Test ID:	1.3.6.1.4.1.25623.1.1.10.2017.0428
Category:	Mageia Linux Local Security Checks
Title:	Mageia: Security Advisory (MGASA-2017-0428)
Summary:	The remote host is missing an update for the 'postgresql9.3, postgresql9.4, postgresql9.6' package(s) announced via the MGASA-2017-0428 advisory.
Description:	Summary: The remote host is missing an update for the 'postgresql9.3, postgresql9.4, postgresql9.6' package(s) announced via the MGASA-2017-0428 advisory. Vulnerability Insight: The startup log file for the postmaster (in newer releases, 'postgres') process was opened while the process was still owned by root. With this setup, the database owner could specify a file that they did not have access to and cause the file to be corrupted with logged data (CVE-2017-12172). Crash due to rowtype mismatch in json{b}_populate_recordset(). These functions used the result rowtype specified in the FROM ... AS clause without checking that it matched the actual rowtype of the supplied tuple value. If it didn't, that would usually result in a crash, though disclosure of server memory contents seems possible as well (CVE-2017-15098). The 'INSERT ... ON CONFLICT DO UPDATE' would not check to see if the executing user had permission to perform a 'SELECT' on the index performing the conflicting check. Additionally, in a table with row-level security enabled, the 'INSERT ... ON CONFLICT DO UPDATE' would not check the SELECT policies for that table before performing the update (CVE-2017-15099). Affected Software/OS: 'postgresql9.3, postgresql9.4, postgresql9.6' package(s) on Mageia 5, Mageia 6. Solution: Please install the updated package(s). CVSS Score: 7.2 CVSS Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2017-12172 BugTraq ID: 101949 http://www.securityfocus.com/bid/101949 https://www.postgresql.org/support/security/ RedHat Security Advisories: RHSA-2017:3402 https://access.redhat.com/errata/RHSA-2017:3402 RedHat Security Advisories: RHSA-2017:3403 https://access.redhat.com/errata/RHSA-2017:3403 RedHat Security Advisories: RHSA-2017:3404 https://access.redhat.com/errata/RHSA-2017:3404 RedHat Security Advisories: RHSA-2017:3405 https://access.redhat.com/errata/RHSA-2017:3405 http://www.securitytracker.com/id/1039752 Common Vulnerability Exposure (CVE) ID: CVE-2017-15098 BugTraq ID: 101781 http://www.securityfocus.com/bid/101781 Debian Security Information: DSA-4027 (Google Search) https://www.debian.org/security/2017/dsa-4027 Debian Security Information: DSA-4028 (Google Search) https://www.debian.org/security/2017/dsa-4028 RedHat Security Advisories: RHSA-2018:2511 https://access.redhat.com/errata/RHSA-2018:2511 RedHat Security Advisories: RHSA-2018:2566 https://access.redhat.com/errata/RHSA-2018:2566 Common Vulnerability Exposure (CVE) ID: CVE-2017-15099
Copyright	Copyright (C) 2022 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.