Search for packages
Package details: pkg:deb/debian/postgresql-15@15.3-0%2Bdeb12u1
purl pkg:deb/debian/postgresql-15@15.3-0%2Bdeb12u1
Tags Ghost
Next non-vulnerable version None.
Latest non-vulnerable version None.
Risk 4.0
Vulnerabilities affecting this package (2)
Vulnerability Summary Fixed by
VCID-23g8-dcz6-aaan
Aliases:
CVE-2023-39417
IN THE EXTENSION SCRIPT, a SQL Injection vulnerability was found in PostgreSQL if it uses @extowner@, @extschema@, or @extschema:...@ inside a quoting construct (dollar quoting, '', or ""). If an administrator has installed files of a vulnerable, trusted, non-bundled extension, an attacker with database-level CREATE privilege can execute arbitrary code as the bootstrap superuser.
15.4-0+deb12u1
Affected by 0 other vulnerabilities.
15.4-3
Affected by 0 other vulnerabilities.
VCID-x1aj-681s-aaah
Aliases:
CVE-2023-39418
A vulnerability was found in PostgreSQL with the use of the MERGE command, which fails to test new rows against row security policies defined for UPDATE and SELECT. If UPDATE and SELECT policies forbid some rows that INSERT policies do not forbid, a user could store such rows.
15.4-0+deb12u1
Affected by 0 other vulnerabilities.
15.4-3
Affected by 0 other vulnerabilities.
Vulnerabilities fixed by this package (0)
Vulnerability Summary Aliases
This package is not known to fix vulnerabilities.

Date Actor Action Vulnerability Source VulnerableCode Version