CVE Vulnerability Catalog

Incomplete tracking in PostgreSQL of tables with row security allows reused queries to view or change different rows than intended. Fixes for CVE-2023-2455 and CVE-2016-2193 missed cases involving subqueries, WITH queries, and security invoker views.

Client use of server error messages in PostgreSQL allows an untrusted server under current SSL or GSS settings to furnish arbitrary non-NUL bytes to the libpq application. A man-in-the-middle attacker could send a long error message that a human or screen-scraper user of psql might misinterpret.

Incorrect privilege assignment in PostgreSQL allows a less-privileged application user to view or change different rows than intended. The attack requires the application to use SET ROLE, SET SESSION AUTHORIZATION, or equivalent. The problem arises when application queries use partitioning.

Incorrect control of environment variables in PostgreSQL PL/Perl allows an unprivileged database user to change sensitive process environment variables (e.g., PATH). This often suffices for arbitrary code execution, even without a database server OS user account.

Missing authorization in PostgreSQL built-in views pg_stats_ext and pg_stats_ext_exprs allows an unprivileged database user to read most common values and other statistics from CREATE STATISTICS commands of other users. The most common values may reveal column values the eavesdropper could not otherwise see.

A TOCTOU race condition in pg_dump in PostgreSQL allows an object creator to replace another relation type with a view or foreign table, executing arbitrary SQL functions as the user running pg_dump, often a superuser. The attack requires waiting for the right moment.

A buffer over-read in PostgreSQL GB18030 encoding validation allows a database input provider to cause temporary denial of service on platforms where a 1-byte over-read leads to process termination. This affects the database server and libpq.

The urllib.parse.urlsplit() and urlparse() functions in Python improperly validate bracketed hosts (`[]`), accepting hosts that are not IPv6 or IPvFuture. This violates RFC 3986 and could enable SSRF attacks if a URL is processed by multiple URL parsers.

A medium severity vulnerability in CPython where regular expressions allow excessive backtracking during tarfile.TarFile header parsing, leading to ReDoS via specially crafted tar archives.

A high severity vulnerability in the CPython zipfile module affecting zipfile.Path. When iterating over entry names in a zip archive (e.g., namelist(), iterdir()), unexpected behavior may occur. The more common zipfile.ZipFile class is unaffected.

In CPython, the venv module and CLI do not properly quote paths when creating a virtual environment, allowing injection of commands into activation scripts (e.g., source venv/bin/activate). This enables arbitrary code execution upon activation.

The Diffie-Hellman Key Agreement Protocol allows long exponents, making certain calculations unnecessarily expensive. The 1996 van Oorschot and Wiener paper showed that appropriately short exponents can be used with adequate subgroup constraints, but these are not utilized.

A null pointer dereference flaw was found in Libtiff via `tif_dirinfo.c`. This may allow an attacker to trigger memory allocation failures, causing a segmentation fault and application crash.

In libxml2 before 2.11.0, xmlXIncludeAddNode in xinclude.c has a use-after-free vulnerability.

In libxml2 before 2.12.10 and 2.13.6, a use-after-free exists in xmlSchemaIDCFillNodeTables and xmlSchemaBubbleIDCNodeTables in xmlschemas.c. Exploitation requires validation of a crafted XML document against an XML schema with identity constraints or a crafted schema.

In libxml2 before 2.12.10 and 2.13.6, a stack-based buffer overflow exists in xmlSnprintfElements in valid.c. Exploitation requires DTD validation of an untrusted document or untrusted DTD. Similar to CVE-2017-9047.

In libxml2 before 2.13.8 and 2.14.2, out-of-bounds memory access occurs in the Python API due to an incorrect return value in xmlPythonFileRead and xmlPythonFileReadRaw.

In libxml2 before 2.13.8 and 2.14.2, a heap-based buffer under-read exists in xmlSchemaIDCFillNodeTables in xmlschemas.c. Exploitation requires validation of a crafted XML document against an XML schema with identity constraints or a crafted schema.

The issue was addressed with improved memory handling. It is fixed in macOS Ventura 13.6, tvOS 17, iOS 16.7 and iPadOS 16.7, macOS Monterey 12.7, watchOS 10, iOS 17 and iPadOS 17, macOS Sonoma 14. Processing web content may disclose sensitive information.

In libxslt before 1.1.43, xsltGetInheritedNsList has a use-after-free issue related to exclusion of result prefixes.