CVE-2007-0556

Severity: medium (CVSS 6.6 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2007-02-06 · updated 2026-06-16

Description

The query planner in PostgreSQL before 8.0.11, 8.1 before 8.1.7, and 8.2 before 8.2.2 does not verify that a table is compatible with a "previously made query plan," which allows remote authenticated users to cause a denial of service (server crash) and possibly access database content via an "ALTER COLUMN TYPE" SQL statement, which can be leveraged to read arbitrary memory from the server.

Affected products

PostgreSQL: 1.0, 1.01, 1.02, 1.09, 6.0, 6.1 (+86)

References

http://fedoranews.org/cms/node/2554
http://lists.rpath.com/pipermail/security-announce/2007-February/000141.html
http://osvdb.org/33302
http://secunia.com/advisories/24028
http://secunia.com/advisories/24033
http://secunia.com/advisories/24042
http://secunia.com/advisories/24050
http://secunia.com/advisories/24057
http://secunia.com/advisories/24151
http://secunia.com/advisories/24315
http://secunia.com/advisories/24513
http://secunia.com/advisories/24577

Get alerted when CVE-2007-0556 or the next vulnerability affects your stack