Buffer overflow in gram.y for PostgreSQL 8.0.0 and earlier may allow attackers to execute arbitrary code via a large number of arguments to

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• postgresql postgresql7.3 and later · before 7.3.10
• postgresql postgresql7.4 and later · before 7.4.7
• postgresql postgresql8.0

Package-level exposure

OSV and GitHub Advisory data: ecosystem, package and range. SBOM matching uses this table.

Other highest-scoring records for the same primary product.

• CVE-2017-7546PostgreSQL versions before 9.2.22, 9.3.18, 9.4.13, 9.5.8 and 9.6.4 are vulnerable to incorrect authentication flaw allowing remote attackers
  57Plan
• CVE-2019-9193In PostgreSQL 9.3 through 11.2, the "COPY TO/FROM PROGRAM" function allows superusers and users in the 'pg_execute_server_program' group to
  55Plan
• CVE-2020-25695A flaw was found in PostgreSQL versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20 and before 9.5.24.
  49Plan
• CVE-2007-3280The Database Link library (dblink) in PostgreSQL 8.1 implements functions via CREATE statements that map to arbitrary libraries based on the
  44Plan
• CVE-2013-1899Argument injection vulnerability in PostgreSQL 9.2.x before 9.2.4, 9.1.x before 9.1.9, and 9.0.x before 9.0.13 allows remote attackers to ca
  42Plan
• CVE-2018-16850postgresql before versions 11.1, 10.6 is vulnerable to a to SQL injection in pg_upgrade and pg_dump via CREATE TRIGGER ...
  41Plan

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.

MITRE has no CAPEC/ATT&CK mapping for this CWE.