Description
PostgreSQL 8.1.x before 8.1.4, 8.0.x before 8.0.8, 7.4.x before 7.4.13, 7.3.x before 7.3.15, and earlier versions allows context-dependent attackers to bypass SQL injection protection methods in applications via invalid encodings of multibyte characters, aka one variant of "Encoding-Based SQL Injection."
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 3.1 | postgresql | 7.4.7-6sarge2 | DSA-1087-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 4 | postgresql +10 | 7.4.13-2.RHEL4.1 | RHSA-2006:0526 |
| RHEL 3 | rh-postgresql +10 | 7.3.15-2 | RHSA-2006:0526 |
Advisories 2
- RHSA-2006:0526 Red Hat Security Advisory: postgresql security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1087-1 postgresql - programming error Debian Security (DSA / DLA) · Mar 9, 2026
References
- GLSA-200607-04 vendor-advisory
- 20435 third-party-advisory
- 18092 vdb-entry
- 20503 third-party-advisory
- 20451 third-party-advisory
- 21001 third-party-advisory
- http://www.postgresql.org/docs/techdocs.50
- 20231 third-party-advisory
- 20653 third-party-advisory
- SUSE-SA:2006:030 vendor-advisory
- 20782 third-party-advisory
- RHSA-2006:0526 vendor-advisory
- 2006-0032 vendor-advisory
- oval:org.mitre.oval:def:10618 vdb-entry signature
- ADV-2006-1941 vdb-entry
- 20060524 rPSA-2006-0080-1 postgresql postgresql-server mailing-list
- 20232 third-party-advisory
- 20060523 PostgreSQL security releases 8.1.4, 8.0.8, 7.4.13, 7.3.15 mailing-list
- USN-288-1 vendor-advisory
- MDKSA-2006:098 vendor-advisory
- http://support.avaya.com/elmodocs2/security/ASA-2006-113.htm
- postgresql-multibyte-sql-injection(26627) vdb-entry
- 20555 third-party-advisory
- [pgsql-announce] 20060523 Security Releases for All Active Versions mailing-list
- 1016142 vdb-entry
- USN-288-2 vendor-advisory
- 20314 third-party-advisory
- DSA-1087 vendor-advisory