postgresql10-10.18-1.3 on GA media SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2024:11184 Final 1 1 2024-06-17T21:45:33Z current 2024-06-17T21:45:33Z 2024-06-17T21:45:33Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z postgresql10-10.18-1.3 on GA media These are all security issues fixed in the postgresql10-10.18-1.3 package on the GA media of openSUSE Tumbleweed. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). openSUSE-Tumbleweed-2024-11184 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) E-Mail link for openSUSE-SU-2024:11184 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://www.suse.com/security/cve/CVE-2017-15098/ SUSE CVE CVE-2017-15098 page https://www.suse.com/security/cve/CVE-2017-15099/ SUSE CVE CVE-2017-15099 page https://www.suse.com/security/cve/CVE-2018-1052/ SUSE CVE CVE-2018-1052 page https://www.suse.com/security/cve/CVE-2018-1053/ SUSE CVE CVE-2018-1053 page https://www.suse.com/security/cve/CVE-2018-1058/ SUSE CVE CVE-2018-1058 page https://www.suse.com/security/cve/CVE-2018-10915/ SUSE CVE CVE-2018-10915 page https://www.suse.com/security/cve/CVE-2018-10925/ SUSE CVE CVE-2018-10925 page https://www.suse.com/security/cve/CVE-2018-1115/ SUSE CVE CVE-2018-1115 page https://www.suse.com/security/cve/CVE-2018-16850/ SUSE CVE CVE-2018-16850 page https://www.suse.com/security/cve/CVE-2019-10130/ SUSE CVE CVE-2019-10130 page https://www.suse.com/security/cve/CVE-2019-10164/ SUSE CVE CVE-2019-10164 page https://www.suse.com/security/cve/CVE-2019-10208/ SUSE CVE CVE-2019-10208 page https://www.suse.com/security/cve/CVE-2020-14349/ SUSE CVE CVE-2020-14349 page https://www.suse.com/security/cve/CVE-2020-14350/ SUSE CVE CVE-2020-14350 page https://www.suse.com/security/cve/CVE-2020-1720/ SUSE CVE CVE-2020-1720 page https://www.suse.com/security/cve/CVE-2020-25694/ SUSE CVE CVE-2020-25694 page https://www.suse.com/security/cve/CVE-2020-25695/ SUSE CVE CVE-2020-25695 page https://www.suse.com/security/cve/CVE-2020-25696/ SUSE CVE CVE-2020-25696 page https://www.suse.com/security/cve/CVE-2021-32027/ SUSE CVE CVE-2021-32027 page https://www.suse.com/security/cve/CVE-2021-32028/ SUSE CVE CVE-2021-32028 page openSUSE Tumbleweed postgresql10-10.18-1.3 postgresql10-contrib-10.18-1.3 postgresql10-devel-10.18-1.3 postgresql10-docs-10.18-1.3 postgresql10-plperl-10.18-1.3 postgresql10-plpython-10.18-1.3 postgresql10-pltcl-10.18-1.3 postgresql10-server-10.18-1.3 postgresql10-test-10.18-1.3 postgresql10-10.18-1.3 as a component of openSUSE Tumbleweed postgresql10-contrib-10.18-1.3 as a component of openSUSE Tumbleweed postgresql10-devel-10.18-1.3 as a component of openSUSE Tumbleweed postgresql10-docs-10.18-1.3 as a component of openSUSE Tumbleweed postgresql10-plperl-10.18-1.3 as a component of openSUSE Tumbleweed postgresql10-plpython-10.18-1.3 as a component of openSUSE Tumbleweed postgresql10-pltcl-10.18-1.3 as a component of openSUSE Tumbleweed postgresql10-server-10.18-1.3 as a component of openSUSE Tumbleweed postgresql10-test-10.18-1.3 as a component of openSUSE Tumbleweed Invalid json_populate_recordset or jsonb_populate_recordset function calls in PostgreSQL 10.x before 10.1, 9.6.x before 9.6.6, 9.5.x before 9.5.10, 9.4.x before 9.4.15, and 9.3.x before 9.3.20 can crash the server or disclose a few bytes of server memory. CVE-2017-15098 openSUSE Tumbleweed:postgresql10-10.18-1.3 openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3 openSUSE Tumbleweed:postgresql10-devel-10.18-1.3 openSUSE Tumbleweed:postgresql10-docs-10.18-1.3 openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3 openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3 openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3 openSUSE Tumbleweed:postgresql10-server-10.18-1.3 openSUSE Tumbleweed:postgresql10-test-10.18-1.3 moderate 6.4 AV:N/AC:L/Au:N/C:P/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2017-15098.html CVE-2017-15098 https://bugzilla.suse.com/1067844 SUSE Bug 1067844 https://bugzilla.suse.com/1185814 SUSE Bug 1185814 INSERT ... ON CONFLICT DO UPDATE commands in PostgreSQL 10.x before 10.1, 9.6.x before 9.6.6, and 9.5.x before 9.5.10 disclose table contents that the invoker lacks privilege to read. These exploits affect only tables where the attacker lacks full read access but has both INSERT and UPDATE privileges. Exploits bypass row level security policies and lack of SELECT privilege. CVE-2017-15099 openSUSE Tumbleweed:postgresql10-10.18-1.3 openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3 openSUSE Tumbleweed:postgresql10-devel-10.18-1.3 openSUSE Tumbleweed:postgresql10-docs-10.18-1.3 openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3 openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3 openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3 openSUSE Tumbleweed:postgresql10-server-10.18-1.3 openSUSE Tumbleweed:postgresql10-test-10.18-1.3 moderate 4.3 AV:L/AC:L/Au:S/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2017-15099.html CVE-2017-15099 https://bugzilla.suse.com/1067841 SUSE Bug 1067841 Memory disclosure vulnerability in table partitioning was found in postgresql 10.x before 10.2, allowing an authenticated attacker to read arbitrary bytes of server memory via purpose-crafted insert to a partitioned table. CVE-2018-1052 openSUSE Tumbleweed:postgresql10-10.18-1.3 openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3 openSUSE Tumbleweed:postgresql10-devel-10.18-1.3 openSUSE Tumbleweed:postgresql10-docs-10.18-1.3 openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3 openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3 openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3 openSUSE Tumbleweed:postgresql10-server-10.18-1.3 openSUSE Tumbleweed:postgresql10-test-10.18-1.3 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2018-1052.html CVE-2018-1052 https://bugzilla.suse.com/1077983 SUSE Bug 1077983 https://bugzilla.suse.com/1080253 SUSE Bug 1080253 In postgresql 9.3.x before 9.3.21, 9.4.x before 9.4.16, 9.5.x before 9.5.11, 9.6.x before 9.6.7 and 10.x before 10.2, pg_upgrade creates file in current working directory containing the output of `pg_dumpall -g` under umask which was in effect when the user invoked pg_upgrade, and not under 0077 which is normally used for other temporary files. This can allow an authenticated attacker to read or modify the one file, which may contain encrypted or unencrypted database passwords. The attack is infeasible if a directory mode blocks the attacker searching the current working directory or if the prevailing umask blocks the attacker opening the file. CVE-2018-1053 openSUSE Tumbleweed:postgresql10-10.18-1.3 openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3 openSUSE Tumbleweed:postgresql10-devel-10.18-1.3 openSUSE Tumbleweed:postgresql10-docs-10.18-1.3 openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3 openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3 openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3 openSUSE Tumbleweed:postgresql10-server-10.18-1.3 openSUSE Tumbleweed:postgresql10-test-10.18-1.3 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2018-1053.html CVE-2018-1053 https://bugzilla.suse.com/1077983 SUSE Bug 1077983 https://bugzilla.suse.com/1185814 SUSE Bug 1185814 A flaw was found in the way Postgresql allowed a user to modify the behavior of a query for other users. An attacker with a user account could use this flaw to execute code with the permissions of superuser in the database. Versions 9.3 through 10 are affected. CVE-2018-1058 openSUSE Tumbleweed:postgresql10-10.18-1.3 openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3 openSUSE Tumbleweed:postgresql10-devel-10.18-1.3 openSUSE Tumbleweed:postgresql10-docs-10.18-1.3 openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3 openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3 openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3 openSUSE Tumbleweed:postgresql10-server-10.18-1.3 openSUSE Tumbleweed:postgresql10-test-10.18-1.3 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2018-1058.html CVE-2018-1058 https://bugzilla.suse.com/1081925 SUSE Bug 1081925 https://bugzilla.suse.com/1175193 SUSE Bug 1175193 https://bugzilla.suse.com/1175194 SUSE Bug 1175194 https://bugzilla.suse.com/1185814 SUSE Bug 1185814 A vulnerability was found in libpq, the default PostgreSQL client library where libpq failed to properly reset its internal state between connections. If an affected version of libpq was used with "host" or "hostaddr" connection parameters from untrusted input, attackers could bypass client-side connection security features, obtain access to higher privileged connections or potentially cause other impact through SQL injection, by causing the PQescape() functions to malfunction. Postgresql versions before 10.5, 9.6.10, 9.5.14, 9.4.19, and 9.3.24 are affected. CVE-2018-10915 openSUSE Tumbleweed:postgresql10-10.18-1.3 openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3 openSUSE Tumbleweed:postgresql10-devel-10.18-1.3 openSUSE Tumbleweed:postgresql10-docs-10.18-1.3 openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3 openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3 openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3 openSUSE Tumbleweed:postgresql10-server-10.18-1.3 openSUSE Tumbleweed:postgresql10-test-10.18-1.3 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2018-10915.html CVE-2018-10915 https://bugzilla.suse.com/1104199 SUSE Bug 1104199 https://bugzilla.suse.com/1140876 SUSE Bug 1140876 https://bugzilla.suse.com/1185814 SUSE Bug 1185814 It was discovered that PostgreSQL versions before 10.5, 9.6.10, 9.5.14, 9.4.19, and 9.3.24 failed to properly check authorization on certain statements involved with "INSERT ... ON CONFLICT DO UPDATE". An attacker with "CREATE TABLE" privileges could exploit this to read arbitrary bytes server memory. If the attacker also had certain "INSERT" and limited "UPDATE" privileges to a particular table, they could exploit this to update other columns in the same table. CVE-2018-10925 openSUSE Tumbleweed:postgresql10-10.18-1.3 openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3 openSUSE Tumbleweed:postgresql10-devel-10.18-1.3 openSUSE Tumbleweed:postgresql10-docs-10.18-1.3 openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3 openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3 openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3 openSUSE Tumbleweed:postgresql10-server-10.18-1.3 openSUSE Tumbleweed:postgresql10-test-10.18-1.3 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2018-10925.html CVE-2018-10925 https://bugzilla.suse.com/1104202 SUSE Bug 1104202 postgresql before versions 10.4, 9.6.9 is vulnerable in the adminpack extension, the pg_catalog.pg_logfile_rotate() function doesn't follow the same ACLs than pg_rorate_logfile. If the adminpack is added to a database, an attacker able to connect to it could exploit this to force log rotation. CVE-2018-1115 openSUSE Tumbleweed:postgresql10-10.18-1.3 openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3 openSUSE Tumbleweed:postgresql10-devel-10.18-1.3 openSUSE Tumbleweed:postgresql10-docs-10.18-1.3 openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3 openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3 openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3 openSUSE Tumbleweed:postgresql10-server-10.18-1.3 openSUSE Tumbleweed:postgresql10-test-10.18-1.3 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2018-1115.html CVE-2018-1115 https://bugzilla.suse.com/1091610 SUSE Bug 1091610 postgresql before versions 11.1, 10.6 is vulnerable to a to SQL injection in pg_upgrade and pg_dump via CREATE TRIGGER ... REFERENCING. Using a purpose-crafted trigger definition, an attacker can cause arbitrary SQL statements to run, with superuser privileges. CVE-2018-16850 openSUSE Tumbleweed:postgresql10-10.18-1.3 openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3 openSUSE Tumbleweed:postgresql10-devel-10.18-1.3 openSUSE Tumbleweed:postgresql10-docs-10.18-1.3 openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3 openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3 openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3 openSUSE Tumbleweed:postgresql10-server-10.18-1.3 openSUSE Tumbleweed:postgresql10-test-10.18-1.3 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2018-16850.html CVE-2018-16850 https://bugzilla.suse.com/1114837 SUSE Bug 1114837 A vulnerability was found in PostgreSQL versions 11.x up to excluding 11.3, 10.x up to excluding 10.8, 9.6.x up to, excluding 9.6.13, 9.5.x up to, excluding 9.5.17. PostgreSQL maintains column statistics for tables. Certain statistics, such as histograms and lists of most common values, contain values taken from the column. PostgreSQL does not evaluate row security policies before consulting those statistics during query planning; an attacker can exploit this to read the most common values of certain columns. Affected columns are those for which the attacker has SELECT privilege and for which, in an ordinary query, row-level security prunes the set of rows visible to the attacker. CVE-2019-10130 openSUSE Tumbleweed:postgresql10-10.18-1.3 openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3 openSUSE Tumbleweed:postgresql10-devel-10.18-1.3 openSUSE Tumbleweed:postgresql10-docs-10.18-1.3 openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3 openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3 openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3 openSUSE Tumbleweed:postgresql10-server-10.18-1.3 openSUSE Tumbleweed:postgresql10-test-10.18-1.3 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2019-10130.html CVE-2019-10130 https://bugzilla.suse.com/1134689 SUSE Bug 1134689 PostgreSQL versions 10.x before 10.9 and versions 11.x before 11.4 are vulnerable to a stack-based buffer overflow. Any authenticated user can overflow a stack-based buffer by changing the user's own password to a purpose-crafted value. This often suffices to execute arbitrary code as the PostgreSQL operating system account. CVE-2019-10164 openSUSE Tumbleweed:postgresql10-10.18-1.3 openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3 openSUSE Tumbleweed:postgresql10-devel-10.18-1.3 openSUSE Tumbleweed:postgresql10-docs-10.18-1.3 openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3 openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3 openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3 openSUSE Tumbleweed:postgresql10-server-10.18-1.3 openSUSE Tumbleweed:postgresql10-test-10.18-1.3 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2019-10164.html CVE-2019-10164 https://bugzilla.suse.com/1138034 SUSE Bug 1138034 A flaw was discovered in postgresql versions 9.4.x before 9.4.24, 9.5.x before 9.5.19, 9.6.x before 9.6.15, 10.x before 10.10 and 11.x before 11.5 where arbitrary SQL statements can be executed given a suitable SECURITY DEFINER function. An attacker, with EXECUTE permission on the function, can execute arbitrary SQL as the owner of the function. CVE-2019-10208 openSUSE Tumbleweed:postgresql10-10.18-1.3 openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3 openSUSE Tumbleweed:postgresql10-devel-10.18-1.3 openSUSE Tumbleweed:postgresql10-docs-10.18-1.3 openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3 openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3 openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3 openSUSE Tumbleweed:postgresql10-server-10.18-1.3 openSUSE Tumbleweed:postgresql10-test-10.18-1.3 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2019-10208.html CVE-2019-10208 https://bugzilla.suse.com/1145092 SUSE Bug 1145092 https://bugzilla.suse.com/1171566 SUSE Bug 1171566 It was found that PostgreSQL versions before 12.4, before 11.9 and before 10.14 did not properly sanitize the search_path during logical replication. An authenticated attacker could use this flaw in an attack similar to CVE-2018-1058, in order to execute arbitrary SQL command in the context of the user used for replication. CVE-2020-14349 openSUSE Tumbleweed:postgresql10-10.18-1.3 openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3 openSUSE Tumbleweed:postgresql10-devel-10.18-1.3 openSUSE Tumbleweed:postgresql10-docs-10.18-1.3 openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3 openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3 openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3 openSUSE Tumbleweed:postgresql10-server-10.18-1.3 openSUSE Tumbleweed:postgresql10-test-10.18-1.3 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2020-14349.html CVE-2020-14349 https://bugzilla.suse.com/1175193 SUSE Bug 1175193 https://bugzilla.suse.com/1176151 SUSE Bug 1176151 https://bugzilla.suse.com/1179499 SUSE Bug 1179499 https://bugzilla.suse.com/1179870 SUSE Bug 1179870 It was found that some PostgreSQL extensions did not use search_path safely in their installation script. An attacker with sufficient privileges could use this flaw to trick an administrator into executing a specially crafted script, during the installation or update of such extension. This affects PostgreSQL versions before 12.4, before 11.9, before 10.14, before 9.6.19, and before 9.5.23. CVE-2020-14350 openSUSE Tumbleweed:postgresql10-10.18-1.3 openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3 openSUSE Tumbleweed:postgresql10-devel-10.18-1.3 openSUSE Tumbleweed:postgresql10-docs-10.18-1.3 openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3 openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3 openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3 openSUSE Tumbleweed:postgresql10-server-10.18-1.3 openSUSE Tumbleweed:postgresql10-test-10.18-1.3 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2020-14350.html CVE-2020-14350 https://bugzilla.suse.com/1175194 SUSE Bug 1175194 https://bugzilla.suse.com/1176151 SUSE Bug 1176151 https://bugzilla.suse.com/1179115 SUSE Bug 1179115 https://bugzilla.suse.com/1179499 SUSE Bug 1179499 https://bugzilla.suse.com/1179870 SUSE Bug 1179870 A flaw was found in PostgreSQL's "ALTER ... DEPENDS ON EXTENSION", where sub-commands did not perform authorization checks. An authenticated attacker could use this flaw in certain configurations to perform drop objects such as function, triggers, et al., leading to database corruption. This issue affects PostgreSQL versions before 12.2, before 11.7, before 10.12 and before 9.6.17. CVE-2020-1720 openSUSE Tumbleweed:postgresql10-10.18-1.3 openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3 openSUSE Tumbleweed:postgresql10-devel-10.18-1.3 openSUSE Tumbleweed:postgresql10-docs-10.18-1.3 openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3 openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3 openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3 openSUSE Tumbleweed:postgresql10-server-10.18-1.3 openSUSE Tumbleweed:postgresql10-test-10.18-1.3 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2020-1720.html CVE-2020-1720 https://bugzilla.suse.com/1163985 SUSE Bug 1163985 A flaw was found in PostgreSQL versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20 and before 9.5.24. If a client application that creates additional database connections only reuses the basic connection parameters while dropping security-relevant parameters, an opportunity for a man-in-the-middle attack, or the ability to observe clear-text transmissions, could exist. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. CVE-2020-25694 openSUSE Tumbleweed:postgresql10-10.18-1.3 openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3 openSUSE Tumbleweed:postgresql10-devel-10.18-1.3 openSUSE Tumbleweed:postgresql10-docs-10.18-1.3 openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3 openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3 openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3 openSUSE Tumbleweed:postgresql10-server-10.18-1.3 openSUSE Tumbleweed:postgresql10-test-10.18-1.3 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2020-25694.html CVE-2020-25694 https://bugzilla.suse.com/1178667 SUSE Bug 1178667 https://bugzilla.suse.com/1179870 SUSE Bug 1179870 A flaw was found in PostgreSQL versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20 and before 9.5.24. An attacker having permission to create non-temporary objects in at least one schema can execute arbitrary SQL functions under the identity of a superuser. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. CVE-2020-25695 openSUSE Tumbleweed:postgresql10-10.18-1.3 openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3 openSUSE Tumbleweed:postgresql10-devel-10.18-1.3 openSUSE Tumbleweed:postgresql10-docs-10.18-1.3 openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3 openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3 openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3 openSUSE Tumbleweed:postgresql10-server-10.18-1.3 openSUSE Tumbleweed:postgresql10-test-10.18-1.3 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2020-25695.html CVE-2020-25695 https://bugzilla.suse.com/1178666 SUSE Bug 1178666 A flaw was found in the psql interactive terminal of PostgreSQL in versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20 and before 9.5.24. If an interactive psql session uses \gset when querying a compromised server, the attacker can execute arbitrary code as the operating system account running psql. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. CVE-2020-25696 openSUSE Tumbleweed:postgresql10-10.18-1.3 openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3 openSUSE Tumbleweed:postgresql10-devel-10.18-1.3 openSUSE Tumbleweed:postgresql10-docs-10.18-1.3 openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3 openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3 openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3 openSUSE Tumbleweed:postgresql10-server-10.18-1.3 openSUSE Tumbleweed:postgresql10-test-10.18-1.3 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2020-25696.html CVE-2020-25696 https://bugzilla.suse.com/1178668 SUSE Bug 1178668 https://bugzilla.suse.com/1179870 SUSE Bug 1179870 A flaw was found in postgresql in versions before 13.3, before 12.7, before 11.12, before 10.17 and before 9.6.22. While modifying certain SQL array values, missing bounds checks let authenticated database users write arbitrary bytes to a wide area of server memory. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. CVE-2021-32027 openSUSE Tumbleweed:postgresql10-10.18-1.3 openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3 openSUSE Tumbleweed:postgresql10-devel-10.18-1.3 openSUSE Tumbleweed:postgresql10-docs-10.18-1.3 openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3 openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3 openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3 openSUSE Tumbleweed:postgresql10-server-10.18-1.3 openSUSE Tumbleweed:postgresql10-test-10.18-1.3 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2021-32027.html CVE-2021-32027 https://bugzilla.suse.com/1185924 SUSE Bug 1185924 A flaw was found in postgresql. Using an INSERT ... ON CONFLICT ... DO UPDATE command on a purpose-crafted table, an authenticated database user could read arbitrary bytes of server memory. The highest threat from this vulnerability is to data confidentiality. CVE-2021-32028 openSUSE Tumbleweed:postgresql10-10.18-1.3 openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3 openSUSE Tumbleweed:postgresql10-devel-10.18-1.3 openSUSE Tumbleweed:postgresql10-docs-10.18-1.3 openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3 openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3 openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3 openSUSE Tumbleweed:postgresql10-server-10.18-1.3 openSUSE Tumbleweed:postgresql10-test-10.18-1.3 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2021-32028.html CVE-2021-32028 https://bugzilla.suse.com/1185925 SUSE Bug 1185925