CVE-2021-32027

Name	CVE-2021-32027
Description	A flaw was found in postgresql in versions before 13.3, before 12.7, before 11.12, before 10.17 and before 9.6.22. While modifying certain SQL array values, missing bounds checks let authenticated database users write arbitrary bytes to a wide area of server memory. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-2662-1, DSA-4915-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
postgresql-13 (PTS)	bullseye	13.16-0+deb11u1	fixed
	bullseye (security)	13.18-0+deb11u1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin
postgresql-11	source	buster	11.12-0+deb10u1	DSA-4915-1
postgresql-11	source	(unstable)	(unfixed)
postgresql-13	source	(unstable)	13.3-1
postgresql-9.6	source	stretch	9.6.22-0+deb9u1	DLA-2662-1
postgresql-9.6	source	(unstable)	(unfixed)

Notes

https://www.postgresql.org/about/news/postgresql-133-127-1112-1017-and-9622-released-2210/
https://git.postgresql.org/gitweb/?p=postgresql.git;a=commit;h=467395bfdf33f1ccf67ca388ffdcc927271544cb (REL_13_3)