CVE-2012-0866 [Medium] | Security Vulnerability in Postgresql

CREATE TRIGGER in PostgreSQL 8.3.x before 8.3.18, 8.4.x before 8.4.11, 9.0.x before 9.0.7, and 9.1.x before 9.1.3 does not properly check the execute permission for trigger functions marked SECURITY DEFINER, which allows remote authenticated users to execute otherwise restricted triggers on arbitrary data by installing the trigger on an attacker-owned table.

#	Date	Old EPSS score	New EPSS score	Delta (New - Old)
1	2026-06-15	1.07%	3.62%	+2.56%
2	2026-04-05	0.91%	1.07%	+0.16%
3	2026-02-01	—	0.91%	—

Date

Old EPSS score

New EPSS score

Delta (New - Old)

2026-06-15

1.07%

3.62%

+2.56%

2026-04-05

0.91%

1.07%

+0.16%

2026-02-01

—

0.91%

—

Base score	Version	Severity	Vector	Exploitability	Impact	Score source
6.5	2.0	MEDIUM	`AV:N/AC:L/Au:S/C:P/I:P/A:P` Click to expand Access vector (AV:N) Can be exploited remotely over network reachability. Access complexity (AC:L) Exploitation conditions are straightforward and predictable. Authentication (AU:S) A single authentication is required. Confidentiality impact (C:P) Partial confidentiality impact. Integrity impact (I:P) Partial integrity impact. Availability impact (A:P) Partial availability impact.	8.0	6.4	[email protected]

Base score

Version

Severity

Vector

Exploitability

Impact

Score source

6.5

2.0

MEDIUM

AV:N/AC:L/Au:S/C:P/I:P/A:P Click to expand

Access vector (AV:N): Can be exploited remotely over network reachability.
Access complexity (AC:L): Exploitation conditions are straightforward and predictable.
Authentication (AU:S): A single authentication is required.
Confidentiality impact (C:P): Partial confidentiality impact.
Integrity impact (I:P): Partial integrity impact.
Availability impact (A:P): Partial availability impact.

8.0

6.4

[email protected]

OS Trackers for CVE-2012-0866

vendor	priority	summary	link
`gentoo`	normal	CVE-2012-0866: 1 GLSA(s) (201209-24), 1 atom(s) (dev-db/postgresql-server); latest impact normal.	https://bugs.gentoo.org/buglist.cgi?quicksearch=CVE-2012-0866
`redhat`	low	—	https://access.redhat.com/security/cve/CVE-2012-0866
`ubuntu`	medium	CVE-2012-0866 medium priority: Ubuntu including 4 source packages (postgresql-8.2, postgresql-8.3, postgresql-8.4, postgresql-9.1), 36 status rows across 9 suites (hardy, lucid, maverick, natty, oneiric, precise, quantal, raring, upstream): DNE 21, released 11, ignored 2, needs-triage 1, not-affected 1.	https://ubuntu.com/security/CVE-2012-0866

Affected software / configurations for CVE-2012-0866

Vendor	Product	Version	Raw CPE
postgresql	postgresql	8.3	cpe:2.3:a:postgresql:postgresql:8.3:::::::*
postgresql	postgresql	8.3.1	cpe:2.3:a:postgresql:postgresql:8.3.1:::::::*
postgresql	postgresql	8.3.2	cpe:2.3:a:postgresql:postgresql:8.3.2:::::::*
postgresql	postgresql	8.3.3	cpe:2.3:a:postgresql:postgresql:8.3.3:::::::*
postgresql	postgresql	8.3.4	cpe:2.3:a:postgresql:postgresql:8.3.4:::::::*
postgresql	postgresql	8.3.5	cpe:2.3:a:postgresql:postgresql:8.3.5:::::::*
postgresql	postgresql	8.3.6	cpe:2.3:a:postgresql:postgresql:8.3.6:::::::*
postgresql	postgresql	8.3.7	cpe:2.3:a:postgresql:postgresql:8.3.7:::::::*
postgresql	postgresql	8.3.8	cpe:2.3:a:postgresql:postgresql:8.3.8:::::::*
postgresql	postgresql	8.3.9	cpe:2.3:a:postgresql:postgresql:8.3.9:::::::*
postgresql	postgresql	8.3.10	cpe:2.3:a:postgresql:postgresql:8.3.10:::::::*
postgresql	postgresql	8.3.11	cpe:2.3:a:postgresql:postgresql:8.3.11:::::::*
postgresql	postgresql	8.3.12	cpe:2.3:a:postgresql:postgresql:8.3.12:::::::*
postgresql	postgresql	8.3.13	cpe:2.3:a:postgresql:postgresql:8.3.13:::::::*
postgresql	postgresql	8.3.14	cpe:2.3:a:postgresql:postgresql:8.3.14:::::::*
postgresql	postgresql	8.3.15	cpe:2.3:a:postgresql:postgresql:8.3.15:::::::*
postgresql	postgresql	8.3.16	cpe:2.3:a:postgresql:postgresql:8.3.16:::::::*
postgresql	postgresql	8.3.17	cpe:2.3:a:postgresql:postgresql:8.3.17:::::::*
postgresql	postgresql	8.4	cpe:2.3:a:postgresql:postgresql:8.4:::::::*
postgresql	postgresql	8.4.1	cpe:2.3:a:postgresql:postgresql:8.4.1:::::::*
postgresql	postgresql	8.4.2	cpe:2.3:a:postgresql:postgresql:8.4.2:::::::*
postgresql	postgresql	8.4.3	cpe:2.3:a:postgresql:postgresql:8.4.3:::::::*
postgresql	postgresql	8.4.4	cpe:2.3:a:postgresql:postgresql:8.4.4:::::::*
postgresql	postgresql	8.4.5	cpe:2.3:a:postgresql:postgresql:8.4.5:::::::*
postgresql	postgresql	8.4.6	cpe:2.3:a:postgresql:postgresql:8.4.6:::::::*
postgresql	postgresql	8.4.7	cpe:2.3:a:postgresql:postgresql:8.4.7:::::::*
postgresql	postgresql	8.4.8	cpe:2.3:a:postgresql:postgresql:8.4.8:::::::*
postgresql	postgresql	8.4.9	cpe:2.3:a:postgresql:postgresql:8.4.9:::::::*
postgresql	postgresql	8.4.10	cpe:2.3:a:postgresql:postgresql:8.4.10:::::::*
postgresql	postgresql	9.0	cpe:2.3:a:postgresql:postgresql:9.0:::::::*
postgresql	postgresql	9.0.1	cpe:2.3:a:postgresql:postgresql:9.0.1:::::::*
postgresql	postgresql	9.0.2	cpe:2.3:a:postgresql:postgresql:9.0.2:::::::*
postgresql	postgresql	9.0.3	cpe:2.3:a:postgresql:postgresql:9.0.3:::::::*
postgresql	postgresql	9.0.4	cpe:2.3:a:postgresql:postgresql:9.0.4:::::::*
postgresql	postgresql	9.0.5	cpe:2.3:a:postgresql:postgresql:9.0.5:::::::*
postgresql	postgresql	9.0.6	cpe:2.3:a:postgresql:postgresql:9.0.6:::::::*
postgresql	postgresql	9.1	cpe:2.3:a:postgresql:postgresql:9.1:::::::*
postgresql	postgresql	9.1.1	cpe:2.3:a:postgresql:postgresql:9.1.1:::::::*
postgresql	postgresql	9.1.2	cpe:2.3:a:postgresql:postgresql:9.1.2:::::::*

References for CVE-2012-0866

URL	Tags
http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705
http://lists.opensuse.org/opensuse-updates/2012-09/msg00060.html
http://rhn.redhat.com/errata/RHSA-2012-0677.html
http://rhn.redhat.com/errata/RHSA-2012-0678.html
http://secunia.com/advisories/49272
http://secunia.com/advisories/49273
http://www.debian.org/security/2012/dsa-2418
http://www.mandriva.com/security/advisories?name=MDVSA-2012:026
http://www.mandriva.com/security/advisories?name=MDVSA-2012:027
http://www.mandriva.com/security/advisories?name=MDVSA-2012:092
http://www.postgresql.org/about/news/1377/	Vendor Advisory
http://www.postgresql.org/docs/8.3/static/release-8-3-18.html
http://www.postgresql.org/docs/8.4/static/release-8-4-11.html
http://www.postgresql.org/docs/9.0/static/release-9-0-7.html
http://www.postgresql.org/docs/9.1/static/release-9-1-3.html

URL

CVE-2012-0866

Exploit prediction scoring system (EPSS) score for CVE-2012-0866

Common vulnerability scoring system (CVSS) metrics for CVE-2012-0866

Weakness enumeration for CVE-2012-0866

OS Trackers for CVE-2012-0866

Affected software / configurations for CVE-2012-0866

References for CVE-2012-0866