Vulnerability Details : CVE-2013-0255
PostgreSQL 9.2.x before 9.2.3, 9.1.x before 9.1.8, 9.0.x before 9.0.12, 8.4.x before 8.4.16, and 8.3.x before 8.3.23 does not properly declare the enum_recv function in backend/utils/adt/enum.c, which causes it to be invoked with incorrect arguments and allows remote authenticated users to cause a denial of service (server crash) or read sensitive process memory via a crafted SQL command, which triggers an array index error and an out-of-bounds read.
Vulnerability category: Input validationDenial of service
Threat overview for CVE-2013-0255
Top countries where our scanners detected CVE-2013-0255
Top open port discovered on systems with this issue
5432
IPs affected by CVE-2013-0255 37,113
Threat actors abusing to this issue?
Yes
Find out if you* are
affected by CVE-2013-0255!
*Directly or indirectly through your vendors, service providers and 3rd parties.
Powered by
attack surface intelligence
from SecurityScorecard.
Exploit prediction scoring system (EPSS) score for CVE-2013-0255
Probability of exploitation activity in the next 30 days: 1.64%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 87 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2013-0255
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
---|---|---|---|---|---|
6.8
|
MEDIUM | AV:N/AC:L/Au:S/C:N/I:N/A:C |
8.0
|
6.9
|
NIST |
CWE ids for CVE-2013-0255
-
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.Assigned by: nvd@nist.gov (Primary)
References for CVE-2013-0255
-
https://blogs.oracle.com/sunsecurity/entry/cve_2013_0255_array_index
CVE-2013-0255 Array Index error vulnerability in PostgreSQL | Oracle Third Party Vulnerability Resolution Blog
-
http://www.postgresql.org/docs/9.0/static/release-9-0-12.html
PostgreSQL: Documentation: 9.0: Release 9.0.12
-
http://lists.opensuse.org/opensuse-updates/2013-02/msg00059.html
openSUSE-SU-2013:0318-1: moderate: postgresql91: update to 9.1.8
-
http://www.postgresql.org/docs/9.1/static/release-9-1-8.html
PostgreSQL: Documentation: 9.1: Release 9.1.8
-
http://www.mandriva.com/security/advisories?name=MDVSA-2013:142
mandriva.com
-
http://lists.fedoraproject.org/pipermail/package-announce/2013-February/098586.html
[SECURITY] Fedora 18 Update: postgresql-9.2.3-1.fc18
-
https://exchange.xforce.ibmcloud.com/vulnerabilities/81917
PostgreSQL enum_recv() denial of service CVE-2013-0255 Vulnerability Report
-
http://lists.opensuse.org/opensuse-updates/2013-02/msg00060.html
openSUSE-SU-2013:0319-1: moderate: postgresql: security and bugfix updat
-
http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
Oracle Critical Patch Update - October 2017
-
http://www.postgresql.org/docs/8.3/static/release-8-3-23.html
PostgreSQL: Documentation: 8.3: Release 8.3.23
-
https://bugzilla.redhat.com/show_bug.cgi?id=907892
907892 – (CVE-2013-0255) CVE-2013-0255 postgresql: array indexing error in enum_recv()
-
http://www.postgresql.org/docs/9.2/static/release-9-2-3.html
PostgreSQL: Documentation: 9.2: Release 9.2.3
-
http://www.debian.org/security/2013/dsa-2630
Debian -- Security Information -- DSA-2630-1 postgresql-8.4
-
http://rhn.redhat.com/errata/RHSA-2013-1475.html
RHSA-2013:1475 - Security Advisory - Red Hat Customer Portal
-
http://www.ubuntu.com/usn/USN-1717-1
USN-1717-1: PostgreSQL vulnerability | Ubuntu security notices
-
http://www.postgresql.org/docs/8.4/static/release-8-4-16.html
PostgreSQL: Documentation: 8.4: Release 8.4.16
-
http://www.securityfocus.com/bid/57844
PostgreSQL 'enum_recv()' Function Denial of Service Vulnerability
Products affected by CVE-2013-0255
- cpe:2.3:a:postgresql:postgresql:8.3.6:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:8.4:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:8.3:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:8.3.7:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:8.3.5:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:8.3.2:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:8.3.1:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:8.3.4:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:8.3.3:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:8.3.8:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:8.4.1:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:8.3.10:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:8.3.9:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:8.4.2:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:8.4.3:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:8.3.11:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:8.4.4:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:9.0:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:8.3.13:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:8.3.12:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:9.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:9.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:8.4.5:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:8.4.6:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:8.3.16:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:8.3.15:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:8.3.14:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:8.3.17:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:8.4.8:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:8.4.9:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:8.4.7:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:8.4.10:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:9.0.5:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:9.0.6:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:9.0.3:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:9.0.4:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:9.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:9.1.2:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:9.1:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:8.3.18:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:8.4.11:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:9.0.7:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:9.1.3:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:9.1.4:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:8.4.12:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:8.3.19:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:9.0.8:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:8.3.20:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:8.3.21:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:8.3.22:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:8.4.14:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:8.4.15:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:8.4.13:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:9.0.9:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:9.0.11:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:9.0.10:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:9.1.5:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:9.1.7:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:9.1.6:*:*:*:*:*:*:*