CVE-2017-7548

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

PostgreSQL versions before 9.4.13, 9.5.8 and 9.6.4 are vulnerable to authorization flaw allowing remote authenticated attackers with no privileges on a large object to overwrite the entire contents of the object, resulting in a denial of service.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-862

Affected software

Vendor	Product	Versions
PostgreSQL	postgresql	9.4.x before 9.4.13; 9.5.x before 9.5.8; 9.6.x before 9.6.4

References

http://www.debian.org/security/2017/dsa-3935Third Party Advisory
http://www.debian.org/security/2017/dsa-3936Third Party Advisory
http://www.securityfocus.com/bid/100276Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1039142Third Party Advisory, VDB Entry
https://access.redhat.com/errata/RHSA-2017:2677Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:2678Third Party Advisory
https://security.gentoo.org/glsa/201710-06Third Party Advisory
https://www.postgresql.org/about/news/1772/Vendor Advisory
http://www.debian.org/security/2017/dsa-3935Third Party Advisory
http://www.debian.org/security/2017/dsa-3936Third Party Advisory
http://www.securityfocus.com/bid/100276Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1039142Third Party Advisory, VDB Entry
https://access.redhat.com/errata/RHSA-2017:2677Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:2678Third Party Advisory
https://security.gentoo.org/glsa/201710-06Third Party Advisory
https://www.postgresql.org/about/news/1772/Vendor Advisory

Timeline

Published: Aug 16, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-75496.4A flaw was found in instack-undercloud 7.2.0 as packaged in Red Hat OpenStack Platform Pike, 6.1.0 as packaged in Red Hat OpenStack Platform CVE-2017-75509.8A flaw was found in the way Ansible (2.3.x before 2.3.3, and 2.4.x before 2.4.1) passed certain parameters to the jenkins_plugin module. Rem CVE-2017-75519.8389-ds-base version before 1.3.5.19 and 1.3.6.7 are vulnerable to password brute-force attacks during account lockout due to different retur CVE-2017-75529.8A flaw was discovered in the file editor of millicore, affecting versions before 3.19.0 and 4.x before 4.5.0, which allows files to be execu CVE-2017-75536.3The external_request api call in App Studio (millicore) allows server side request forgery (SSRF). An attacker could use this flaw to probe CVE-2017-75546.1It was found that the App Studio component of RHMAP 4.4 executes javascript provided by a user. An attacker could use this flaw to execute a CVE-2017-75559.8Augeas versions up to and including 1.8.0 are vulnerable to heap-based buffer overflow due to improper handling of escaped strings. Attacker CVE-2017-75568.8Hawtio versions up to and including 1.5.3 are vulnerable to CSRF vulnerability allowing remote attackers to trick the user to visit their we CVE-2017-75578.8dnsdist version 1.1.0 is vulnerable to a flaw in authentication mechanism for REST API potentially allowing CSRF attack.CVE-2017-75587.5A kernel data leak due to an out-of-bound read was found in the Linux kernel in inet_diag_msg_sctp{,l}addr_fill() and sctp_get_sctp_info() f CVE-2017-75596.1In Undertow 2.x before 2.0.0.Alpha2, 1.4.x before 1.4.17.Final, and 1.3.x before 1.3.31.Final, it was found that the fix for CVE-2017-2666 w CVE-2017-75605.5It was found that rhnsd PID files are created as world-writable that allows local attackers to fill the disks or to kill selected processes.