CVE-2007-4769

The regular expression parser in TCL before 8.4.17, as used in PostgreSQL 8.2 before 8.2.6, 8.1 before 8.1.11, 8.0 before 8.0.15, and 7.4 before 7.4.19, allows remote authenticated users to cause a denial of service (backend crash) via an out-of-bounds backref number.

Published: 2008-01-09 Last update: 2026-04-23 Assigner: [email protected] Source: [email protected]
NVD Status：Modified，CVE State: published
View at NVD, CVE.org, EUVD

CVE-2007-4769 is rated Moderate Risk (54.8/100): CVSS Medium severity, with medium exploitation likelihood (EPSS 1.21%). Review affected assets and schedule remediation.

Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.

Exploit prediction scoring system (EPSS) score for CVE-2007-4769

EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).

# Date Old EPSS score New EPSS score Delta (New - Old)
1 2025-12-01 1.08% 1.21% +0.13%
2 2025-05-22 1.18% 1.08% -0.10%
3 2025-03-30 — 1.18% —

Full EPSS history (13 records total)

Common vulnerability scoring system (CVSS) metrics for CVE-2007-4769

CVSS metrics for this CVE.

Base score Version Severity Vector Exploitability Impact Score source
6.8 2.0 MEDIUM
AV:N/AC:L/Au:S/C:N/I:N/A:C Click to expand
Access vector (AV:N)
Can be exploited remotely over network reachability.
Access complexity (AC:L)
Exploitation conditions are straightforward and predictable.
Authentication (AU:S)
A single authentication is required.
Confidentiality impact (C:N)
No confidentiality impact.
Integrity impact (I:N)
No integrity impact.
Availability impact (A:C)
Complete availability impact.
 8.0 6.9 [email protected]

Weakness enumeration for CVE-2007-4769

OS Trackers for CVE-2007-4769

vendor priority summary link
gentoo high CVE-2007-4769: 1 GLSA(s) (200801-15), 1 atom(s) (dev-db/postgresql); latest impact high. https://bugs.gentoo.org/buglist.cgi?quicksearch=CVE-2007-4769
redhat medium — https://access.redhat.com/security/cve/CVE-2007-4769
ubuntu medium CVE-2007-4769 medium priority: Ubuntu including 2 source packages (postgresql-8.1, postgresql-8.2), 14 status rows across 7 suites (dapper, edgy, feisty, gutsy, hardy, intrepid, upstream): DNE 5, released 5, ignored 2, needs-triage 2. https://ubuntu.com/security/CVE-2007-4769

Affected software / configurations for CVE-2007-4769

Vendor Product Version Raw CPE
postgresql postgresql 7.3 cpe:2.3:a:postgresql:postgresql:7.3:*:*:*:*:*:*:*
postgresql postgresql 7.3.1 cpe:2.3:a:postgresql:postgresql:7.3.1:*:*:*:*:*:*:*
postgresql postgresql 7.3.2 cpe:2.3:a:postgresql:postgresql:7.3.2:*:*:*:*:*:*:*
postgresql postgresql 7.3.3 cpe:2.3:a:postgresql:postgresql:7.3.3:*:*:*:*:*:*:*
postgresql postgresql 7.3.4 cpe:2.3:a:postgresql:postgresql:7.3.4:*:*:*:*:*:*:*
postgresql postgresql 7.3.6 cpe:2.3:a:postgresql:postgresql:7.3.6:*:*:*:*:*:*:*
postgresql postgresql 7.3.8 cpe:2.3:a:postgresql:postgresql:7.3.8:*:*:*:*:*:*:*
postgresql postgresql 7.3.9 cpe:2.3:a:postgresql:postgresql:7.3.9:*:*:*:*:*:*:*
postgresql postgresql 7.3.10 cpe:2.3:a:postgresql:postgresql:7.3.10:*:*:*:*:*:*:*
postgresql postgresql 7.3.11 cpe:2.3:a:postgresql:postgresql:7.3.11:*:*:*:*:*:*:*
postgresql postgresql 7.3.12 cpe:2.3:a:postgresql:postgresql:7.3.12:*:*:*:*:*:*:*
postgresql postgresql 7.3.13 cpe:2.3:a:postgresql:postgresql:7.3.13:*:*:*:*:*:*:*
postgresql postgresql 7.3.14 cpe:2.3:a:postgresql:postgresql:7.3.14:*:*:*:*:*:*:*
postgresql postgresql 7.3.15 cpe:2.3:a:postgresql:postgresql:7.3.15:*:*:*:*:*:*:*
postgresql postgresql 7.3.16 cpe:2.3:a:postgresql:postgresql:7.3.16:*:*:*:*:*:*:*
postgresql postgresql 7.3.19 cpe:2.3:a:postgresql:postgresql:7.3.19:*:*:*:*:*:*:*
postgresql postgresql 7.4 cpe:2.3:a:postgresql:postgresql:7.4:*:*:*:*:*:*:*
postgresql postgresql 7.4.1 cpe:2.3:a:postgresql:postgresql:7.4.1:*:*:*:*:*:*:*
postgresql postgresql 7.4.2 cpe:2.3:a:postgresql:postgresql:7.4.2:*:*:*:*:*:*:*
postgresql postgresql 7.4.3 cpe:2.3:a:postgresql:postgresql:7.4.3:*:*:*:*:*:*:*
postgresql postgresql 7.4.4 cpe:2.3:a:postgresql:postgresql:7.4.4:*:*:*:*:*:*:*
postgresql postgresql 7.4.5 cpe:2.3:a:postgresql:postgresql:7.4.5:*:*:*:*:*:*:*
postgresql postgresql 7.4.6 cpe:2.3:a:postgresql:postgresql:7.4.6:*:*:*:*:*:*:*
postgresql postgresql 7.4.7 cpe:2.3:a:postgresql:postgresql:7.4.7:*:*:*:*:*:*:*
postgresql postgresql 7.4.8 cpe:2.3:a:postgresql:postgresql:7.4.8:*:*:*:*:*:*:*
postgresql postgresql 7.4.9 cpe:2.3:a:postgresql:postgresql:7.4.9:*:*:*:*:*:*:*
postgresql postgresql 7.4.10 cpe:2.3:a:postgresql:postgresql:7.4.10:*:*:*:*:*:*:*
postgresql postgresql 7.4.11 cpe:2.3:a:postgresql:postgresql:7.4.11:*:*:*:*:*:*:*
postgresql postgresql 7.4.12 cpe:2.3:a:postgresql:postgresql:7.4.12:*:*:*:*:*:*:*
postgresql postgresql 7.4.13 cpe:2.3:a:postgresql:postgresql:7.4.13:*:*:*:*:*:*:*
postgresql postgresql 7.4.14 cpe:2.3:a:postgresql:postgresql:7.4.14:*:*:*:*:*:*:*
postgresql postgresql 7.4.16 cpe:2.3:a:postgresql:postgresql:7.4.16:*:*:*:*:*:*:*
postgresql postgresql 7.4.17 cpe:2.3:a:postgresql:postgresql:7.4.17:*:*:*:*:*:*:*
postgresql postgresql 8.0 cpe:2.3:a:postgresql:postgresql:8.0:*:*:*:*:*:*:*
postgresql postgresql 8.0.1 cpe:2.3:a:postgresql:postgresql:8.0.1:*:*:*:*:*:*:*
postgresql postgresql 8.0.2 cpe:2.3:a:postgresql:postgresql:8.0.2:*:*:*:*:*:*:*
postgresql postgresql 8.0.3 cpe:2.3:a:postgresql:postgresql:8.0.3:*:*:*:*:*:*:*
postgresql postgresql 8.0.4 cpe:2.3:a:postgresql:postgresql:8.0.4:*:*:*:*:*:*:*
postgresql postgresql 8.0.5 cpe:2.3:a:postgresql:postgresql:8.0.5:*:*:*:*:*:*:*
postgresql postgresql 8.0.7 cpe:2.3:a:postgresql:postgresql:8.0.7:*:*:*:*:*:*:*
postgresql postgresql 8.0.8 cpe:2.3:a:postgresql:postgresql:8.0.8:*:*:*:*:*:*:*
postgresql postgresql 8.0.9 cpe:2.3:a:postgresql:postgresql:8.0.9:*:*:*:*:*:*:*
postgresql postgresql 8.0.11 cpe:2.3:a:postgresql:postgresql:8.0.11:*:*:*:*:*:*:*
postgresql postgresql 8.0.13 cpe:2.3:a:postgresql:postgresql:8.0.13:*:*:*:*:*:*:*
postgresql postgresql 8.0.317 cpe:2.3:a:postgresql:postgresql:8.0.317:*:*:*:*:*:*:*
postgresql postgresql 8.1.1 cpe:2.3:a:postgresql:postgresql:8.1.1:*:*:*:*:*:*:*
postgresql postgresql 8.1.3 cpe:2.3:a:postgresql:postgresql:8.1.3:*:*:*:*:*:*:*
postgresql postgresql 8.1.4 cpe:2.3:a:postgresql:postgresql:8.1.4:*:*:*:*:*:*:*
postgresql postgresql 8.1.5 cpe:2.3:a:postgresql:postgresql:8.1.5:*:*:*:*:*:*:*
postgresql postgresql 8.1.7 cpe:2.3:a:postgresql:postgresql:8.1.7:*:*:*:*:*:*:*
postgresql postgresql 8.1.8 cpe:2.3:a:postgresql:postgresql:8.1.8:*:*:*:*:*:*:*
postgresql postgresql 8.1.9 cpe:2.3:a:postgresql:postgresql:8.1.9:*:*:*:*:*:*:*
postgresql postgresql 8.2 cpe:2.3:a:postgresql:postgresql:8.2:*:*:*:*:*:*:*
postgresql postgresql 8.2.2 cpe:2.3:a:postgresql:postgresql:8.2.2:*:*:*:*:*:*:*
postgresql postgresql 8.2.3 cpe:2.3:a:postgresql:postgresql:8.2.3:*:*:*:*:*:*:*
postgresql postgresql 8.2.4 cpe:2.3:a:postgresql:postgresql:8.2.4:*:*:*:*:*:*:*
tcl_tk tcl_tk <= 8.4.16 cpe:2.3:a:tcl_tk:tcl_tk:*:*:*:*:*:*:*:*

References for CVE-2007-4769

URL Tags
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01420154
http://lists.opensuse.org/opensuse-security-announce/2008-02/msg00000.html
http://secunia.com/advisories/28359 Vendor Advisory
http://secunia.com/advisories/28376 Vendor Advisory
http://secunia.com/advisories/28437 Vendor Advisory
http://secunia.com/advisories/28438 Vendor Advisory
http://secunia.com/advisories/28454 Vendor Advisory
http://secunia.com/advisories/28455 Vendor Advisory
http://secunia.com/advisories/28464 Vendor Advisory
http://secunia.com/advisories/28477
http://secunia.com/advisories/28479 Vendor Advisory
http://secunia.com/advisories/28679 Vendor Advisory
http://secunia.com/advisories/28698 Vendor Advisory
http://secunia.com/advisories/29638 Vendor Advisory
http://security.gentoo.org/glsa/glsa-200801-15.xml
http://securitytracker.com/id?1019157
http://sourceforge.net/project/shownotes.php?release_id=565440&group_id=10894
http://sourceforge.net/tracker/index.php?func=detail&aid=1810264&group_id=10894&atid=110894
http://sunsolve.sun.com/search/document.do?assetkey=1-26-103197-1
http://sunsolve.sun.com/search/document.do?assetkey=1-66-200559-1
http://www.debian.org/security/2008/dsa-1460
http://www.debian.org/security/2008/dsa-1463
http://www.mandriva.com/security/advisories?name=MDVSA-2008:004
http://www.postgresql.org/about/news.905
http://www.redhat.com/support/errata/RHSA-2008-0038.html
http://www.redhat.com/support/errata/RHSA-2008-0040.html
http://www.securityfocus.com/archive/1/485864/100/0/threaded
http://www.securityfocus.com/archive/1/486407/100/0/threaded
http://www.securityfocus.com/bid/27163 Patch
http://www.vupen.com/english/advisories/2008/0061 Vendor Advisory
http://www.vupen.com/english/advisories/2008/0109 Vendor Advisory
http://www.vupen.com/english/advisories/2008/1071/references
https://exchange.xforce.ibmcloud.com/vulnerabilities/39499
https://issues.rpath.com/browse/RPL-1768
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9804
https://usn.ubuntu.com/568-1/
https://www.redhat.com/archives/fedora-package-announce/2008-January/msg00397.html
https://www.redhat.com/archives/fedora-package-announce/2008-January/msg00469.html
cvelogic Threat Intelligence