Release date:
2026-09-04 14:04:18 UTC
Description:
* SECURITY UPDATE: Heap buffer overflow in to_char(timestamptz).
DCH_to_char() copied the timezone abbreviation into a workspace
budgeted at DCH_MAX_ITEM_SIZ bytes per format character with an
unchecked strcpy(), and any client can select a longer POSIX
abbreviation via SET TIME ZONE (CVSS 8.8, arbitrary code execution
as the database OS user).
- debian/patches/CVE-2026-14669.patch: reject POSIX timezone
abbreviations longer than n->key->len * DCH_MAX_ITEM_SIZ in the
TZ/tz items of DCH_to_char() with an error, instead of strcpy()ing
them past the palloc'd buffer (upstream 3d724bf4fd, backpatched to
REL_14_STABLE as the formatting.c hunk of 5fb3c638 and shipped in
14.24; applies verbatim).
- CVE-2026-14669
Updated packages:
-
libecpg-compat3_9.5.25-0ubuntu0.16.04.1+tuxcare.els14_amd64.deb
sha:9edb64300010c45310826e50f3ab03d6aaebbec6
-
libecpg-dev_9.5.25-0ubuntu0.16.04.1+tuxcare.els14_amd64.deb
sha:6b8603e1edc1d7969eef41ab936dc84e48858c74
-
libecpg6_9.5.25-0ubuntu0.16.04.1+tuxcare.els14_amd64.deb
sha:7c9fcf33b20b9f18fa9711350b2ab6904cf011be
-
libpgtypes3_9.5.25-0ubuntu0.16.04.1+tuxcare.els14_amd64.deb
sha:39c7721cc83332ced240e00e9b23ca06c52f5172
-
libpq-dev_9.5.25-0ubuntu0.16.04.1+tuxcare.els14_amd64.deb
sha:b6f8ad92baaea6feee9fccf04e1188801475923d
-
libpq5_9.5.25-0ubuntu0.16.04.1+tuxcare.els14_amd64.deb
sha:1ff1d85fe1d81dbaade34be7fadbad4c6c80757b
-
postgresql-9.5_9.5.25-0ubuntu0.16.04.1+tuxcare.els14_amd64.deb
sha:0ebe1b86a85d6913cc95c851d85a83c7c6bfd800
-
postgresql-client-9.5_9.5.25-0ubuntu0.16.04.1+tuxcare.els14_amd64.deb
sha:d8abe5d219250afe585c987036719fde664df68e
-
postgresql-contrib-9.5_9.5.25-0ubuntu0.16.04.1+tuxcare.els14_amd64.deb
sha:8d8df66b0a3e9bd8831887acf3a7e0c0bd2ff907
-
postgresql-doc-9.5_9.5.25-0ubuntu0.16.04.1+tuxcare.els14_all.deb
sha:48985934dc6336ce07ec401b16b4dbb4580e8b5a
-
postgresql-plperl-9.5_9.5.25-0ubuntu0.16.04.1+tuxcare.els14_amd64.deb
sha:4f534c975d0037ce0ee2cadd2f9283cc70651aef
-
postgresql-plpython-9.5_9.5.25-0ubuntu0.16.04.1+tuxcare.els14_amd64.deb
sha:062ac2042045c93988ae622406b15714fcb073db
-
postgresql-plpython3-9.5_9.5.25-0ubuntu0.16.04.1+tuxcare.els14_amd64.deb
sha:61b3beea489c8e113f4184e9b8e4b388d276f997
-
postgresql-pltcl-9.5_9.5.25-0ubuntu0.16.04.1+tuxcare.els14_amd64.deb
sha:c733f2889e0863b3520fe4283c00014919a3cd36
-
postgresql-server-dev-9.5_9.5.25-0ubuntu0.16.04.1+tuxcare.els14_amd64.deb
sha:616826df3e951fa3178b67b77e8716a2e43d0a4a
Notes:
This page is generated automatically and has not been checked for errors. For clarification or
corrections please contact the
CloudLinux Packaging Team.
