Vulnerability Description
Untrusted search path vulnerability in PostgreSQL before 7.3.19, 7.4.x before 7.4.17, 8.0.x before 8.0.13, 8.1.x before 8.1.9, and 8.2.x before 8.2.4 allows remote authenticated users, when permitted to call a SECURITY DEFINER function, to gain the privileges of the function owner, related to "search_path settings."
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Postgresql | Postgresql | < 7.3.19 |
| Debian | Debian Linux | 3.1 |
| Canonical | Ubuntu Linux | 6.06 |
Related Weaknesses (CWE)
References
- http://rhn.redhat.com/errata/RHSA-2007-0336.htmlThird Party Advisory
- http://secunia.com/advisories/24989Third Party Advisory
- http://secunia.com/advisories/24999Third Party Advisory
- http://secunia.com/advisories/25005Third Party Advisory
- http://secunia.com/advisories/25019Third Party Advisory
- http://secunia.com/advisories/25037Third Party Advisory
- http://secunia.com/advisories/25058Third Party Advisory
- http://secunia.com/advisories/25184Third Party Advisory
- http://secunia.com/advisories/25238Third Party Advisory
- http://secunia.com/advisories/25334Third Party Advisory
- http://secunia.com/advisories/25717Third Party Advisory
- http://secunia.com/advisories/25720Third Party Advisory
- http://secunia.com/advisories/25725Third Party Advisory
- http://security.gentoo.org/glsa/glsa-200705-12.xmlThird Party Advisory
- http://sunsolve.sun.com/search/document.do?assetkey=1-26-102894-1Broken Link
FAQ
What is CVE-2007-2138?
CVE-2007-2138 is a vulnerability with a CVSS score of 6.0 (MEDIUM). Untrusted search path vulnerability in PostgreSQL before 7.3.19, 7.4.x before 7.4.17, 8.0.x before 8.0.13, 8.1.x before 8.1.9, and 8.2.x before 8.2.4 allows remote authenticated users, when permitted ...
How severe is CVE-2007-2138?
CVE-2007-2138 has been rated MEDIUM with a CVSS base score of 6.0/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2007-2138?
Check the references section above for vendor advisories and patch information. Affected products include: Postgresql Postgresql, Debian Debian Linux, Canonical Ubuntu Linux.