Test ID:	1.3.6.1.4.1.25623.1.1.10.2019.0225
Category:	Mageia Linux Local Security Checks
Title:	Mageia: Security Advisory (MGASA-2019-0225)
Summary:	The remote host is missing an update for the 'postgresql9.4, postgresql9.6, postgresql11' package(s) announced via the MGASA-2019-0225 advisory.
Description:	Summary: The remote host is missing an update for the 'postgresql9.4, postgresql9.6, postgresql11' package(s) announced via the MGASA-2019-0225 advisory. Vulnerability Insight: Updated postgresql packages fix security vulnerabilities: Given a suitable SECURITY DEFINER function, an attacker can execute arbitrary SQL under the identity of the function owner. An attack requires EXECUTE permission on the function, which must itself contain a function call having inexact argument type match. For example, length('foo'::varchar) and length('foo') are inexact, while length('foo'::text) is exact (CVE-2019-10208). In a database containing hypothetical, user-defined hash equality operators, an attacker could read arbitrary bytes of server memory. For an attack to become possible, a superuser would need to create unusual operators. It is possible for operators not purpose-crafted for attack to have the properties that enable an attack, but we are not aware of specific examples (CVE-2019-10209). This update also fixes over 40 bugs that were reported in the last several months. See the upstream release notes for details. Affected Software/OS: 'postgresql9.4, postgresql9.6, postgresql11' package(s) on Mageia 6, Mageia 7. Solution: Please install the updated package(s). CVSS Score: 6.5 CVSS Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2019-10208 https://www.postgresql.org/about/news/1960/ SuSE Security Announcement: openSUSE-SU-2020:1227 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00043.html Common Vulnerability Exposure (CVE) ID: CVE-2019-10209
Copyright	Copyright (C) 2022 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.