CVE-2007-2138: Canonical Ubuntu Linux

Medium severity, CVSS 6.0. EPSS: 3.7% chance of exploitation in the next 30 days.

Untrusted search path vulnerability in PostgreSQL before 7.3.19, 7.4.x before 7.4.17, 8.0.x before 8.0.13, 8.1.x before 8.1.9, and 8.2.x before 8.2.4 allows remote authenticated users, when permitted to call a SECURITY DEFINER function, to gain the privileges of the function owner, related to "search_path settings."

Affected products

• Canonical Ubuntu Linux: version 6.06 only; version 6.10 only; version 7.04 only
• Debian Debian Linux: version 3.1 only; version 4.0 only
• PostgreSQL PostgreSQL: before 7.3.19 (fixed in 7.3.19); from 7.4, before 7.4.17 (fixed in 7.4.17); from 8.0, before 8.0.13 (fixed in 8.0.13); from 8.1, before 8.1.9 (fixed in 8.1.9); from 8.2, before 8.2.4 (fixed in 8.2.4)

Published 2007-04-24. Last modified 2026-06-16.