CVE-2009-4136

Description

PostgreSQL 7.4.x before 7.4.27, 8.0.x before 8.0.23, 8.1.x before 8.1.19, 8.2.x before 8.2.15, 8.3.x before 8.3.9, and 8.4.x before 8.4.2 does not properly manage session-local state during execution of an index function by a database superuser, which allows remote authenticated users to gain privileges via a table with crafted index functions, as demonstrated by functions that modify (1) search_path or (2) a prepared statement, a related issue to CVE-2007-6600 and CVE-2009-3230.

Risk Information

Base Score

8.8

MODERATE

Vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Score

Exploitation Probability

1.557

Associated Vulnerability

Vulnerability	OS Platform
Vulnerability CVE-2009-4034,CVE-2009-4136 are affected in Postgresql 8.4.1	Windows
Vulnerabilities CVE-2009-4136,CVE-2009-4034 are fixed in PostgreSQL 8.4.2	Windows
Vulnerabilities CVE-2009-4136,CVE-2009-4034 are fixed in PostgreSQL 8.3.9	Windows
Vulnerabilities CVE-2009-4136,CVE-2009-4034 are fixed in PostgreSQL 8.2.15	Windows
Vulnerabilities CVE-2009-4136,CVE-2009-4034 are fixed in PostgreSQL 8.1.19	Windows
Vulnerabilities CVE-2009-4136,CVE-2009-4034 are fixed in PostgreSQL 8.0.23	Windows
Vulnerabilities CVE-2009-4136,CVE-2009-4034 are fixed in PostgreSQL 7.4.27	Windows
Vulnerability CVE-2009-4034,CVE-2009-4136 are affected in Postgresql 8.4.1 (For Linux)	Linux
Vulnerabilities CVE-2009-4136,CVE-2009-4034 are fixed in PostgreSQL 8.4.2 (For Linux)	Linux
Vulnerabilities CVE-2009-4136,CVE-2009-4034 are fixed in PostgreSQL 8.3.9 (For Linux)	Linux
Vulnerabilities CVE-2009-4136,CVE-2009-4034 are fixed in PostgreSQL 8.2.15 (For Linux)	Linux
Vulnerabilities CVE-2009-4136,CVE-2009-4034 are fixed in PostgreSQL 8.1.19 (For Linux)	Linux
Vulnerabilities CVE-2009-4136,CVE-2009-4034 are fixed in PostgreSQL 8.0.23 (For Linux)	Linux
Vulnerabilities CVE-2009-4136,CVE-2009-4034 are fixed in PostgreSQL 7.4.27 (For Linux)	Linux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234