CVE-2016-7048

HIGH

PostgreSQL < 9.1.24 - Remote Code Execution via Interactive Installer HTTP Download

Title source: llm

Description

The interactive installer in PostgreSQL before 9.3.15, 9.4.x before 9.4.10, and 9.5.x before 9.5.5 might allow remote attackers to execute arbitrary code by leveraging use of HTTP to download software.

References (2)

Core 2

Core References

Issue Tracking, Third Party Advisory x_refsource_confirm

https://bugzilla.redhat.com/show_bug.cgi?id=1378043

Patch, Vendor Advisory x_refsource_confirm

https://www.postgresql.org/support/security/

Scores

CVSS v3 8.1

EPSS 0.1206

EPSS Percentile 93.9%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE

CWE-284

Status published

Products (1)

postgresql/postgresql < 9.1.24

Published Aug 20, 2018

Tracked Since Feb 18, 2026