CVE-2002-1400: Heap-based buffer overflow in the repeat() function for PostgreSQL before 7.2.2 allows attackers to execute arbitrary code by causing repeat() to generate a large string | LiveThreat CVE Feed — Verisq

Login Request a demo

Unscored severity · published Jan 17, 2003

CVE-2002-1400

Heap-based buffer overflow in the repeat() function for PostgreSQL before 7.2.2 allows attackers to execute arbitrary code by causing repeat() to generate a large string

–

CVSS

3.9%

EPSS

No

On KEV

Description

Heap-based buffer overflow in the repeat() function for PostgreSQL before 7.2.2 allows attackers to execute arbitrary code by causing repeat() to generate a large string.

Exploitation

Is it being used?

Exploit prediction (EPSS)3.9% · higher than 90% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

PO

PostgreSQL · PostgreSQL

6.3.2; 6.5.3; 7.0.3; 7.1; 7.1.1; 7.1.2; +3 more · source: NVD

Affected product

PO

PostgreSQL

PostgreSQL

All PostgreSQL CVEs

References

https://nvd.nist.gov/vuln/detail/CVE-2002-1400

https://www.cve.org/CVERecord?id=CVE-2002-1400

Vendor Advisory

http://archives.postgresql.org/pgsql-announce/2002-08/msg00004.php

distro.conectiva.com.br

http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000524

http://marc.info/?l=bugtraq&m=102987306029821&w=2

http://marc.info/?l=bugtraq&m=103021186622725&w=2

http://marc.info/?l=bugtraq&m=103036987114437&w=2

http://marc.info/?l=postgresql-announce&m=103062536330644

More from PostgreSQL

9.8

PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1 does not properly handle errors while reading a protocol message,…

9.8

The snprintf implementation in PostgreSQL before 9.0.20, 9.1.x before 9.1.16, 9.2.x before 9.2.11, 9.3.x before 9.3.7, and 9.4.x before 9.4.2 does not properly handle system-call…

9.8

Postgresql Windows installer before versions 11.5, 10.10, 9.6.15, 9.5.19, 9.4.24 is vulnerable via bundled OpenSSL executing code from unprotected directory

9.8

postgresql before versions 11.1, 10.6 is vulnerable to a to SQL injection in pg_upgrade and pg_dump via CREATE TRIGGER

9.8

PostgreSQL versions before 9.2.22, 9.3.18, 9.4.13, 9.5.8 and 9.6.4 are vulnerable to incorrect authentication flaw allowing remote attackers to gain access to database accounts…