Description
PostgreSQL (pgsql) 7.4.x, 7.2.x, and other versions allows local users to load arbitrary shared libraries and execute code via the LOAD extension.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 3.0 | postgresql | 7.2.1-2woody7 | DSA-668-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 4 | postgresql +10 | 7.4.7-2.RHEL4.1 | RHSA-2005:138 |
| RHEL 3 | rh-postgresql +10 | 7.3.9-2 | RHSA-2005:141 |
Advisories 3
- RHSA-2005:141 Red Hat Security Advisory: rh-postgresql security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2005:138 Red Hat Security Advisory: postgresql security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-668-1 postgresql - privilege escalation Debian Security (DSA / DLA) · Mar 9, 2026
References
- 200502-08 vendor-advisory
- 2005-0003 vendor-advisory
- DSA-668 vendor-advisory
- [pgsql-announce] 20050201 PostgreSQL Security Release mailing-list
- 12411 vdb-entry
- MDKSA-2005:040 vendor-advisory
- [pgsql-bugs] 20050121 Privilege escalation via LOAD mailing-list
- oval:org.mitre.oval:def:10234 vdb-entry signature
- RHSA-2005:138 vendor-advisory
- 12948 third-party-advisory
- RHSA-2005:150 vendor-advisory
- 20050201 [USN-71-1] PostgreSQL vulnerability mailing-list
- SUSE-SA:2005:036 vendor-advisory