CVE-2014-0067
Fixed in a distro release EPSS <1%
The "make check" command for the test suites in PostgreSQL 9.3.3 and earlier does not properly invoke initdb to specify the authentication requirements for a database cluster to be used for the tests, which allows local users to gain privileges by leveraging access to this cluster.
Products: apple mac_os_x, apple mac_os_x_server, postgresql
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 6.0 | postgresql-8.4 | 8.4.22-0+deb6u1 |
| Debian 6.0 | postgresql-8.4 | 8.4.20-0squeeze1 |
| Debian 7 | postgresql-9.1 | 9.1.12-0wheezy1 |
| Ubuntu 14.04 LTS | postgresql-9.1 | 9.1.15-0ubuntu0.14.04 |
| Ubuntu 14.04 LTS | postgresql-9.3 | 9.3.5-0ubuntu0.14.04.1 |
| openSUSE Tumbleweed | postgresql93 | 9.3.15-1.1 |
| openSUSE Tumbleweed | postgresql94 | 9.4.10-1.1 |
| openSUSE Tumbleweed | postgresql95 | 9.5.4-1.2 |