CVE-2014-0062 [Medium] | Security Vulnerability in Postgresql

Race condition in the (1) CREATE INDEX and (2) unspecified ALTER TABLE commands in PostgreSQL before 8.4.20, 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 allows remote authenticated users to create an unauthorized index or read portions of unauthorized tables by creating or deleting a table with the same name during the timing window.

#	Date	Old EPSS score	New EPSS score	Delta (New - Old)
1	2026-06-15	0.38%	3.00%	+2.62%
2	2026-02-25	0.69%	0.38%	-0.31%
3	2025-09-30	—	0.69%	—

Date

Old EPSS score

New EPSS score

Delta (New - Old)

2026-06-15

0.38%

3.00%

+2.62%

2026-02-25

0.69%

0.38%

-0.31%

2025-09-30

—

0.69%

—

Base score	Version	Severity	Vector	Exploitability	Impact	Score source
4.9	2.0	MEDIUM	`AV:N/AC:M/Au:S/C:P/I:P/A:N` Click to expand Access vector (AV:N) Can be exploited remotely over network reachability. Access complexity (AC:M) Exploitation needs some favorable conditions, but not exceptional ones. Authentication (AU:S) A single authentication is required. Confidentiality impact (C:P) Partial confidentiality impact. Integrity impact (I:P) Partial integrity impact. Availability impact (A:N) No availability impact.	6.8	4.9	[email protected]

Base score

Version

Severity

Vector

Exploitability

Impact

Score source

4.9

2.0

MEDIUM

AV:N/AC:M/Au:S/C:P/I:P/A:N Click to expand

Access vector (AV:N): Can be exploited remotely over network reachability.
Access complexity (AC:M): Exploitation needs some favorable conditions, but not exceptional ones.
Authentication (AU:S): A single authentication is required.
Confidentiality impact (C:P): Partial confidentiality impact.
Integrity impact (I:P): Partial integrity impact.
Availability impact (A:N): No availability impact.

6.8

4.9

[email protected]

OS Trackers for CVE-2014-0062

vendor	priority	summary	link
`gentoo`	normal	CVE-2014-0062: 1 GLSA(s) (201408-15), 1 atom(s) (dev-db/postgresql-server); latest impact normal.	https://bugs.gentoo.org/buglist.cgi?quicksearch=CVE-2014-0062
`redhat`	medium	—	https://access.redhat.com/security/cve/CVE-2014-0062
`ubuntu`	medium	CVE-2014-0062 medium priority: Ubuntu including 3 source packages (postgresql-8.4, postgresql-9.1, postgresql-9.3), 21 status rows across 7 suites (lucid, precise, quantal, saucy, trusty, upstream, utopic): DNE 11, released 10.	https://ubuntu.com/security/CVE-2014-0062

Affected software / configurations for CVE-2014-0062

Vendor	Product	Version	Raw CPE
postgresql	postgresql	<= 8.4.19	cpe:2.3:a:postgresql:postgresql::::::::
postgresql	postgresql	8.4.1	cpe:2.3:a:postgresql:postgresql:8.4.1:::::::*
postgresql	postgresql	8.4.2	cpe:2.3:a:postgresql:postgresql:8.4.2:::::::*
postgresql	postgresql	8.4.3	cpe:2.3:a:postgresql:postgresql:8.4.3:::::::*
postgresql	postgresql	8.4.4	cpe:2.3:a:postgresql:postgresql:8.4.4:::::::*
postgresql	postgresql	8.4.5	cpe:2.3:a:postgresql:postgresql:8.4.5:::::::*
postgresql	postgresql	8.4.6	cpe:2.3:a:postgresql:postgresql:8.4.6:::::::*
postgresql	postgresql	8.4.7	cpe:2.3:a:postgresql:postgresql:8.4.7:::::::*
postgresql	postgresql	8.4.8	cpe:2.3:a:postgresql:postgresql:8.4.8:::::::*
postgresql	postgresql	8.4.9	cpe:2.3:a:postgresql:postgresql:8.4.9:::::::*
postgresql	postgresql	8.4.10	cpe:2.3:a:postgresql:postgresql:8.4.10:::::::*
postgresql	postgresql	8.4.11	cpe:2.3:a:postgresql:postgresql:8.4.11:::::::*
postgresql	postgresql	8.4.12	cpe:2.3:a:postgresql:postgresql:8.4.12:::::::*
postgresql	postgresql	8.4.13	cpe:2.3:a:postgresql:postgresql:8.4.13:::::::*
postgresql	postgresql	8.4.14	cpe:2.3:a:postgresql:postgresql:8.4.14:::::::*
postgresql	postgresql	8.4.15	cpe:2.3:a:postgresql:postgresql:8.4.15:::::::*
postgresql	postgresql	8.4.16	cpe:2.3:a:postgresql:postgresql:8.4.16:::::::*
postgresql	postgresql	8.4.17	cpe:2.3:a:postgresql:postgresql:8.4.17:::::::*
postgresql	postgresql	8.4.18	cpe:2.3:a:postgresql:postgresql:8.4.18:::::::*
postgresql	postgresql	9.0	cpe:2.3:a:postgresql:postgresql:9.0:::::::*
postgresql	postgresql	9.0.1	cpe:2.3:a:postgresql:postgresql:9.0.1:::::::*
postgresql	postgresql	9.0.2	cpe:2.3:a:postgresql:postgresql:9.0.2:::::::*
postgresql	postgresql	9.0.3	cpe:2.3:a:postgresql:postgresql:9.0.3:::::::*
postgresql	postgresql	9.0.4	cpe:2.3:a:postgresql:postgresql:9.0.4:::::::*
postgresql	postgresql	9.0.5	cpe:2.3:a:postgresql:postgresql:9.0.5:::::::*
postgresql	postgresql	9.0.6	cpe:2.3:a:postgresql:postgresql:9.0.6:::::::*
postgresql	postgresql	9.0.7	cpe:2.3:a:postgresql:postgresql:9.0.7:::::::*
postgresql	postgresql	9.0.8	cpe:2.3:a:postgresql:postgresql:9.0.8:::::::*
postgresql	postgresql	9.0.9	cpe:2.3:a:postgresql:postgresql:9.0.9:::::::*
postgresql	postgresql	9.0.10	cpe:2.3:a:postgresql:postgresql:9.0.10:::::::*
postgresql	postgresql	9.0.11	cpe:2.3:a:postgresql:postgresql:9.0.11:::::::*
postgresql	postgresql	9.0.12	cpe:2.3:a:postgresql:postgresql:9.0.12:::::::*
postgresql	postgresql	9.0.13	cpe:2.3:a:postgresql:postgresql:9.0.13:::::::*
postgresql	postgresql	9.0.14	cpe:2.3:a:postgresql:postgresql:9.0.14:::::::*
postgresql	postgresql	9.0.15	cpe:2.3:a:postgresql:postgresql:9.0.15:::::::*
postgresql	postgresql	9.1	cpe:2.3:a:postgresql:postgresql:9.1:::::::*
postgresql	postgresql	9.1.1	cpe:2.3:a:postgresql:postgresql:9.1.1:::::::*
postgresql	postgresql	9.1.2	cpe:2.3:a:postgresql:postgresql:9.1.2:::::::*
postgresql	postgresql	9.1.3	cpe:2.3:a:postgresql:postgresql:9.1.3:::::::*
postgresql	postgresql	9.1.4	cpe:2.3:a:postgresql:postgresql:9.1.4:::::::*
postgresql	postgresql	9.1.5	cpe:2.3:a:postgresql:postgresql:9.1.5:::::::*
postgresql	postgresql	9.1.6	cpe:2.3:a:postgresql:postgresql:9.1.6:::::::*
postgresql	postgresql	9.1.7	cpe:2.3:a:postgresql:postgresql:9.1.7:::::::*
postgresql	postgresql	9.1.8	cpe:2.3:a:postgresql:postgresql:9.1.8:::::::*
postgresql	postgresql	9.1.9	cpe:2.3:a:postgresql:postgresql:9.1.9:::::::*
postgresql	postgresql	9.1.10	cpe:2.3:a:postgresql:postgresql:9.1.10:::::::*
postgresql	postgresql	9.1.11	cpe:2.3:a:postgresql:postgresql:9.1.11:::::::*
postgresql	postgresql	9.2	cpe:2.3:a:postgresql:postgresql:9.2:::::::*
postgresql	postgresql	9.2.1	cpe:2.3:a:postgresql:postgresql:9.2.1:::::::*
postgresql	postgresql	9.2.2	cpe:2.3:a:postgresql:postgresql:9.2.2:::::::*
postgresql	postgresql	9.2.3	cpe:2.3:a:postgresql:postgresql:9.2.3:::::::*
postgresql	postgresql	9.2.4	cpe:2.3:a:postgresql:postgresql:9.2.4:::::::*
postgresql	postgresql	9.2.5	cpe:2.3:a:postgresql:postgresql:9.2.5:::::::*
postgresql	postgresql	9.2.6	cpe:2.3:a:postgresql:postgresql:9.2.6:::::::*
postgresql	postgresql	9.3	cpe:2.3:a:postgresql:postgresql:9.3:::::::*
postgresql	postgresql	9.3.1	cpe:2.3:a:postgresql:postgresql:9.3.1:::::::*
postgresql	postgresql	9.3.2	cpe:2.3:a:postgresql:postgresql:9.3.2:::::::*

References for CVE-2014-0062

URL	Tags
http://archives.neohapsis.com/archives/bugtraq/2014-10/0103.html
http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705
http://lists.opensuse.org/opensuse-updates/2014-03/msg00018.html
http://lists.opensuse.org/opensuse-updates/2014-03/msg00038.html
http://rhn.redhat.com/errata/RHSA-2014-0211.html
http://rhn.redhat.com/errata/RHSA-2014-0221.html
http://rhn.redhat.com/errata/RHSA-2014-0249.html
http://rhn.redhat.com/errata/RHSA-2014-0469.html
http://secunia.com/advisories/61307
http://support.apple.com/kb/HT6448
http://wiki.postgresql.org/wiki/20140220securityrelease	Vendor Advisory
http://www.debian.org/security/2014/dsa-2864
http://www.debian.org/security/2014/dsa-2865
http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
http://www.postgresql.org/about/news/1506/	Vendor Advisory
http://www.securityfocus.com/bid/65727
http://www.ubuntu.com/usn/USN-2120-1
https://support.apple.com/kb/HT6536

URL

CVE-2014-0062

Exploit prediction scoring system (EPSS) score for CVE-2014-0062

Common vulnerability scoring system (CVSS) metrics for CVE-2014-0062

Weakness enumeration for CVE-2014-0062

OS Trackers for CVE-2014-0062

Affected software / configurations for CVE-2014-0062

References for CVE-2014-0062