UpHeron
All vulnerabilities

Servers and applications

CVE-2016-5424

PostgreSQL before 9.1.23, 9.2.x before 9.2.18, 9.3.x before 9.3.14, 9.4.x before 9.4.9, and 9.5.x before 9.5.4 might allow remote authenticated users with the CREATEDB or CREATEROLE role to gain superuser privileges via a (1) " (double quote), (2) \ (backslash), (3) carriage return, or (4) newline character in a (a) database or (b) role name that is mishandled during an administrative operation.

Severity
High 7.1
Published
9 Dec 2016
Last changed
17 Jun 2026
Added to UpHeron
16 Oct 2026
Sources
NVD

Affected software

SoftwareAffected versions
PostgreSQLServers and applications · cpe:a:postgresql:postgresql
  • Version 9.5.3
  • Version 9.5.2
  • Version 9.5.1
  • Version 9.5
All 46 release lines
  • Every version up to 9.1.22
  • Version 9.2
  • Version 9.2.1
  • Version 9.2.2
  • Version 9.2.3
  • Version 9.2.4
  • Version 9.2.5
  • Version 9.2.6
  • Version 9.2.7
  • Version 9.2.8
  • Version 9.2.9
  • Version 9.2.10
  • Version 9.2.11
  • Version 9.2.12
  • Version 9.2.13
  • Version 9.2.14
  • Version 9.2.15
  • Version 9.2.16
  • Version 9.2.17
  • Version 9.3
  • Version 9.3.1
  • Version 9.3.2
  • Version 9.3.3
  • Version 9.3.4
  • Version 9.3.5
  • Version 9.3.6
  • Version 9.3.7
  • Version 9.3.8
  • Version 9.3.9
  • Version 9.3.10
  • Version 9.3.11
  • Version 9.3.12
  • Version 9.3.13
  • Version 9.4
  • Version 9.4.1
  • Version 9.4.2
  • Version 9.4.3
  • Version 9.4.4
  • Version 9.4.5
  • Version 9.4.6
  • Version 9.4.7
  • Version 9.4.8
  • Version 9.5
  • Version 9.5.1
  • Version 9.5.2
  • Version 9.5.3

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2016-5424
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2016-5424