CVE-2007-0556

The query planner in PostgreSQL before 8.0.11, 8.1 before 8.1.7, and 8.2 before 8.2.2 does not verify that a table is compatible with a "previously made query plan," which allows remote authenticated users to cause a denial of service (server crash) and possibly access database content via an "ALTER COLUMN TYPE" SQL statement, which can be leveraged to read arbitrary memory from the server.

🔗 References (68)

• cve@mitrehttp://fedoranews.org/cms/node/2554
• cve@mitrehttp://lists.rpath.com/pipermail/security-announce/2007-February/000141.html
• cve@mitrehttp://osvdb.org/33302
• cve@mitrehttp://secunia.com/advisories/24028
• cve@mitrehttp://secunia.com/advisories/24033
• cve@mitrehttp://secunia.com/advisories/24042
• cve@mitrehttp://secunia.com/advisories/24050
• cve@mitrehttp://secunia.com/advisories/24057
• cve@mitrehttp://secunia.com/advisories/24151
• cve@mitrehttp://secunia.com/advisories/24315
• cve@mitrehttp://secunia.com/advisories/24513
• cve@mitrehttp://secunia.com/advisories/24577
• cve@mitrehttp://secunia.com/advisories/25220
• cve@mitrehttp://security.gentoo.org/glsa/glsa-200703-15.xml
• cve@mitrehttp://securitytracker.com/id?1017597