CVE-2015-3166

Description

The snprintf implementation in PostgreSQL before 9.0.20, 9.1.x before 9.1.16, 9.2.x before 9.2.11, 9.3.x before 9.3.7, and 9.4.x before 9.4.2 does not properly handle system-call errors, which allows attackers to obtain sensitive information or have other unspecified impact via unknown vectors, as demonstrated by an out-of-memory error.

Risk Information

Base Score

9.8

MODERATE

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score

Exploitation Probability

2.185

Associated Vulnerability

Vulnerability	OS Platform
Vulnerabilities CVE-2015-3167,CVE-2015-3166,CVE-2015-3165 are fixed in PostgreSQL 9.4.2	Windows
Vulnerabilities CVE-2015-3167,CVE-2015-3166,CVE-2015-3165 are fixed in PostgreSQL 9.3.7	Windows
Vulnerabilities CVE-2015-3167,CVE-2015-3166,CVE-2015-3165 are fixed in PostgreSQL 9.2.11	Windows
Vulnerabilities CVE-2015-3167,CVE-2015-3166,CVE-2015-3165 are fixed in PostgreSQL 9.1.16	Windows
Vulnerabilities CVE-2015-3167,CVE-2015-3166,CVE-2015-3165 are fixed in PostgreSQL 9.0.20	Windows
Object-relational SQL database (USN-2621-1) postgresql-9.4_9.4.5-0ubuntu0.15.04_i386.deb	Linux
Object-relational SQL database (USN-2621-1) postgresql-9.4_9.4.5-0ubuntu0.15.04_amd64.deb	Linux
postgresql-9.4 security update(DSA-3476-1) postgresql-9.4_9.4.8-0+deb8u1_i386.deb	Linux
postgresql-9.4 security update(DSA-3476-1) postgresql-9.4_9.4.8-0+deb8u1_amd64.deb	Linux
Vulnerabilities CVE-2015-3167,CVE-2015-3166,CVE-2015-3165 are fixed in PostgreSQL 9.4.2 (For Linux)	Linux
Vulnerabilities CVE-2015-3167,CVE-2015-3166,CVE-2015-3165 are fixed in PostgreSQL 9.3.7 (For Linux)	Linux
Vulnerabilities CVE-2015-3167,CVE-2015-3166,CVE-2015-3165 are fixed in PostgreSQL 9.2.11 (For Linux)	Linux
Vulnerabilities CVE-2015-3167,CVE-2015-3166,CVE-2015-3165 are fixed in PostgreSQL 9.1.16 (For Linux)	Linux
Vulnerabilities CVE-2015-3167,CVE-2015-3166,CVE-2015-3165 are fixed in PostgreSQL 9.0.20 (For Linux)	Linux
Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability (CVE-2015-3166)	NCM

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234