The bitsubstr function in backend/utils/adt/varbit.c in PostgreSQL 8.0.23, 8.1.11, and 8.3.8 allows remote authenticated users to cause a…

Description

The bitsubstr function in backend/utils/adt/varbit.c in PostgreSQL 8.0.23, 8.1.11, and 8.3.8 allows remote authenticated users to cause a denial of service (daemon crash) or have unspecified other impact via vectors involving a negative integer in the third argument, as demonstrated by a SELECT statement that contains a call to the substring function for a bit string, related to an "overflow."

Scores

EPSS (exploitation in 30 days)

13.3% · top 3.6% of all CVEs (4 Nov 2026)

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.5.

Weakness

• n/a
• CWE-189 (opens in a new tab)All about CWE-189 and its CVEs

Affected products

• n/a

  • affected n/a

References (26)

• RHSA-2010:0427 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
• 1023510 (opens in a new tab)vdb-entryx_refsource_SECTRACKx_transferred
• RHSA-2010:0428 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
• DSA-2051 (opens in a new tab)vendor-advisoryx_refsource_DEBIANx_transferred
• USN-933-1 (opens in a new tab)vendor-advisoryx_refsource_UBUNTUx_transferred
• 39820 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• [oss-security] 20100127 Re: CVE id request: postgresql bitsubstr overflow (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• ADV-2010-1221 (opens in a new tab)vdb-entryx_refsource_VUPENx_transferred
• 37973 (opens in a new tab)vdb-entryx_refsource_BIDx_transferred
• http://git.postgresql.org/gitweb?p=postgresql.git%3Ba=commit%3Bh=75dea10196c31d98d98c0bafeeb576ae99c09b12 (opens in a new tab)x_refsource_CONFIRMx_transferred
• http://intevydis.blogspot.com/2010/01/postgresql-8023-bitsubstr-overflow.html (opens in a new tab)x_refsource_MISCx_transferred
• http://git.postgresql.org/gitweb?p=postgresql.git%3Ba=commit%3Bh=b15087cb39ca9e4bde3c8920fcee3741045d2b83 (opens in a new tab)x_refsource_CONFIRMx_transferred
• ADV-2010-1207 (opens in a new tab)vdb-entryx_refsource_VUPENx_transferred
• http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=567058 (opens in a new tab)x_refsource_MISCx_transferred
• ADV-2010-1022 (opens in a new tab)vdb-entryx_refsource_VUPENx_transferred
• [pgsql-hackers] 20100107 Re: Patch: Allow substring/replace() to get/set bit values (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• 39566 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• https://bugzilla.redhat.com/show_bug.cgi?id=559259 (opens in a new tab)x_refsource_CONFIRMx_transferred
• postgresql-substring-bo(55902) (opens in a new tab)vdb-entryx_refsource_XFx_transferred
• [pgsql-committers] 20100107 pgsql: Make bit/varbit substring() treat any negative length as meaning (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• RHSA-2010:0429 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
• oval:org.mitre.oval:def:9720 (opens in a new tab)vdb-entrysignaturex_refsource_OVALx_transferred
• https://bugzilla.redhat.com/show_bug.cgi?id=559194 (opens in a new tab)x_refsource_CONFIRMx_transferred
• MDVSA-2010:103 (opens in a new tab)vendor-advisoryx_refsource_MANDRIVAx_transferred
• 39939 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• ADV-2010-1197 (opens in a new tab)vdb-entryx_refsource_VUPENx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2010-0442](https://trackcve.app/badge/CVE-2010-0442.svg)](https://trackcve.app/cve/CVE-2010-0442)

Record last updated 7 Aug 2024, 00:52 UTC.