The regular expression parser in TCL before 8.4.17, as used in PostgreSQL 8.2 before 8.2.6, 8.1 before 8.1.11, 8.0 before 8.0.15, and 7.4 before 7.4.19, allows remote authenticated users to cause a denial of service (backend crash) via an out-of-bounds backref number.

Metrics

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication Single

Confidentiality Impact None

Integrity Impact None

Availability Impact Complete

This CVE is not in the KEV list.

The EPSS score is 0.01079.

Key SSVC decision points have not yet been added.

Affected Vendors & Products

Vendors Products
Postgresql
  • Postgresql
Redhat
  • Enterprise Linux
  • Rhel Application Stack
Tcl Tk
  • Tcl Tk

Configuration 1 [-]

OR cpe:2.3:a:postgresql:postgresql:7.3:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:7.3.1:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:7.3.2:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:7.3.3:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:7.3.4:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:7.3.6:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:7.3.8:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:7.3.9:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:7.3.10:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:7.3.11:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:7.3.12:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:7.3.13:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:7.3.14:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:7.3.15:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:7.3.16:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:7.3.19:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:7.4:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:7.4.1:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:7.4.2:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:7.4.3:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:7.4.4:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:7.4.5:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:7.4.6:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:7.4.7:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:7.4.8:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:7.4.9:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:7.4.10:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:7.4.11:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:7.4.12:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:7.4.13:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:7.4.14:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:7.4.16:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:7.4.17:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:8.0:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:8.0.1:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:8.0.2:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:8.0.3:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:8.0.4:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:8.0.5:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:8.0.7:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:8.0.8:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:8.0.9:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:8.0.11:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:8.0.13:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:8.0.317:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:8.1.1:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:8.1.3:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:8.1.4:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:8.1.5:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:8.1.7:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:8.1.8:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:8.1.9:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:8.2:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:8.2.2:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:8.2.3:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:8.2.4:*:*:*:*:*:*:*
cpe:2.3:a:tcl_tk:tcl_tk:*:*:*:*:*:*:*:*
Package CPE Advisory Released Date
Red Hat Enterprise Linux 4
postgresql-0:7.4.19-1.el4_6.1 cpe:/o:redhat:enterprise_linux:4 RHSA-2008:0038 2008-01-11T00:00:00Z
Red Hat Enterprise Linux 5
postgresql-0:8.1.11-1.el5_1.1 cpe:/o:redhat:enterprise_linux:5 RHSA-2008:0038 2008-01-11T00:00:00Z
Red Hat Web Application Stack for RHEL 4
postgresql-0:8.1.11-1.el4s1.1 cpe:/a:redhat:rhel_application_stack:1 RHSA-2008:0040 2008-02-01T00:00:00Z

No data.

Advisories
Source ID Title
Debian DSA Debian DSA DSA-1460-1 New postgresql-8.1 packages fix several vulnerabilities
Debian DSA Debian DSA DSA-1463-1 New postgresql-7.4 packages fix several vulnerabilities
EUVD EUVD EUVD-2007-4750 The regular expression parser in TCL before 8.4.17, as used in PostgreSQL 8.2 before 8.2.6, 8.1 before 8.1.11, 8.0 before 8.0.15, and 7.4 before 7.4.19, allows remote authenticated users to cause a denial of service (backend crash) via an out-of-bounds backref number.
Ubuntu USN Ubuntu USN USN-568-1 PostgreSQL vulnerabilities
Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01420154 cve-icon cve-icon
http://lists.opensuse.org/opensuse-security-announce/2008-02/msg00000.html cve-icon cve-icon
http://secunia.com/advisories/28359 cve-icon cve-icon
http://secunia.com/advisories/28376 cve-icon cve-icon
http://secunia.com/advisories/28437 cve-icon cve-icon
http://secunia.com/advisories/28438 cve-icon cve-icon
http://secunia.com/advisories/28454 cve-icon cve-icon
http://secunia.com/advisories/28455 cve-icon cve-icon
http://secunia.com/advisories/28464 cve-icon cve-icon
http://secunia.com/advisories/28477 cve-icon cve-icon
http://secunia.com/advisories/28479 cve-icon cve-icon
http://secunia.com/advisories/28679 cve-icon cve-icon
http://secunia.com/advisories/28698 cve-icon cve-icon
http://secunia.com/advisories/29638 cve-icon cve-icon
http://security.gentoo.org/glsa/glsa-200801-15.xml cve-icon cve-icon
http://securitytracker.com/id?1019157 cve-icon cve-icon
http://sourceforge.net/project/shownotes.php?release_id=565440&group_id=10894 cve-icon cve-icon
http://sourceforge.net/tracker/index.php?func=detail&aid=1810264&group_id=10894&atid=110894 cve-icon cve-icon
http://sunsolve.sun.com/search/document.do?assetkey=1-26-103197-1 cve-icon cve-icon
http://sunsolve.sun.com/search/document.do?assetkey=1-66-200559-1 cve-icon cve-icon
http://www.debian.org/security/2008/dsa-1460 cve-icon cve-icon
http://www.debian.org/security/2008/dsa-1463 cve-icon cve-icon
http://www.mandriva.com/security/advisories?name=MDVSA-2008:004 cve-icon cve-icon
http://www.postgresql.org/about/news.905 cve-icon cve-icon
http://www.redhat.com/support/errata/RHSA-2008-0038.html cve-icon cve-icon
http://www.redhat.com/support/errata/RHSA-2008-0040.html cve-icon cve-icon
http://www.securityfocus.com/archive/1/485864/100/0/threaded cve-icon cve-icon
http://www.securityfocus.com/archive/1/486407/100/0/threaded cve-icon cve-icon
http://www.securityfocus.com/bid/27163 cve-icon cve-icon
http://www.vupen.com/english/advisories/2008/0061 cve-icon cve-icon
http://www.vupen.com/english/advisories/2008/0109 cve-icon cve-icon
http://www.vupen.com/english/advisories/2008/1071/references cve-icon cve-icon
https://exchange.xforce.ibmcloud.com/vulnerabilities/39499 cve-icon cve-icon
https://issues.rpath.com/browse/RPL-1768 cve-icon cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2007-4769 cve-icon
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9804 cve-icon cve-icon
https://usn.ubuntu.com/568-1/ cve-icon cve-icon
https://www.cve.org/CVERecord?id=CVE-2007-4769 cve-icon
https://www.redhat.com/archives/fedora-package-announce/2008-January/msg00397.html cve-icon cve-icon
https://www.redhat.com/archives/fedora-package-announce/2008-January/msg00469.html cve-icon cve-icon
History

No history.

cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published:

Updated: 2024-08-07T15:08:33.721Z

Reserved: 2007-09-10T00:00:00

Link: CVE-2007-4769

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2008-01-09T21:46:00.000

Modified: 2025-04-09T00:30:58.490

Link: CVE-2007-4769

cve-icon Redhat

Severity : Moderate

Publid Date: 2008-01-07T00:00:00Z

Links: CVE-2007-4769 - Bugzilla

cve-icon OpenCVE Enrichment

No data.