GCVE - cpe:2.3:a:postgresql:postgresql:9.2.17:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:postgresql:postgresql:9.2.17:*:*:*:*:*:*:*

part: a version: 9.2.17 update: *

Vendor	Postgresql (`17ae1743-f0f5-50ae-b0e9-670248233cae`)
Product	Postgresql (`cce58cf9-95f4-56e0-85d7-e79aa6a78bc7`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:deb/debian/postgresql`	purl2cpe	2026-06-01 10:12:17.143574
`pkg:deb/ubuntu/postgresql`	purl2cpe	2026-06-01 10:12:17.143575
`pkg:docker/postgres`	purl2cpe	2026-06-01 10:12:17.143576
`pkg:github/postgres/postgres`	purl2cpe	2026-06-01 10:12:17.143578
`pkg:gitlab/redhat/postgresql`	purl2cpe	2026-06-01 10:12:17.143579
`pkg:rpm/fedora/postgresql`	purl2cpe	2026-06-01 10:12:17.143580

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2017-7547`	vulnerable	2026-06-08 05:09:56.502773	Details available PostgreSQL versions before 9.2.22, 9.3.18, 9.4.13, 9.5.8 and 9.6.4 are vulnerable to authorization flaw allowing remote authenticated attackers to retrieve passwords from the user mappings defined by the foreign server owners without actually having the privileges to do so. Published: 2017-08-16T18:00:00.000Z Updated: 2024-09-16T23:41:38.650Z Open on db.gcve.eu Reference links https://access.redhat.com/errata/RHSA-2017:2728 http://www.debian.org/security/2017/dsa-3936 https://access.redhat.com/errata/RHSA-2017:2678 http://www.debian.org/security/2017/dsa-3935 http://www.securitytracker.com/id/1039142	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2017-7546`	vulnerable	2026-06-08 05:09:56.493284	Details available PostgreSQL versions before 9.2.22, 9.3.18, 9.4.13, 9.5.8 and 9.6.4 are vulnerable to incorrect authentication flaw allowing remote attackers to gain access to database accounts with an empty password. Published: 2017-08-16T18:00:00.000Z Updated: 2024-09-16T17:18:53.123Z Open on db.gcve.eu Reference links https://access.redhat.com/errata/RHSA-2017:2728 http://www.debian.org/security/2017/dsa-3936 https://access.redhat.com/errata/RHSA-2017:2678 https://access.redhat.com/errata/RHSA-2017:2860 http://www.securityfocus.com/bid/100278	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2017-7486`	vulnerable	2026-06-08 05:09:56.139922	Details available PostgreSQL versions 8.4 - 9.6 are vulnerable to information leak in pg_user_mappings view which discloses foreign server passwords to any user having USAGE privilege on the associated foreign server. Published: 2017-05-12T19:00:00.000Z Updated: 2024-08-05T16:04:11.547Z Open on db.gcve.eu Reference links http://www.securitytracker.com/id/1038476 http://www.debian.org/security/2017/dsa-3851 https://access.redhat.com/errata/RHSA-2017:2425 https://access.redhat.com/errata/RHSA-2017:1678 https://access.redhat.com/errata/RHSA-2017:1677	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2017-12172`	vulnerable	2026-06-08 05:08:45.453895	Details available PostgreSQL 10.x before 10.1, 9.6.x before 9.6.6, 9.5.x before 9.5.10, 9.4.x before 9.4.15, 9.3.x before 9.3.20, and 9.2.x before 9.2.24 runs under a non-root operating system account, and database superusers have effective ability to run arbitrary code under that system account. PostgreSQL provides a script for starting the database server during system boot. Packages of PostgreSQL for many operating systems provide their own, packager-authored startup implementations. Several implementations use a log file name that the database superuser can replace with a symbolic link. As root, they open(), chmod() and/or chown() this log file name. This often suffices for the database superuser to escalate to root privileges when root starts the server. Published: 2017-11-22T19:00:00.000Z Updated: 2024-09-16T22:20:22.695Z Open on db.gcve.eu Reference links https://access.redhat.com/errata/RHSA-2017:3402 http://www.securityfocus.com/bid/101949 https://access.redhat.com/errata/RHSA-2017:3403 https://access.redhat.com/errata/RHSA-2017:3405 https://www.postgresql.org/support/security/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2016-5424`	vulnerable	2026-06-08 05:07:57.001917	Details available PostgreSQL before 9.1.23, 9.2.x before 9.2.18, 9.3.x before 9.3.14, 9.4.x before 9.4.9, and 9.5.x before 9.5.4 might allow remote authenticated users with the CREATEDB or CREATEROLE role to gain superuser privileges via a (1) " (double quote), (2) \ (backslash), (3) carriage return, or (4) newline character in a (a) database or (b) role name that is mishandled during an administrative operation. Published: 2016-12-09T23:00:00.000Z Updated: 2024-08-06T01:00:59.909Z Open on db.gcve.eu Reference links http://rhn.redhat.com/errata/RHSA-2016-1781.html https://www.postgresql.org/docs/current/static/release-9-4-9.html http://www.securitytracker.com/id/1036617 http://rhn.redhat.com/errata/RHSA-2016-1821.html http://www.debian.org/security/2016/dsa-3646	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2016-5423`	vulnerable	2026-06-08 05:07:56.987033	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.