PostgreSQL PL/Java before 1.5.0 allows remote authenticated users to alter type mappings for types they do not own.