Servers and applications
CVE-2010-0442
The bitsubstr function in backend/utils/adt/varbit.c in PostgreSQL 8.0.23, 8.1.11, and 8.3.8 allows remote authenticated users to cause a denial of service (daemon crash) or have unspecified other impact via vectors involving a negative integer in the third argument, as demonstrated by a SELECT statement that contains a call to the substring function for a bit string, related to an "overflow."
- Severity
- Medium 6.5
- Published
- 2 Feb 2010
- Last changed
- 16 Jun 2026
- Added to UpHeron
- 16 Oct 2026
- Fixed in
- 7.4.28, 8.0.24, 8.1.20, 8.2.16, 8.3.10, 8.4.3
- Exploit chance
- 13% in the next 30 daysHigher than 96% of CVEs. EPSS by FIRST, 12 Nov 2026
- Weakness
- CWE-189
- Attack
- Over the network · Needs a login
- Attacker can
- Read some data · Change some data · Slow it down
- CVSS vector
AV:N/AC:L/Au:S/C:P/I:P/A:P- Sources
- NVD
Affected software
| Software | Affected versions |
|---|---|
PostgreSQLServers and applications · cpe:a:postgresql:postgresql |
|