Skip to content
OpenAdvisories
Unscored USN-2772-1 2 CVEs

postgresql-9.1, postgresql-9.3, postgresql-9.4 vulnerabilities

Published Oct 16, 2015 · Updated Apr 22, 2026

Ecosystem: Ubuntu

Summary

Josh Kupershmidt discovered the pgCrypto extension could expose
several bytes of server memory if the crypt() function was provided a
too-short salt. An attacker could use this flaw to read private data.
(CVE-2015-5288)

Oskari Saarenmaa discovered that the json and jsonb handlers could exhaust
available stack space. An attacker could use this flaw to perform a denial
of service attack. This issue only affected Ubuntu 14.04 LTS and Ubuntu
15.04. (CVE-2015-5289)

Fixed packages 1

ReleasePackageFixed in
Ubuntu · 14.04 LTS 14.04:LTS postgresql-9.3 9.3.10-0ubuntu0.14.04

Vulnerabilities 2

References

  • report
    https://ubuntu.com/security/CVE-2015-5288
  • report
    https://ubuntu.com/security/CVE-2015-5289