CVE-2016-7048

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

The interactive installer in PostgreSQL before 9.3.15, 9.4.x before 9.4.10, and 9.5.x before 9.5.5 might allow remote attackers to execute arbitrary code by leveraging use of HTTP to download software.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-284

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://bugzilla.redhat.com/show_bug.cgi?id=1378043Issue Tracking, Third Party Advisory
https://www.postgresql.org/support/security/Patch, Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1378043Issue Tracking, Third Party Advisory
https://www.postgresql.org/support/security/Patch, Vendor Advisory

Timeline

Published: Aug 20, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-70509.8SerializableProvider in RESTEasy in Red Hat Enterprise Linux Desktop 7, Red Hat Enterprise Linux HPC Node 7, Red Hat Enterprise Linux Server CVE-2016-70518.6XmlMapper in the Jackson XML dataformat component (aka jackson-dataformat-xml) before 2.7.8 and 2.8.x before 2.8.4 allows remote attackers t CVE-2016-70527.5crypto/x509/x509_vfy.c in OpenSSL 1.0.2i allows remote attackers to cause a denial of service (NULL pointer dereference and application cras CVE-2016-70537.5In OpenSSL 1.1.0 before 1.1.0c, applications parsing invalid CMS structures can crash with a NULL pointer dereference. This is caused by a b CVE-2016-70547.5In OpenSSL 1.1.0 before 1.1.0c, TLS connections using *-CHACHA20-POLY1305 ciphersuites are susceptible to a DoS attack by corrupting larger CVE-2016-70555.9There is a carry propagating bug in the Broadwell-specific Montgomery multiplication procedure in OpenSSL 1.0.2 and 1.1.0 before 1.1.0c that CVE-2016-70565.5A timing attack flaw was found in OpenSSL 1.0.1u and before that could allow a malicious user with local access to recover ECDSA P-256 priva CVE-2016-70604.6The web interface in Red Hat QuickStart Cloud Installer (QCI) 1.0 does not mask passwords fields, which allows physically proximate attacker CVE-2016-70616.5An information disclosure vulnerability was found in JBoss Enterprise Application Platform before 7.0.4. It was discovered that when configu CVE-2016-70627.8rhscon-ceph in Red Hat Storage Console 2 x86_64 and Red Hat Storage Console Node 2 x86_64 allows local users to obtain the password as clear CVE-2016-70639.8A flaw was found in pritunl-client before version 1.0.1116.6. Arbitrary write to user specified path may lead to privilege escalation.CVE-2016-70647.5A flaw was found in pritunl-client before version 1.0.1116.6. A lack of signature verification leads to sensitive information leakage