The to_char function in PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1 allows remote authenticated users to cause a denial of service (crash) or possibly execute arbitrary code via a (1) large number of digits when processing a numeric formatting template, which triggers a buffer over-read, or (2) crafted timestamp formatting template, which triggers a buffer overflow.

在PostgreSQL 9.0.19之前、9.1.x 之前、9.2.x 之前、9.3.x 之前、9.4.x 之前，`to_char`函数允许远程登录的用户可以通过对数值格式化模板中的大量数字进行处理，导致服务拒绝( crash)或执行任意代码。该函数在处理数值格式化模板时触发缓冲区溢出。

NVD 暂无评分

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

NVD 暂无漏洞类别信息

神龙GPT 暂无漏洞类别信息（请耐心等待）