly execute arbitrary code via a SELECT statement that invokes a pldbg_ function, as demonstrated by (1) pldbg_get_stack and (2) pldbg_abort_target, which triggers use of an uninitialized pointer.

Metrics

CVSS 2.0 6.5/10AV:N/AC:L/Au:S/C:P/I:P/A:P

Weakness enumeration

CWE-824

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://secunia.com/advisories/26640Broken Link
http://www.securityfocus.com/archive/1/478057/100/0/threadedBroken Link, Third Party Advisory, VDB Entry
http://www.securityfocus.com/bid/25481Broken Link, Exploit, Third Party Advisory, VDB Entry
http://www.vupen.com/english/advisories/2007/3040Broken Link
https://exchange.xforce.ibmcloud.com/vulnerabilities/36328Broken Link, Third Party Advisory, VDB Entry
http://secunia.com/advisories/26640Broken Link
http://www.securityfocus.com/archive/1/478057/100/0/threadedBroken Link, Third Party Advisory, VDB Entry
http://www.securityfocus.com/bid/25481Broken Link, Exploit, Third Party Advisory, VDB Entry
http://www.vupen.com/english/advisories/2007/3040Broken Link
https://exchange.xforce.ibmcloud.com/vulnerabilities/36328Broken Link, Third Party Advisory, VDB Entry

Timeline

Published: Aug 31, 2007
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2007

CVE-2007-46406.4Unrestricted file upload vulnerability in index.php in Pakupaku CMS 0.4 and earlier allows remote attackers to upload and execute arbitrary CVE-2007-46416.4Directory traversal vulnerability in index.php in Pakupaku CMS 0.4 and earlier allows remote attackers to include and execute arbitrary loca CVE-2007-464210.0Multiple buffer overflows in Doomsday (aka deng) 1.9.0-beta5.1 and earlier allow remote attackers to execute arbitrary code via a long chat CVE-2007-46435.0Integer underflow in Doomsday (aka deng) 1.9.0-beta5.1 and earlier allows remote attackers to cause a denial of service (daemon crash) via a CVE-2007-46447.5Format string vulnerability in the Cl_GetPackets function in cl_main.c in the client in Doomsday (aka deng) 1.9.0-beta5.1 and earlier allows CVE-2007-46456.4SQL injection vulnerability in index.php in NMDeluxe 2.0.0 allows remote attackers to execute arbitrary SQL commands via the id parameter in CVE-2007-464610.0Buffer overflow in the pop3 service in Hexamail Server 3.0.0.001 Lite allows remote attackers to cause a denial of service (daemon crash) an CVE-2007-46475.0newswire/uploadmedia.cgi in 2coolcode Our Space (Ourspace) 2.0.9 allows remote attackers to upload certain files via unspecified vectors, pr CVE-2007-46487.2The nvcoaft51 driver in Norman Virus Control (NVC) 5.82 uses weak permissions (unrestricted write access) for the NvcOa device, which allows CVE-2007-46497.2MicroWorld eScan Virus Control 9.0.722.1, Anti-Virus 9.0.722.1, and Internet Security 9.0.722.1 use weak permissions (Everyone:Full Control)CVE-2007-46506.4Multiple unspecified vulnerabilities in Gallery before 2.2.3 allow attackers to (1) rename items, (2) read and modify item properties, or (3 CVE-2007-46515.0Unspecified vulnerability in Adobe Connect Enterprise Server 6 allows remote attackers to read certain pages that are restricted to the admi