Candidate: CVE-2015-4054
PublicDate: 2017-05-23 04:29:00 UTC
References:
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4054
 https://github.com/pgbouncer/pgbouncer/issues/42
 http://www.openwall.com/lists/oss-security/2015/05/21/2
Description:
 PgBouncer before 1.5.5 allows remote attackers to cause a denial of service
 (NULL pointer dereference and crash) by sending a password packet before a
 startup packet.
Ubuntu-Description:
Notes:
Bugs:
Priority: medium
Discovered-by:
Assigned-to:
CVSS:
 nvd: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H [7.5 HIGH]

Patches_pgbouncer:
 upstream: https://github.com/pgbouncer/pgbouncer/commit/edab5be6665b9e8de66c25ba527509b229468573 (master)
 upstream: https://github.com/pgbouncer/pgbouncer/commit/74d6e5f7de5ec736f71204b7b422af7380c19ac5 (stable-1.5)
upstream_pgbouncer: released (1.5.5-1)
precise_pgbouncer: ignored (reached end-of-life)
precise/esm_pgbouncer: DNE (precise was needs-triage)
trusty_pgbouncer: ignored (reached end-of-life)
trusty/esm_pgbouncer: DNE (trusty was needed)
utopic_pgbouncer: ignored (reached end-of-life)
vivid_pgbouncer: ignored (reached end-of-life)
vivid/stable-phone-overlay_pgbouncer: DNE
vivid/ubuntu-core_pgbouncer: DNE
wily_pgbouncer: not-affected (1.5.5-1)
xenial_pgbouncer: not-affected (1.5.5-1)
yakkety_pgbouncer: not-affected (1.5.5-1)
zesty_pgbouncer: not-affected (1.5.5-1)
artful_pgbouncer: not-affected (1.5.5-1)
bionic_pgbouncer: not-affected (1.5.5-1)
cosmic_pgbouncer: not-affected (1.5.5-1)
disco_pgbouncer: not-affected (1.5.5-1)
devel_pgbouncer: not-affected (1.5.5-1)