PostgreSQL is prone to a security-bypass vulnerability because the application fails to properly validate the domain name in a signed CA certificate, allowing attackers to substitute malicious SSL certificates for trusted ones. Successfully exploiting this issue allows attackers to perform man-in-the- middle attacks or impersonate trusted servers, which will aid in further attacks. PostgreSQL is also prone to a local privilege-escalation vulnerability. Exploiting this issue allows local attackers to gain elevated privileges. PostgreSQL versions prior to 8.4.2, 8.3.9, 8.2.15, 8.1.19, 8.0.23, and 7.4.27 are vulnerable to this issue.
Updates are available. Please see the references for more information.
- Oracle MySQL Multiple Unspecified vulnerabilities-01 Oct-2013 (Windows)
- PostgreSQL Multiple Integer Overflow Vulnerabilities July14 (Windows)
- MySQL UNINSTALL PLUGIN Security Bypass Vulnerability
- MySQL Multiple Vulnerabilities
- IBM DB2 DML Statement Execution Remote Privilege Escalation Vulnerability (Linux)