Description
The query planner in PostgreSQL before 8.0.11, 8.1 before 8.1.7, and 8.2 before 8.2.2 does not verify that a table is compatible with a "previously made query plan," which allows remote authenticated users to cause a denial of service (server crash) and possibly access database content via an "ALTER COLUMN TYPE" SQL statement, which can be leveraged to read arbitrary memory from the server.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | postgresql +9 | 8.1.8-1.el5 | RHSA-2007:0068 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhel Application Stack 1 | postgresql +9 | 8.1.7-3.el4s1.1 | RHSA-2007:0067 |
Advisories 2
- RHSA-2007:0068 Red Hat Security Advisory: postgresql security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2007:0067 Red Hat Security Advisory: postgresql security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
References
- https://issues.rpath.com/browse/RPL-1025
- 24050 third-party-advisory
- 22387 vdb-entry
- 24513 third-party-advisory
- 24315 third-party-advisory
- oval:org.mitre.oval:def:11353 vdb-entry signature
- postgresql-datatype-information-disclosure(32191) vdb-entry
- RHSA-2007:0068 vendor-advisory
- 20070208 rPSA-2007-0025-2 postgresql postgresql-server mailing-list
- ADV-2007-0774 vdb-entry
- 20070206 rPSA-2007-0025-1 postgresql postgresql-server mailing-list
- ADV-2007-0478 vdb-entry
- 24151 third-party-advisory
- USN-417-2 vendor-advisory
- 24577 third-party-advisory
- 24033 third-party-advisory
- 1017597 vdb-entry
- USN-417-1 vendor-advisory
- https://issues.rpath.com/browse/RPL-830
- SUSE-SR:2007:010 vendor-advisory
- http://www.postgresql.org/support/security
- FEDORA-2007-198 vendor-advisory
- http://support.avaya.com/elmodocs2/security/ASA-2007-117.htm
- 2007-0007 vendor-advisory
- MDKSA-2007:037 vendor-advisory
- RHSA-2007:0067 vendor-advisory
- 24057 third-party-advisory
- 25220 third-party-advisory
- 24042 third-party-advisory
- 24028 third-party-advisory
- 33302 vdb-entry
- [security-announce] 20070206 rPSA-2007-0025-1 postgresql postgresql-server mailing-list
- 102825 vendor-advisory
- GLSA-200703-15 vendor-advisory