CVE-2010-0442
CVE-2010-0442 is a medium-severity vulnerability in Postgresql with a CVSS 2.0 base score of 6.5. Its EPSS exploit-prediction score of 13% places it in the 96th percentile, indicating an elevated likelihood of exploitation. The underlying weakness is classified as CWE-189.
Key facts
- Severity: Medium (CVSS 2.0 base score 6.5)
- EPSS exploit prediction: 13% (96th percentile)
- Actively exploited: Not listed in CISA KEV
- Weakness: CWE-189
- Affected product: Postgresql
- Published:
- Last modified:
Description
The bitsubstr function in backend/utils/adt/varbit.c in PostgreSQL 8.0.23, 8.1.11, and 8.3.8 allows remote authenticated users to cause a denial of service (daemon crash) or have unspecified other impact via vectors involving a negative integer in the third argument, as demonstrated by a SELECT statement that contains a call to the substring function for a bit string, related to an "overflow."
Frequently asked questions
- What is CVE-2010-0442?
- The bitsubstr function in backend/utils/adt/varbit.c in PostgreSQL 8.0.23, 8.1.11, and 8.3.8 allows remote authenticated users to cause a denial of service (daemon crash) or have unspecified other impact via vectors involving a negative integer in the third argument, as demonstrated by a SELECT statement that contains a call to the substring function for a bit string, related to an "overflow."
- How severe is CVE-2010-0442?
- CVE-2010-0442 has a CVSS 2.0 base score of 6.5, rated medium severity.
- Is CVE-2010-0442 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 13% (96th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2010-0442?
- CVE-2010-0442 affects Postgresql. See the affected-products list for the exact vulnerable versions.
- How do I fix CVE-2010-0442?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
- When was CVE-2010-0442 published?
- CVE-2010-0442 was published on 2010-02-02 and last updated on 2026-06-16.
References
- http://archives.postgresql.org/pgsql-committers/2010-01/msg00125.php
- http://archives.postgresql.org/pgsql-hackers/2010-01/msg00634.php
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=567058
- http://git.postgresql.org/gitweb?p=postgresql.git%3Ba=commit%3Bh=75dea10196c31d98d98c0bafeeb576ae99c09b12
- http://git.postgresql.org/gitweb?p=postgresql.git%3Ba=commit%3Bh=b15087cb39ca9e4bde3c8920fcee3741045d2b83
- http://intevydis.blogspot.com/2010/01/postgresql-8023-bitsubstr-overflow.html
- http://secunia.com/advisories/39566
- http://secunia.com/advisories/39820
- http://secunia.com/advisories/39939
- http://securitytracker.com/id?1023510
- http://ubuntu.com/usn/usn-933-1
- http://www.debian.org/security/2010/dsa-2051
- http://www.mandriva.com/security/advisories?name=MDVSA-2010:103
- http://www.openwall.com/lists/oss-security/2010/01/27/5
- http://www.redhat.com/support/errata/RHSA-2010-0427.html
- http://www.redhat.com/support/errata/RHSA-2010-0428.html
- http://www.redhat.com/support/errata/RHSA-2010-0429.html
- http://www.securityfocus.com/bid/37973
- http://www.vupen.com/english/advisories/2010/1022
- http://www.vupen.com/english/advisories/2010/1197
- http://www.vupen.com/english/advisories/2010/1207
- http://www.vupen.com/english/advisories/2010/1221
- https://bugzilla.redhat.com/show_bug.cgi?id=559194
- https://bugzilla.redhat.com/show_bug.cgi?id=559259
- https://exchange.xforce.ibmcloud.com/vulnerabilities/55902
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9720
Affected products (1)
- cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*
More vulnerabilities in Postgresql
- CVE-2013-1903 — Critical (CVSS 10.0): PostgreSQL, possibly 9.2.x before 9.2.4, 9.1.x before 9.1.9, 9.0.x before 9.0.13, 8.4.x before 8.4.17, and 8.3.x before…
- CVE-2013-1902 — Critical (CVSS 10.0): PostgreSQL, 9.2.x before 9.2.4, 9.1.x before 9.1.9, 9.0.x before 9.0.13, 8.4.x before 8.4.17, and 8.3.x before 8.3.23…
- CVE-2007-3279 — Critical (CVSS 10.0): PostgreSQL 8.1 and probably later versions, when the PL/pgSQL (plpgsql) language has been created, grants certain…
- CVE-2002-1399 — Critical (CVSS 10.0): Unknown vulnerability in cash_out and possibly other functions in PostgreSQL 7.2.1 and earlier, and possibly later…
- CVE-2015-0244 — Critical (CVSS 9.8): PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1 does not…
- CVE-2015-3166 — Critical (CVSS 9.8): The snprintf implementation in PostgreSQL before 9.0.20, 9.1.x before 9.1.16, 9.2.x before 9.2.11, 9.3.x before 9.3.7,…
All CVEs affecting Postgresql →
Other CWE-189 (Numeric Errors) vulnerabilities
- CVE-2015-8396 — Critical (CVSS 10.0): Integer overflow in the ImageRegionReader::ReadIntoBuffer function in…
- CVE-2015-7205 — Critical (CVSS 10.0): Integer underflow in the RTPReceiverVideo::ParseRtpPacket function in Mozilla Firefox before 43.0 and Firefox ESR 38.x…
- CVE-2015-6575 — Critical (CVSS 10.0): SampleTable.cpp in libstagefright in Android before 5.1.1 LMY48I does not properly consider integer promotion, which…
- CVE-2015-3864 — Critical (CVSS 10.0): Integer underflow in the MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in mediaserver in…
- CVE-2015-3836 — Critical (CVSS 10.0): The Parse_wave function in arm-wt-22k/lib_src/eas_mdls.c in the Sonivox DLS-to-EAS converter in Android before 5.1.1…
- CVE-2015-3834 — Critical (CVSS 10.0): Multiple integer overflows in the BnHDCP::onTransact function in media/libmedia/IHDCP.cpp in libstagefright in Android…