CVE-2016-5424
Status: ModifiedHigh (7.1)—
PostgreSQL before 9.1.23, 9.2.x before 9.2.18, 9.3.x before 9.3.14, 9.4.x before 9.4.9, and 9.5.x before 9.5.4 might allow remote authenticated users with the CREATEDB or CREATEROLE role to gain superuser privileges via a (1) " (double quote), (2) \ (backslash), (3) carriage return, or (4) newline character in a (a) database or (b) role name that is mishandled during an administrative operation.
CVSS
- Version: 3.0
- Vector: CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
- Base score: 7.1
Exploitation probability (EPSS)
- Probability of exploitation in the next 30 days: 4.61%
- Percentile among all scored CVEs: 91
- Score date: 10/7/2026
EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).
Affected technologies (2)
CWEs
- CWE-94
References
- http://rhn.redhat.com/errata/RHSA-2016-1781.html
- http://rhn.redhat.com/errata/RHSA-2016-1820.html
- http://rhn.redhat.com/errata/RHSA-2016-1821.html
- http://rhn.redhat.com/errata/RHSA-2016-2606.html
- http://www.debian.org/security/2016/dsa-3646
- http://www.securityfocus.com/bid/92435
- http://www.securitytracker.com/id/1036617
- https://access.redhat.com/errata/RHSA-2017:2425
- https://security.gentoo.org/glsa/201701-33
- https://www.postgresql.org/about/news/1688/
- https://www.postgresql.org/docs/current/static/release-9-1-23.html
- https://www.postgresql.org/docs/current/static/release-9-2-18.html
- https://www.postgresql.org/docs/current/static/release-9-3-14.html
- https://www.postgresql.org/docs/current/static/release-9-4-9.html
- https://www.postgresql.org/docs/current/static/release-9-5-4.html
- http://rhn.redhat.com/errata/RHSA-2016-1781.html
- http://rhn.redhat.com/errata/RHSA-2016-1820.html
- http://rhn.redhat.com/errata/RHSA-2016-1821.html
- http://rhn.redhat.com/errata/RHSA-2016-2606.html
- http://www.debian.org/security/2016/dsa-3646
- http://www.securityfocus.com/bid/92435
- http://www.securitytracker.com/id/1036617
- https://access.redhat.com/errata/RHSA-2017:2425
- https://security.gentoo.org/glsa/201701-33
- https://www.postgresql.org/about/news/1688/
- https://www.postgresql.org/docs/current/static/release-9-1-23.html
- https://www.postgresql.org/docs/current/static/release-9-2-18.html
- https://www.postgresql.org/docs/current/static/release-9-3-14.html
- https://www.postgresql.org/docs/current/static/release-9-4-9.html
- https://www.postgresql.org/docs/current/static/release-9-5-4.html
Raw JSON (NVD)
Show
{
"id": "CVE-2016-5424",
"cveTags": [],
"metrics": {
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 4.6,
"accessVector": "NETWORK",
"vectorString": "AV:N/AC:H/Au:S/C:P/I:P/A:P",
"authentication": "SINGLE",
"integrityImpact": "PARTIAL",
"accessComplexity": "HIGH",
"availabilityImpact": "PARTIAL",
"confidentialityImpact": "PARTIAL"
},
"acInsufInfo": false,
"impactScore": 6.4,
"baseSeverity": "MEDIUM",
"obtainAllPrivilege": false,
"exploitabilityScore": 3.9,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": true
}
],
"cvssMetricV30": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.0",
"baseScore": 7.1,
"attackVector": "NETWORK",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H",
"integrityImpact": "HIGH",
"userInteraction": "REQUIRED",
"attackComplexity": "HIGH",
"availabilityImpact": "HIGH",
"privilegesRequired": "LOW",
"confidentialityImpact": "HIGH"
},
"impactScore": 5.9,
"exploitabilityScore": 1.2
}
]
},
"affected": [
{
"source": "secalert@redhat.com",
"affectedData": [
{
"vendor": "n/a",
"product": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
]
}
],
"published": "2016-12-09T23:59:02.050",
"references": [
{
"url": "http://rhn.redhat.com/errata/RHSA-2016-1781.html",
"source": "secalert@redhat.com"
},
{
"url": "http://rhn.redhat.com/errata/RHSA-2016-1820.html",
"source": "secalert@redhat.com"
},
{
"url": "http://rhn.redhat.com/errata/RHSA-2016-1821.html",
"source": "secalert@redhat.com"
},
{
"url": "http://rhn.redhat.com/errata/RHSA-2016-2606.html",
"source": "secalert@redhat.com"
},
{
"url": "http://www.debian.org/security/2016/dsa-3646",
"tags": [
"Third Party Advisory"
],
"source": "secalert@redhat.com"
},
{
"url": "http://www.securityfocus.com/bid/92435",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"source": "secalert@redhat.com"
},
{
"url": "http://www.securitytracker.com/id/1036617",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"source": "secalert@redhat.com"
},
{
"url": "https://access.redhat.com/errata/RHSA-2017:2425",
"source": "secalert@redhat.com"
},
{
"url": "https://security.gentoo.org/glsa/201701-33",
"source": "secalert@redhat.com"
},
{
"url": "https://www.postgresql.org/about/news/1688/",
"tags": [
"Patch",
"Third Party Advisory",
"VDB Entry"
],
"source": "secalert@redhat.com"
},
{
"url": "https://www.postgresql.org/docs/current/static/release-9-1-23.html",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"source": "secalert@redhat.com"
},
{
"url": "https://www.postgresql.org/docs/current/static/release-9-2-18.html",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"source": "secalert@redhat.com"
},
{
"url": "https://www.postgresql.org/docs/current/static/release-9-3-14.html",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"source": "secalert@redhat.com"
},
{
"url": "https://www.postgresql.org/docs/current/static/release-9-4-9.html",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"source": "secalert@redhat.com"
},
{
"url": "https://www.postgresql.org/docs/current/static/release-9-5-4.html",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"source": "secalert@redhat.com"
},
{
"url": "http://rhn.redhat.com/errata/RHSA-2016-1781.html",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://rhn.redhat.com/errata/RHSA-2016-1820.html",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://rhn.redhat.com/errata/RHSA-2016-1821.html",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://rhn.redhat.com/errata/RHSA-2016-2606.html",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.debian.org/security/2016/dsa-3646",
"tags": [
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.securityfocus.com/bid/92435",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.securitytracker.com/id/1036617",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://access.redhat.com/errata/RHSA-2017:2425",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://security.gentoo.org/glsa/201701-33",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://www.postgresql.org/about/news/1688/",
"tags": [
"Patch",
"Third Party Advisory",
"VDB Entry"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://www.postgresql.org/docs/current/static/release-9-1-23.html",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://www.postgresql.org/docs/current/static/release-9-2-18.html",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://www.postgresql.org/docs/current/static/release-9-3-14.html",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://www.postgresql.org/docs/current/static/release-9-4-9.html",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://www.postgresql.org/docs/current/static/release-9-5-4.html",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-94"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "PostgreSQL before 9.1.23, 9.2.x before 9.2.18, 9.3.x before 9.3.14, 9.4.x before 9.4.9, and 9.5.x before 9.5.4 might allow remote authenticated users with the CREATEDB or CREATEROLE role to gain superuser privileges via a (1) \" (double quote), (2) \\ (backslash), (3) carriage return, or (4) newline character in a (a) database or (b) role name that is mishandled during an administrative operation."
},
{
"lang": "es",
"value": "PostgreSQL en versiones anteriores a 9.1.23, 9.2.x en versiones anteriores a 9.2.18, 9.3.x en versiones anteriores a 9.3.14, 9.4.x en versiones anteriores a 9.4.9 y 9.5.x en versiones anteriores a 9.5.4 podrían permitir a usuarios remotos autenticados con el rol CREATEDB o CREATEROLE obtener privilegios de superusuario a través de un carácter (1) \" (comillas dobles), (2) \\ (barra invertida), (3) retorno de carro o (4) nueva linea en (a) una base de datos o (b) el nombre del rol que se maneja incorrectamente durante una operación administrativa."
}
],
"lastModified": "2026-06-17T00:49:23.290",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "4CB60B43-0107-45CB-A520-7135515095F6",
"versionEndIncluding": "9.1.22"
},
{
"criteria": "cpe:2.3:a:postgresql:postgresql:9.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "AD27648F-E2FF-4779-97F9-2632DCC6B16D"
},
{
"criteria": "cpe:2.3:a:postgresql:postgresql:9.2.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "CEFB4916-8B59-4534-804C-CF9DA1B18508"
},
{
"criteria": "cpe:2.3:a:postgresql:postgresql:9.2.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3413A3AB-45A3-48E1-9B30-1194C4E7D49D"
},
{
"criteria": "cpe:2.3:a:postgresql:postgresql:9.2.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5760CE83-4802-42A0-9338-E1E634882450"
},
{
"criteria": "cpe:2.3:a:postgresql:postgresql:9.2.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6B41009E-4028-4D82-B8D0-8B949EDC0A68"
},
{
"criteria": "cpe:2.3:a:postgresql:postgresql:9.2.5:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "832F3EBE-A92C-4FB3-BF3C-0E7B750F966B"
},
{
"criteria": "cpe:2.3:a:postgresql:postgresql:9.2.6:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "1571EE80-55A6-4F91-909B-C46BA19EC76F"
},
{
"criteria": "cpe:2.3:a:postgresql:postgresql:9.2.7:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2848E3BC-293A-4A75-BEB7-C2F1637AD3E0"
},
{
"criteria": "cpe:2.3:a:postgresql:postgresql:9.2.8:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "ADC9133E-94FC-4199-BD69-BBB46CF3799F"
},
{
"criteria": "cpe:2.3:a:postgresql:postgresql:9.2.9:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "200172CE-40AB-49E3-93D1-9947E3CBFFF8"
},
{
"criteria": "cpe:2.3:a:postgresql:postgresql:9.2.10:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E90B21A9-19A7-4DCB-A2FE-C558CCB6BBB1"
},
{
"criteria": "cpe:2.3:a:postgresql:postgresql:9.2.11:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "924D1F84-EC50-44C3-A156-DC8E3A5E3909"
},
{
"criteria": "cpe:2.3:a:postgresql:postgresql:9.2.12:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "4A5EAF3B-B148-4B57-8E4E-0B5365003DFC"
},
{
"criteria": "cpe:2.3:a:postgresql:postgresql:9.2.13:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D5CE8DB4-CD97-4F60-9080-9FB093BD60CA"
},
{
"criteria": "cpe:2.3:a:postgresql:postgresql:9.2.14:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9B5AA780-4378-4959-9256-510C65E6E5B5"
},
{
"criteria": "cpe:2.3:a:postgresql:postgresql:9.2.15:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "74C9EB31-5D8E-4583-BC95-700F53854964"
},
{
"criteria": "cpe:2.3:a:postgresql:postgresql:9.2.16:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3700FF66-108C-47C2-B4C2-1CB0B5575EDA"
},
{
"criteria": "cpe:2.3:a:postgresql:postgresql:9.2.17:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "239F26B4-CFB2-4D7A-939E-0215A336A490"
},
{
"criteria": "cpe:2.3:a:postgresql:postgresql:9.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5B890251-95EB-44F3-A6A7-F718F3C807B0"
},
{
"criteria": "cpe:2.3:a:postgresql:postgresql:9.3.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D2E5BD02-8C3D-4687-88DE-1C00366270E7"
},
{
"criteria": "cpe:2.3:a:postgresql:postgresql:9.3.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "709F5DF9-9F3A-42C3-890B-521B13118C0E"
},
{
"criteria": "cpe:2.3:a:postgresql:postgresql:9.3.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "14D85A34-C897-4E52-8F97-18CA51C5461A"
},
{
"criteria": "cpe:2.3:a:postgresql:postgresql:9.3.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A40DAD2B-A6D4-43D8-B282-A3C672356D6A"
},
{
"criteria": "cpe:2.3:a:postgresql:postgresql:9.3.5:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "FC2FE391-9414-480E-A9B1-CF70280E315E"
},
{
"criteria": "cpe:2.3:a:postgresql:postgresql:9.3.6:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "55B6A4ED-FA3B-4251-BF82-755F95277CF9"
},
{
"criteria": "cpe:2.3:a:postgresql:postgresql:9.3.7:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C7142DF3-124D-43D7-ADD9-70F4F7298557"
},
{
"criteria": "cpe:2.3:a:postgresql:postgresql:9.3.8:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "28DEA438-A0ED-49DC-AE51-4E9D8D4B6E7B"
},
{
"criteria": "cpe:2.3:a:postgresql:postgresql:9.3.9:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "810B184F-6FB8-48D8-A569-F47BA43C4862"
},
{
"criteria": "cpe:2.3:a:postgresql:postgresql:9.3.10:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "064BF155-7E2D-47B9-BD2B-C6E9FC06F5FC"
},
{
"criteria": "cpe:2.3:a:postgresql:postgresql:9.3.11:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "676A81BD-7EEE-4770-B9AC-451B09844D6C"
},
{
"criteria": "cpe:2.3:a:postgresql:postgresql:9.3.12:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "30F23D38-BDD6-48E6-A6B2-29CD962EED99"
},
{
"criteria": "cpe:2.3:a:postgresql:postgresql:9.3.13:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "89833234-3890-4E2E-8FCF-09925D83ED67"
},
{
"criteria": "cpe:2.3:a:postgresql:postgresql:9.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "77D1323D-3096-4D0F-823A-ECAC9017646D"
},
{
"criteria": "cpe:2.3:a:postgresql:postgresql:9.4.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8A587AF3-5E70-4455-8621-DFD048207DE2"
},
{
"criteria": "cpe:2.3:a:postgresql:postgresql:9.4.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "526AFF26-B3EC-41C3-AC4C-85BFA3F99AC8"
},
{
"criteria": "cpe:2.3:a:postgresql:postgresql:9.4.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "89D2CAB7-C3D9-4F21-B902-2E498D00EFEB"
},
{
"criteria": "cpe:2.3:a:postgresql:postgresql:9.4.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "88797795-8B1C-455F-8C52-6169B2E47D53"
},
{
"criteria": "cpe:2.3:a:postgresql:postgresql:9.4.5:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "DBDE0CC8-F1DF-4723-8FCB-9A33EA8B12D3"
},
{
"criteria": "cpe:2.3:a:postgresql:postgresql:9.4.6:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "90F13667-019B-49DF-929C-3D376FCDE6E4"
},
{
"criteria": "cpe:2.3:a:postgresql:postgresql:9.4.7:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B9E20AA3-C0D3-492C-AF3B-9F61550E6983"
},
{
"criteria": "cpe:2.3:a:postgresql:postgresql:9.4.8:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "251C78CA-EEC0-49A8-A3D2-3C86D16CCB7F"
},
{
"criteria": "cpe:2.3:a:postgresql:postgresql:9.5:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9FF7FC5B-C9E3-4109-B3D6-9AC06F75DCB3"
},
{
"criteria": "cpe:2.3:a:postgresql:postgresql:9.5.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D2C15A86-9ED9-492E-877B-86963DAA761A"
},
{
"criteria": "cpe:2.3:a:postgresql:postgresql:9.5.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9EF74623-EF0E-455D-ADEB-9E336B539D86"
},
{
"criteria": "cpe:2.3:a:postgresql:postgresql:9.5.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "FACD7AB7-34E9-4DFC-A788-7B9BF745D780"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "secalert@redhat.com"
}