CVE-2010-1447

PostgreSQL 7.4-8.4 and 9.0 Beta - Remote Code Execution via Safe.pm Subroutine Reference Injection

Title source: llm
STIX 2.1

Description

The Safe (aka Safe.pm) module 2.26, and certain earlier versions, for Perl, as used in PostgreSQL 7.4 before 7.4.29, 8.0 before 8.0.25, 8.1 before 8.1.21, 8.2 before 8.2.17, 8.3 before 8.3.11, 8.4 before 8.4.4, and 9.0 Beta before 9.0 Beta 2, allows context-dependent attackers to bypass intended (1) Safe::reval and (2) Safe::rdo access restrictions, and inject and execute arbitrary code, via vectors involving subroutine references and delayed execution.

References (20)

Core 20
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/40305
Vendor Advisory vendor-advisory x_refsource_mandriva
http://www.mandriva.com/security/advisories?name=MDVSA-2010:115
Third Party Advisory vendor-advisory x_refsource_debian
http://www.debian.org/security/2011/dsa-2267
Third Party Advisory x_refsource_confirm
http://security-tracker.debian.org/tracker/CVE-2010-1447
Third Party Advisory, VDB Entry vdb-entry signature x_refsource_oval
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7320
Various Sources x_refsource_confirm
http://www.postgresql.org/about/news.1203
Patch, Vendor Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2010/1167
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/39845
Third Party Advisory, VDB Entry vdb-entry signature x_refsource_oval
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11530
Issue Tracking x_refsource_confirm
https://bugs.launchpad.net/bugs/cve/2010-1447
Third Party Advisory, VDB Entry vdb-entry x_refsource_osvdb
http://osvdb.org/64756
Vendor Advisory vendor-advisory x_refsource_redhat
http://www.redhat.com/support/errata/RHSA-2010-0457.html
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/40049
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/40052
Vendor Advisory vendor-advisory x_refsource_redhat
http://www.redhat.com/support/errata/RHSA-2010-0458.html
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id?1023988
Mailing List mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2010/05/20/5
Issue Tracking x_refsource_confirm
https://bugzilla.redhat.com/show_bug.cgi?id=588269
Vendor Advisory vendor-advisory x_refsource_mandriva
http://www.mandriva.com/security/advisories?name=MDVSA-2010:116

Scores

EPSS 0.0045
EPSS Percentile 64.0%

Details

CWE
CWE-264
Status published
Products (50)
postgresql/postgresql 7.4
postgresql/postgresql 7.4.1
postgresql/postgresql 7.4.2
postgresql/postgresql 7.4.3
postgresql/postgresql 7.4.4
postgresql/postgresql 7.4.5
postgresql/postgresql 7.4.6
postgresql/postgresql 7.4.7
postgresql/postgresql 7.4.8
postgresql/postgresql 7.4.9
... and 40 more
Published May 19, 2010
Tracked Since Feb 18, 2026