CVE-2010-1447

Severity: high (CVSS 8.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2010-05-19 · updated 2026-06-16
Weakness: CWE-264

Description

The Safe (aka Safe.pm) module 2.26, and certain earlier versions, for Perl, as used in PostgreSQL 7.4 before 7.4.29, 8.0 before 8.0.25, 8.1 before 8.1.21, 8.2 before 8.2.17, 8.3 before 8.3.11, 8.4 before 8.4.4, and 9.0 Beta before 9.0 Beta 2, allows context-dependent attackers to bypass intended (1) Safe::reval and (2) Safe::rdo access restrictions, and inject and execute arbitrary code, via vectors involving subroutine references and delayed execution.

Affected products

PostgreSQL: 7.4, 7.4.1, 7.4.2, 7.4.3, 7.4.4, 7.4.5 (+104)

References

http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705
http://osvdb.org/64756
http://secunia.com/advisories/39845
http://secunia.com/advisories/40049
http://secunia.com/advisories/40052
http://security-tracker.debian.org/tracker/CVE-2010-1447
http://www.debian.org/security/2011/dsa-2267
http://www.mandriva.com/security/advisories?name=MDVSA-2010:115
http://www.mandriva.com/security/advisories?name=MDVSA-2010:116
http://www.openwall.com/lists/oss-security/2010/05/20/5
http://www.postgresql.org/about/news.1203
http://www.redhat.com/support/errata/RHSA-2010-0457.html

Get alerted when CVE-2010-1447 or the next vulnerability affects your stack