Vulnerability Details : CVE-2007-6067
Algorithmic complexity vulnerability in the regular expression parser in TCL before 8.4.17, as used in PostgreSQL 8.2 before 8.2.6, 8.1 before 8.1.11, 8.0 before 8.0.15, and 7.4 before 7.4.19, allows remote authenticated users to cause a denial of service (memory consumption) via a crafted "complex" regular expression with doubly-nested states.
Vulnerability category: Denial of service
Products affected by CVE-2007-6067
- cpe:2.3:a:postgresql:postgresql:7.3.19:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:7.3.1:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:7.3.3:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:7.3:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:7.3.2:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:7.4.3:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:7.4.5:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:7.4.6:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:7.4.4:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:7.4.7:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:7.4.1:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:7.4.2:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:7.3.6:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:7.3.4:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:7.3.8:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:7.3.9:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:7.4:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:8.0:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:8.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:8.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:8.0.3:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:8.0.4:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:8.0.5:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:8.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:7.3.11:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:7.3.12:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:7.3.13:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:7.3.10:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:7.4.10:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:7.4.11:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:7.4.8:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:7.4.9:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:7.3.14:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:8.1.3:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:7.4.12:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:8.0.7:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:8.0.8:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:7.4.13:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:7.3.15:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:8.1.4:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:7.4.14:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:8.2:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:7.3.16:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:7.4.16:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:8.1.5:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:8.0.9:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:8.0.11:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:8.0.13:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:7.4.17:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:8.1.7:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:8.1.8:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:8.1.9:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:8.0.317:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:8.2.4:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:8.2.2:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:8.2.3:*:*:*:*:*:*:*
- cpe:2.3:a:tcl_tk:tcl_tk:*:*:*:*:*:*:*:*
Threat overview for CVE-2007-6067
Top countries where our scanners detected CVE-2007-6067
Top open port discovered on systems with this issue
5432
IPs affected by CVE-2007-6067 7,090
Threat actors abusing to this issue?
Yes
Find out if you* are
affected by CVE-2007-6067!
*Directly or indirectly through your vendors, service providers and 3rd parties.
Powered by
attack surface intelligence
from SecurityScorecard.
Exploit prediction scoring system (EPSS) score for CVE-2007-6067
3.25%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 91 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2007-6067
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
6.8
|
MEDIUM | AV:N/AC:L/Au:S/C:N/I:N/A:C |
8.0
|
6.9
|
NIST |
CWE ids for CVE-2007-6067
-
Assigned by: nvd@nist.gov (Primary)
References for CVE-2007-6067
-
http://www.vupen.com/english/advisories/2008/0109
-
http://rhn.redhat.com/errata/RHSA-2013-0122.html
-
https://www.redhat.com/archives/fedora-package-announce/2008-January/msg00469.html
-
http://www.securityfocus.com/archive/1/486407/100/0/threaded
-
http://www.redhat.com/support/errata/RHSA-2008-0040.html
-
https://issues.rpath.com/browse/RPL-1768
-
http://www.debian.org/security/2008/dsa-1460
-
http://www.debian.org/security/2008/dsa-1463
-
http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705
Juniper Networks - 2015-10 Security Bulletin: CTPView: Multiple Vulnerabilities in CTPView
-
http://www.redhat.com/support/errata/RHSA-2008-0038.html
-
http://www.securityfocus.com/bid/27163
Patch
-
http://sunsolve.sun.com/search/document.do?assetkey=1-66-200559-1
-
http://www.mandriva.com/security/advisories?name=MDVSA-2008:004
-
http://lists.opensuse.org/opensuse-security-announce/2008-02/msg00000.html
-
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10235
-
http://security.gentoo.org/glsa/glsa-200801-15.xml
-
http://www.postgresql.org/about/news.905
-
http://sourceforge.net/project/shownotes.php?release_id=565440&group_id=10894
-
http://sourceforge.net/tracker/index.php?func=detail&aid=1810264&group_id=10894&atid=110894
Exploit
-
http://sunsolve.sun.com/search/document.do?assetkey=1-26-103197-1
-
https://exchange.xforce.ibmcloud.com/vulnerabilities/39498
-
http://www.vupen.com/english/advisories/2008/0061
-
http://www.vupen.com/english/advisories/2008/1071/references
-
http://www.securityfocus.com/archive/1/485864/100/0/threaded
-
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01420154
-
http://securitytracker.com/id?1019157
-
https://usn.ubuntu.com/568-1/
-
https://www.redhat.com/archives/fedora-package-announce/2008-January/msg00397.html
Jump to