CVE-2015-0241 — postgresql: buffer overflow in the to_char() function

Back Back to CVE browser

HIGH

postgresql: buffer overflow in the to_char() function

Published Jan 27, 2020

8.8

HIGH

CVSS 3.1

EPSS 5.53%

Description

The to_char function in PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1 allows remote authenticated users to cause a denial of service (crash) or possibly execute arbitrary code via a (1) large number of digits when processing a numeric formatting template, which triggers a buffer over-read, or (2) crafted timestamp formatting template, which triggers a buffer overflow.

Affected products

Vendor PostgreSQL Global Development Group Product PostgreSQL Default
n/a
- Version
  9.1.x before 9.1.15
  Status
  affected
  Constraints
  -
- Version
  9.2.x before 9.2.10
  Status
  affected
  Constraints
  -
- Version
  9.3.x before 9.3.6
  Status
  affected
  Constraints
  -
- Version
  9.4.x before 9.4.1
  Status
  affected
  Constraints
  -
- Version
  before 9.0.19
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

PostgreSQL Global Development Group

PostgreSQL

n/a

Version	Status	Constraints
9.1.x before 9.1.15	affected	-
9.2.x before 9.2.10	affected	-
9.3.x before 9.3.6	affected	-
9.4.x before 9.4.1	affected	-
before 9.0.19	affected	-

Red Hat Enterprise Linux 6

postgresql-0:8.4.20-2.el6_6

Fixed · RHSA-2015:0750
Red Hat Enterprise Linux 7

postgresql-0:9.2.10-2.ael7b_1

Fixed · RHSA-2015:0750
Red Hat Satellite 5.7

postgresql92-postgresql-0:9.2.10-2.el6

Fixed · RHSA-2015:0856
Red Hat Satellite 5.7

postgresql92-postgresql-0:9.2.10-2.el6

Fixed · RHSA-2015:0856
Red Hat Software Collections 1 for Red Hat Enterprise Linux 6

postgresql92-postgresql-0:9.2.10-2.el6

Fixed · RHSA-2015:0699
Red Hat Software Collections 1 for Red Hat Enterprise Linux 6.5 EUS

postgresql92-postgresql-0:9.2.10-2.el6

Fixed · RHSA-2015:0699
Red Hat Software Collections 1 for Red Hat Enterprise Linux 6.6 EUS

postgresql92-postgresql-0:9.2.10-2.el6

Fixed · RHSA-2015:0699
Red Hat Software Collections 1 for Red Hat Enterprise Linux 7

postgresql92-postgresql-0:9.2.10-1.el7

Fixed · RHSA-2015:0699
CloudForms Management Engine 5

postgresql

Will not fix
CloudForms Management Engine 5

postgresql92-postgresql

Will not fix
Red Hat Enterprise Linux 5

postgresql

Will not fix
Red Hat Enterprise Linux 5

postgresql84

Will not fix
Red Hat Software Collections

rh-postgresql94-postgresql

Affected

Product	Package	State	Advisory
Red Hat Enterprise Linux 6	postgresql-0:8.4.20-2.el6_6	Fixed	RHSA-2015:0750
Red Hat Enterprise Linux 7	postgresql-0:9.2.10-2.ael7b_1	Fixed	RHSA-2015:0750
Red Hat Satellite 5.7	postgresql92-postgresql-0:9.2.10-2.el6	Fixed	RHSA-2015:0856
Red Hat Satellite 5.7	postgresql92-postgresql-0:9.2.10-2.el6	Fixed	RHSA-2015:0856
Red Hat Software Collections 1 for Red Hat Enterprise Linux 6	postgresql92-postgresql-0:9.2.10-2.el6	Fixed	RHSA-2015:0699
Red Hat Software Collections 1 for Red Hat Enterprise Linux 6.5 EUS	postgresql92-postgresql-0:9.2.10-2.el6	Fixed	RHSA-2015:0699
Red Hat Software Collections 1 for Red Hat Enterprise Linux 6.6 EUS	postgresql92-postgresql-0:9.2.10-2.el6	Fixed	RHSA-2015:0699
Red Hat Software Collections 1 for Red Hat Enterprise Linux 7	postgresql92-postgresql-0:9.2.10-1.el7	Fixed	RHSA-2015:0699
CloudForms Management Engine 5	postgresql	Will not fix	n/a
CloudForms Management Engine 5	postgresql92-postgresql	Will not fix	n/a
Red Hat Enterprise Linux 5	postgresql	Will not fix	n/a
Red Hat Enterprise Linux 5	postgresql84	Will not fix	n/a
Red Hat Software Collections	rh-postgresql94-postgresql	Affected	n/a

Remediation

No remediation recorded yet.

Metrics

5.53% 0.05533

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.05533

Score over time

2022–2026

EPSS v2
EPSS v3
EPSS v4
EPSS v5

Percentile over time

EPSS v2
EPSS v3
EPSS v4
EPSS v5

Table of values (19 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	5.53% (0.05533)	92.57th	v5 (v2026.06.15)
Jun 15, 2026	5.53% (0.05533)	91.79th	v5 (v2026.06.15)
Jun 13, 2026	5.13% (0.05131)	90.11th	v4 (v2025.03.14)
Dec 3, 2025	6.69% (0.06686)	90.93th	v4 (v2025.03.14)
Mar 30, 2025	2.76% (0.02758)	84.73th	v4 (v2025.03.14)
Mar 29, 2025	8.29% (0.08285)	86.83th	v4 (v2025.03.14)
Mar 17, 2025	2.76% (0.02758)	85.05th	v4 (v2025.03.14)
Dec 12, 2024	0.32% (0.00316)	71.22th	v3 (v2023.03.01)
Feb 8, 2024	0.32% (0.00316)	69.54th	v3 (v2023.03.01)
Jul 19, 2023	0.32% (0.00316)	66.33th	v3 (v2023.03.01)
Jun 16, 2023	0.33% (0.00328)	66.72th	v3 (v2023.03.01)
Jun 13, 2023	0.37% (0.00371)	68.72th	v3 (v2023.03.01)
Jun 1, 2023	0.71% (0.00714)	77.71th	v3 (v2023.03.01)
Apr 30, 2023	0.63% (0.00626)	75.87th	v3 (v2023.03.01)
Mar 7, 2023	0.77% (0.00765)	78.35th	v3 (v2023.03.01)
Mar 6, 2023	51.92% (0.51922)	98.75th	v2 (v2022.01.01)
Feb 14, 2023	51.92% (0.51922)	98.74th	v2 (v2022.01.01)
Apr 1, 2022	4.07% (0.04069)	84.57th	v2 (v2022.01.01)
Feb 4, 2022	4.07% (0.04069)	68.02th	v2 (v2022.01.01)

Weaknesses (2)

CWE-120

Classic Buffer Overflow

CWE-122

References (11)

http://www.debian.org/security/2015/dsa-3155
x_refsource_CONFIRMThird Party Advisory
http://www.postgresql.org/about/news/1569/
x_refsource_CONFIRMVendor Advisory
http://www.postgresql.org/docs/9.4/static/release-9-4-1.html
x_refsource_CONFIRMRelease NotesVendor Advisory
http://www.postgresql.org/docs/current/static/release-9-0-19.html
x_refsource_CONFIRMRelease NotesVendor Advisory
http://www.postgresql.org/docs/current/static/release-9-1-15.html
x_refsource_CONFIRMRelease NotesVendor Advisory
http://www.postgresql.org/docs/current/static/release-9-2-10.html
x_refsource_CONFIRMRelease NotesVendor Advisory
http://www.postgresql.org/docs/current/static/release-9-3-6.html
x_refsource_CONFIRMRelease NotesVendor Advisory
https://access.redhat.com/security/cve/CVE-2015-0241
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1188684
Issue Tracking
https://nvd.nist.gov/vuln/detail/CVE-2015-0241
https://www.cve.org/CVERecord?id=CVE-2015-0241

Link	Providers	Tags
http://www.debian.org/security/2015/dsa-3155		x_refsource_CONFIRMThird Party Advisory
http://www.postgresql.org/about/news/1569/		x_refsource_CONFIRMVendor Advisory
http://www.postgresql.org/docs/9.4/static/release-9-4-1.html		x_refsource_CONFIRMRelease NotesVendor Advisory
http://www.postgresql.org/docs/current/static/release-9-0-19.html		x_refsource_CONFIRMRelease NotesVendor Advisory
http://www.postgresql.org/docs/current/static/release-9-1-15.html		x_refsource_CONFIRMRelease NotesVendor Advisory
http://www.postgresql.org/docs/current/static/release-9-2-10.html		x_refsource_CONFIRMRelease NotesVendor Advisory
http://www.postgresql.org/docs/current/static/release-9-3-6.html		x_refsource_CONFIRMRelease NotesVendor Advisory
https://access.redhat.com/security/cve/CVE-2015-0241		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1188684		Issue Tracking
https://nvd.nist.gov/vuln/detail/CVE-2015-0241
https://www.cve.org/CVERecord?id=CVE-2015-0241