CVE-2012-4575

Published: Nov 18, 2012Modified: Apr 29, 2026

5.0

Vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Exploitability: 10.0 / Impact: 2.9

Source: NVD

Description

The add_database function in objects.c in the pgbouncer pooler 1.5.2 for PostgreSQL allows remote attackers to cause a denial of service (daemon outage) via a long database name in a request.

Affected (1)

Products: Pgbouncer Project: Pgbouncer

Pgbouncer Project

1 product

Pgbouncer

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Pgbouncer Project Pgbouncer	Version 1.5.2

Running on/with	Platform Versions
Postgresql Postgresql	All versions

Related CWEs

CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

References (10)

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=692103

Source: secalert@redhat.com

Third Party Advisory

http://git.postgresql.org/gitweb/?p=pgbouncer.git%3Ba=commit%3Bh=4b92112b820830b30cd7bc91bef3dd8f35305525

Source: secalert@redhat.com

http://openwall.com/lists/oss-security/2012/11/02/8

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://www.securityfocus.com/bid/56371

Source: secalert@redhat.com

Third Party AdvisoryVDB Entry

https://bugzilla.redhat.com/show_bug.cgi?id=872527

Source: secalert@redhat.com

Issue TrackingThird Party Advisory

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=692103