CVE-2018-1058

Name	CVE-2018-1058
Description	A flaw was found in the way Postgresql allowed a user to modify the behavior of a query for other users. An attacker with a user account could use this flaw to execute code with the permissions of superuser in the database. Versions 9.3 through 10 are affected.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
postgresql-9.1 (PTS)	jessie, jessie (lts)	9.1.22-0+deb8u1	fixed
postgresql-9.4 (PTS)	jessie, jessie (lts)	9.4.26-0+deb8u9	fixed
postgresql-9.6 (PTS)	stretch (security)	9.6.24-0+deb9u1	fixed
	stretch (lts), stretch	9.6.24-0+deb9u6	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version
postgresql-10	source	(unstable)	10.3-1
postgresql-9.1	source	jessie	(not affected)
postgresql-9.1	source	(unstable)	(unfixed)
postgresql-9.4	source	jessie	9.4.17-0+deb8u1
postgresql-9.4	source	(unstable)	(unfixed)
postgresql-9.6	source	stretch	9.6.8-0+deb9u1
postgresql-9.6	source	(unstable)	(unfixed)

Notes

[jessie] - postgresql-9.1 <not-affected> (postgresql-9.1 in jessie is PL/Perl only)
[wheezy] - postgresql-9.1 <no-dsa> (Minor issue)
https://git.postgresql.org/gitweb/?p=postgresql.git;a=commit;h=3d2aed664ee8271fd6c721ed0aa10168cda112ea
https://git.postgresql.org/gitweb/?p=postgresql.git;a=commit;h=582edc369cdbd348d68441fc50fa26a84afd0c1a
https://git.postgresql.org/gitweb/?p=postgresql.git;a=commit;h=5770172cb0c9df9e6ce27c507b449557e5b45124