USN-6656-2: PostgreSQL vulnerability
12 March 2024
PostgreSQL could be made to run arbitrary SQL.
Releases
Packages
- postgresql-9.5 - Object-relational SQL database
Details
USN-6656-1 fixed several vulnerabilities in PostgreSQL. This update provides
the corresponding updates for Ubuntu 16.04 LTS
Original advisory details:
It was discovered that PostgreSQL incorrectly handled dropping privileges
when handling REFRESH MATERIALIZED VIEW CONCURRENTLY commands. If a user or
automatic system were tricked into running a specially crafted command, a
remote attacker could possibly use this issue to execute arbitrary SQL
functions.
Update instructions
The problem can be corrected by updating your system to the following package versions:
Ubuntu 16.04
-
postgresql-9.5
-
9.5.25-0ubuntu0.16.04.1+esm7
Available with Ubuntu Pro
-
postgresql-client-9.5
-
9.5.25-0ubuntu0.16.04.1+esm7
Available with Ubuntu Pro
After a standard system update you need to restart PostgreSQL to make all
the necessary changes.
References
Related notices
- USN-6656-1: postgresql-15, postgresql-14, postgresql-plpython3-14, libecpg6, libpq5, postgresql-doc-14, postgresql-server-dev-14, postgresql-pltcl-12, postgresql-client-14, postgresql-server-dev-12, postgresql-server-dev-15, postgresql-plpython3-15, postgresql-pltcl-14, postgresql-doc-15, postgresql-client-15, postgresql-client-12, libecpg-compat3, postgresql-plperl-15, postgresql-plpython3-12, postgresql-12, libpgtypes3, postgresql-pltcl-15, postgresql-doc-12, libpq-dev, postgresql-plperl-12, postgresql-plperl-14, libecpg-dev