Release date:
2026-09-07 12:45:51 UTC
Description:
* SECURITY UPDATE: Heap buffer overflow in to_char(timestamptz).
DCH_to_char() copies the timezone abbreviation into a
DCH_MAX_ITEM_SIZ-budgeted workspace with an unchecked strcpy(), and
any client can select a longer POSIX abbreviation via SET TIME ZONE
(CVSS 8.8, arbitrary code execution as the database OS user).
- debian/patches/CVE-2026-14669.patch: reject POSIX timezone
abbreviations longer than n->key->len * DCH_MAX_ITEM_SIZ in the
TZ/tz items of DCH_to_char() with an error, instead of strcpy()ing
them past the palloc'd buffer (upstream 3d724bf4fd by Tom Lane,
carried on REL_14_STABLE inside 5fb3c63 and shipped in 14.24;
applies verbatim to 12.22).
- CVE-2026-14669
Updated packages:
-
libecpg-compat3_12.22-0ubuntu0.20.04.4+tuxcare.els2_amd64.deb
sha:bf0e61b70cc416322b6ede4ac6432ae6bf3a3756
-
libecpg-dev_12.22-0ubuntu0.20.04.4+tuxcare.els2_amd64.deb
sha:a9f2a0e29e27a8c6ff6c79de3240e5b87c63e852
-
libecpg6_12.22-0ubuntu0.20.04.4+tuxcare.els2_amd64.deb
sha:feb61d07d63baf4ec6cfd8c5deba36dfa201fe05
-
libpgtypes3_12.22-0ubuntu0.20.04.4+tuxcare.els2_amd64.deb
sha:fcfbd079f9e5719dd817b8daaf2bc4c45f2e2dee
-
libpq-dev_12.22-0ubuntu0.20.04.4+tuxcare.els2_amd64.deb
sha:d2f50777c669228a2b0b72e64c4ededfb6488268
-
libpq5_12.22-0ubuntu0.20.04.4+tuxcare.els2_amd64.deb
sha:589188303bad8fd49de9ca84b20aba03323e0197
-
postgresql-12_12.22-0ubuntu0.20.04.4+tuxcare.els2_amd64.deb
sha:95191f7f5286ccf247465565d59aa02e22fed9d2
-
postgresql-client-12_12.22-0ubuntu0.20.04.4+tuxcare.els2_amd64.deb
sha:74abd87a584e14a96baa69d2a5e7fe781433d60a
-
postgresql-doc-12_12.22-0ubuntu0.20.04.4+tuxcare.els2_all.deb
sha:955ff0b8b7ea508b01af4b47f21e9582325b7511
-
postgresql-plperl-12_12.22-0ubuntu0.20.04.4+tuxcare.els2_amd64.deb
sha:02cb62245445fb585dff14f30252f9f14a439d18
-
postgresql-plpython3-12_12.22-0ubuntu0.20.04.4+tuxcare.els2_amd64.deb
sha:3e95a559e5d027c5202023c9f92025f82dff9362
-
postgresql-pltcl-12_12.22-0ubuntu0.20.04.4+tuxcare.els2_amd64.deb
sha:dd7b0061a424000698ac8a1c98b8df3dcb5277ac
-
postgresql-server-dev-12_12.22-0ubuntu0.20.04.4+tuxcare.els2_amd64.deb
sha:b41b16af219f7726a316b6a38923971273d47e32
-
libecpg-compat3_12.22-0ubuntu0.20.04.4+tuxcare.els2_arm64.deb
sha:35c2a2127f89ae1b0db12b8d8fd6f5acb969e4cf
-
libecpg-dev_12.22-0ubuntu0.20.04.4+tuxcare.els2_arm64.deb
sha:34778514bbe0c6b6aec477f65a98f843c7add916
-
libecpg6_12.22-0ubuntu0.20.04.4+tuxcare.els2_arm64.deb
sha:d19112d9c580c88e7421e6718c1a18cf3ecaad2d
-
libpgtypes3_12.22-0ubuntu0.20.04.4+tuxcare.els2_arm64.deb
sha:41938a60c46eff3945f7f5da99a3c0b1393f626c
-
libpq-dev_12.22-0ubuntu0.20.04.4+tuxcare.els2_arm64.deb
sha:1cb5576d088d4dae887ba2550bf9b27842334118
-
libpq5_12.22-0ubuntu0.20.04.4+tuxcare.els2_arm64.deb
sha:a455aa8df50e8daa7b54f20043a8d2279956bec3
-
postgresql-12_12.22-0ubuntu0.20.04.4+tuxcare.els2_arm64.deb
sha:b261781b47da21db12268fac348d086cf0e54946
-
postgresql-client-12_12.22-0ubuntu0.20.04.4+tuxcare.els2_arm64.deb
sha:9d567f50cf059abce4f7abf43651ba84ed5400ef
-
postgresql-plperl-12_12.22-0ubuntu0.20.04.4+tuxcare.els2_arm64.deb
sha:42fdf24c531004527795507ba0eb79886477181e
-
postgresql-plpython3-12_12.22-0ubuntu0.20.04.4+tuxcare.els2_arm64.deb
sha:a18902c02292c9eb8b58632062a85f229e00cc80
-
postgresql-pltcl-12_12.22-0ubuntu0.20.04.4+tuxcare.els2_arm64.deb
sha:edde311e468e7a3fb8dbdf0b8def6d3b62ac00c5
-
postgresql-server-dev-12_12.22-0ubuntu0.20.04.4+tuxcare.els2_arm64.deb
sha:8c2ab7f929d94f2e7dbe90b49e85a105ba711834
Notes:
This page is generated automatically and has not been checked for errors. For clarification or
corrections please contact the
CloudLinux Packaging Team.
