Sicherheit: Mehrere Probleme in postgresql
Linux 9.
Red Hat Product Security has rated this update as having a security impact of
Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
PostgreSQL is an advanced object-relational database management system (DBMS).
Security Fix(es):
* postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in
tsvector and tsquery functions (CVE-2026-14662)
* postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion
in pg_dump (CVE-2026-18408)
* postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data
in COPY FROM STDIN (CVE-2026-6464)
* postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin
(CVE-2026-6471)
* postgresql: PostgreSQL: Arbitrary code execution via type confusion with
“internal” arguments (CVE-2026-14680)
* postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in
regexp (CVE-2026-14664)
* postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit
pltcl and plperl (CVE-2026-14677)
* postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution
via integer wraparound (CVE-2026-15742)
* postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor
lifecycle (CVE-2026-16239)
* postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone
abbreviation (CVE-2026-14669)
* postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count
manipulation (CVE-2026-14679)
* postgresql: PostgreSQL: Arbitrary code execution via type confusion in
‘refint’ module (CVE-2026-14671)
* postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap
buffer overflow (CVE-2026-14670)
* postgresql: PostgreSQL: Information disclosure via type confusion in ctid
selectivity estimator (CVE-2026-14668)
* postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted
transform lists (CVE-2026-19385)
* postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT()
deparse (CVE-2026-15741)
* postgis: PostGIS: Memory Disclosure and Denial of Service via Malformed
FlatGeobuf Buffer (CVE-2026-73515)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
This content is licensed under the Creative Commons Attribution 4.0 International License (creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
CVE-2026-6464: Inclusion of Functionality from Untrusted Control Sphere
(CWE-829)
CVE-2026-6471: Improper Control of Generation of Code (‘Code
Injection’) (CWE-94)
CVE-2026-14662: Out-of-bounds Write (CWE-787)
CVE-2026-14664: Heap-based Buffer Overflow (CWE-122)
CVE-2026-14668: Access of Resource Using Incompatible Type (‘Type
Confusion’) (CWE-843)
CVE-2026-14669: Heap-based Buffer Overflow (CWE-122)
CVE-2026-14670: Buffer Access with Incorrect Length Value (CWE-805)
CVE-2026-14671: Access of Resource Using Incompatible Type (‘Type
Confusion’) (CWE-843)
CVE-2026-14677: Integer Overflow or Wraparound (CWE-190)
CVE-2026-14679: Stack-based Buffer Overflow (CWE-121)
CVE-2026-14680: Access of Resource Using Incompatible Type (‘Type
Confusion’) (CWE-843)
CVE-2026-15741: Improper Neutralization of Special Elements used in an SQL
Command (‘SQL Injection’) (CWE-89)
CVE-2026-15742: Integer Overflow or Wraparound (CWE-190)
CVE-2026-16239: Access of Resource Using Incompatible Type (‘Type
Confusion’) (CWE-843)
CVE-2026-18408: Inclusion of Functionality from Untrusted Control Sphere
(CWE-829)
CVE-2026-19385: Heap-based Buffer Overflow (CWE-122)
CVE-2026-73515: Out-of-bounds Read (CWE-125)
Read more here: Source link