| Name | CVE-2018-1058 |
| Description | A flaw was found in the way Postgresql allowed a user to modify the behavior of a query for other users. An attacker with a user account could use this flaw to execute code with the permissions of superuser in the database. Versions 9.3 through 10 are affected. |
| Source | CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
The information below is based on the following data on fixed versions.
| Package | Type | Release | Fixed Version | Urgency | Origin | Debian Bugs |
|---|---|---|---|---|---|---|
| postgresql-10 | source | (unstable) | 10.3-1 | |||
| postgresql-9.1 | source | jessie | (not affected) | |||
| postgresql-9.1 | source | (unstable) | (unfixed) | |||
| postgresql-9.4 | source | jessie | 9.4.17-0+deb8u1 | |||
| postgresql-9.4 | source | (unstable) | (unfixed) | |||
| postgresql-9.6 | source | stretch | 9.6.8-0+deb9u1 | |||
| postgresql-9.6 | source | (unstable) | (unfixed) |
[jessie] - postgresql-9.1 <not-affected> (postgresql-9.1 in jessie is PL/Perl only)
[wheezy] - postgresql-9.1 <no-dsa> (Minor issue)
https://git.postgresql.org/gitweb/?p=postgresql.git;a=commit;h=3d2aed664ee8271fd6c721ed0aa10168cda112ea
https://git.postgresql.org/gitweb/?p=postgresql.git;a=commit;h=582edc369cdbd348d68441fc50fa26a84afd0c1a
https://git.postgresql.org/gitweb/?p=postgresql.git;a=commit;h=5770172cb0c9df9e6ce27c507b449557e5b45124