Description
Multiple stack-based buffer overflows in json parsing in PostgreSQL before 9.3.x before 9.3.10 and 9.4.x before 9.4.5 allow attackers to cause a denial of service (server crash) via unspecified vectors, which are not properly handled in (1) json or (2) jsonb values.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 8 | postgresql-9.4 | 9.4.5-0+deb8u1 | DSA-3374-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 14.04 LTS | postgresql-9.1 | 9.1.19-0ubuntu0.14.04 | — |
| Ubuntu 14.04 LTS | postgresql-9.3 | 9.3.10-0ubuntu0.14.04 | USN-2772-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7 | postgresql +10 | 9.2.14-1.ael7b_1 | RHSA-2015:2078 |
| RHEL 2 | postgresql92-postgresql +10 | 9.2.14-1.el6 | RHSA-2015:2083 |
| RHEL 2 | rh-postgresql94-postgresql +10 | 9.4.5-1.el6 | RHSA-2015:2077 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 | postgresql-init | 9.4-17.8.1 | SUSE-OU-2015:1847-1 |
| SLES 12 | postgresql93 +1 | 9.3.10-11.1 | SUSE-SU-2015:1821-1 |
| SLES 12 | postgresql94 | 9.4.5-4.5 | SUSE-OU-2015:1847-1 |
| SLES 12 | postgresql94-libs | 9.4.5-4.1 | SUSE-OU-2015:1847-1 |
| SLES 11 SP4 | postgresql94 +1 | 9.4.5-0.8.3 | SUSE-SU-2016:0677-1, SUSE-SU-2016:0482-1 |
| SLES 11 SP3 | postgresql94 +1 | 9.4.5-0.8.3 | SUSE-SU-2016:0482-1 |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 12 | postgresql-init | 9.4-17.8.1 | SUSE-OU-2015:1847-1 |
| SLES for SAP 12 | postgresql93 +1 | 9.3.10-11.1 | SUSE-SU-2015:1821-1 |
| SLES for SAP 12 | postgresql94 | 9.4.5-4.5 | SUSE-OU-2015:1847-1 |
| SLES for SAP 12 | postgresql94-libs | 9.4.5-4.1 | SUSE-OU-2015:1847-1 |
| SLES for SAP 11 SP4 | postgresql94 +1 | 9.4.5-0.8.3 | SUSE-SU-2016:0677-1, SUSE-SU-2016:0482-1 |
| SLES for SAP 11 SP3 | postgresql94 +1 | 9.4.5-0.8.3 | SUSE-SU-2016:0482-1 |
| SUSE Manager 2.1 | postgresql94 | 9.4.5-0.8.3 | SUSE-SU-2016:0482-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | postgresql93 | 9.3.15-1.1 | openSUSE-SU-2024:10256-1 |
| openSUSE Tumbleweed | postgresql94 | 9.4.10-1.1 | openSUSE-SU-2024:10030-1 |
| openSUSE Tumbleweed | postgresql95 | 9.5.4-1.2 | openSUSE-SU-2024:10273-1 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 7 | postgresql +10 | 9.2.14-1.el7_1 | ELSA-2015-2078 |
Advisories 13
- RHSA-2015:2083 Red Hat Security Advisory: postgresql92-postgresql security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2015:2077 Red Hat Security Advisory: rh-postgresql94-postgresql security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2015:2078 Red Hat Security Advisory: postgresql security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- USN-2772-1 postgresql-9.1, postgresql-9.3, postgresql-9.4 vulnerabilities Ubuntu Security Notices (USN) · Apr 22, 2026
- DSA-3374-1 postgresql-9.4 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:10030-1 postgresql94-9.4.10-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-OU-2015:1847-1 Optional update for postgresql94 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2016:0677-1 Security update for postgresql94 SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10273-1 libecpg6-32bit-9.5.4-1.2 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2016:0482-1 Security update for postgresql94 SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10256-1 postgresql93-9.3.15-1.1 on GA media SUSE / openSUSE Security Updates · May 7, 2025
- SUSE-SU-2015:1821-1 Security update for postgresql93 SUSE / openSUSE Security Updates · May 2, 2025
- ELSA-2015-2078 Moderate: postgresql security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Nov 18, 2015
References
- 77048 vdb-entry
- http://www.postgresql.org/docs/9.3/static/release-9-3-10.html
- SUSE-SU-2016:0677 vendor-advisory
- http://www.postgresql.org/docs/9.4/static/release-9-4-5.html
- USN-2772-1 vendor-advisory
- GLSA-201701-33 vendor-advisory
- http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
- FEDORA-2015-6d2a957a87 vendor-advisory
- openSUSE-SU-2015:1907 vendor-advisory
- http://git.postgresql.org/gitweb/?p=postgresql.git%3Ba=commit%3Bh=08fa47c4850cea32c3116665975bca219fbf2fe6
- FEDORA-2015-7fac92f49c vendor-advisory
- http://www.postgresql.org/about/news/1615/
- DSA-3374 vendor-advisory
- 1033775 vdb-entry