Description
The tsearch2 module in PostgreSQL 7.4 through 8.0.x declares the (1) dex_init, (2) snb_en_init, (3) snb_ru_init, (4) spell_init, and (5) syn_init functions as "internal" even when they do not take an internal argument, which allows attackers to cause a denial of service (application crash) and possibly have other impacts via SQL commands that call other functions that accept internal arguments.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 4 | postgresql +10 | 7.4.8-1.RHEL4.1 | RHSA-2005:433 |
| RHEL 3 | rh-postgresql +10 | 7.3.10-1 | RHSA-2005:433 |
Advisories 1
- RHSA-2005:433 Red Hat Security Advisory: postgresql security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
References
- oval:org.mitre.oval:def:9343 vdb-entry signature
- 13475 vdb-entry
- oval:org.mitre.oval:def:1086 vdb-entry signature
- RHSA-2005:433 vendor-advisory
- FLSA-2006:157366 vendor-advisory
- ADV-2005-0453 vdb-entry
- [pgsql-announce] 20050502 IMPORTANT: two new PostgreSQL security problems found mailing-list
- http://www.postgresql.org/about/news.315
- SUSE-SA:2005:036 vendor-advisory