CVE-2013-1899

Publication date 4 April 2013

Last updated 24 July 2024

Argument injection vulnerability in PostgreSQL 9.2.x before 9.2.4, 9.1.x before 9.1.9, and 9.0.x before 9.0.13 allows remote attackers to cause a denial of service (file corruption), and allows remote authenticated users to modify configuration settings and execute arbitrary code, via a connection request using a database name that begins with a "-" (hyphen).

Read the notes from the security team

Status

Show unmaintained releases

Package	Ubuntu Release	Status
postgresql-8.2	12.10 quantal	Not in release
	12.04 LTS precise	Not in release
	11.10 oneiric	Not in release
	10.04 LTS lucid	Not in release
	8.04 LTS hardy	Not affected
postgresql-8.3	12.10 quantal	Not in release
	12.04 LTS precise	Not in release
	11.10 oneiric	Not in release
	10.04 LTS lucid	Not in release
	8.04 LTS hardy	Not affected
postgresql-8.4	12.10 quantal	Not in release
	12.04 LTS precise	Not affected
	11.10 oneiric	Not affected
	10.04 LTS lucid	Not affected
	8.04 LTS hardy	Not in release
postgresql-9.1	12.10 quantal	Fixed 9.1.9-0ubuntu12.10
	12.04 LTS precise	Fixed 9.1.9-0ubuntu12.04
	11.10 oneiric	Fixed 9.1.9-0ubuntu11.10
	10.04 LTS lucid	Not in release
	8.04 LTS hardy	Not in release

CVE-2013-1899

Status

Notes

mdeslaur

References

Related Ubuntu Security Notices (USN)

Other references