A vulnerability has been reported in libpam-pgsql, which can be exploited by malicious people to cause a DoS (Denial of Service) and potentially compromise a vulnerable system. The vulnerability is caused due to the "pg_execParam()" function in src/backend_pgsql.c using an incorrect format specifier, which can be exploited to cause a heap-based buffer overflow by e.g. connecting from an IPv4 address containing an octet larger than 127 to an application using the module. The vulnerability is reported in version 0.7.1. Other versions may also be affected. Solution Do not use a vulnerable version of the module. Provided and/or discovered by Krzysztof Galazka within a Debian bug report. Original Advisory Debian bug #603436: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=603436 http://secunia.com/advisories/43471/
Bumped to 0.7.3 and removed old version. It was never stable so this should probably be closed.
(In reply to comment #1) > Bumped to 0.7.3 and removed old version. It was never stable so this should > probably be closed. Thanks, Diego.
