[CLSA-2026:1788163557] Fix CVE(s): CVE-2026-14669
Type:
security
Severity:
Important
Release date:
2026-08-31 08:06:08 UTC
Description:
* SECURITY UPDATE: Heap buffer overflow in to_char(timestamptz): DCH_to_char() copies the timezone abbreviation into a DCH_MAX_ITEM_SIZ-budgeted workspace with an unchecked strcpy(), and any client can select a longer POSIX abbreviation via SET TIME ZONE (CVSS 8.8, arbitrary code execution as the database OS user) - debian/patches/CVE-2026-14669.patch: Reject POSIX timezone abbreviations that would overflow the TZ/tz item budget in DCH_to_char() with an error instead of strcpy()ing them past the palloc'd buffer (upstream commit 12a620686, shipped in 14.24 via the REL_14_STABLE carrier 5fb3c63; applies verbatim) - CVE-2026-14669
CVEs fixed:
Updated packages:
  • libecpg-compat3-9.6_9.6.24-0+deb10u1+tuxcare.els4_amd64.deb
    sha:365f29c0ed453fcbb36ac1d9a40bbbc7f462cb10
  • libecpg-dev-9.6_9.6.24-0+deb10u1+tuxcare.els4_amd64.deb
    sha:75597011cb17e9f024adf24761716a2d11b0e94a
  • libecpg6-9.6_9.6.24-0+deb10u1+tuxcare.els4_amd64.deb
    sha:c04ac32b35cac08ca1f12fdfdfc6f918465d60a7
  • libpgtypes3-9.6_9.6.24-0+deb10u1+tuxcare.els4_amd64.deb
    sha:ba6b7cac507be144450b7c10ee350f259b534a4d
  • libpq-dev-9.6_9.6.24-0+deb10u1+tuxcare.els4_amd64.deb
    sha:11209ecdae47fa03ae2dae59dfd6129d8c44e755
  • libpq5-9.6_9.6.24-0+deb10u1+tuxcare.els4_amd64.deb
    sha:e28c6181a70d955cc9fb4926e19d71bbced73fc3
  • postgresql-9.6_9.6.24-0+deb10u1+tuxcare.els4_amd64.deb
    sha:f28abffb903efcc11f749e5cef8f861b488de13b
  • postgresql-client-9.6_9.6.24-0+deb10u1+tuxcare.els4_amd64.deb
    sha:c7ed464a01cc40ef0896d037aa64bc8cff1df584
  • postgresql-contrib-9.6_9.6.24-0+deb10u1+tuxcare.els4_amd64.deb
    sha:21bb5c7fc34ef42d05885dd3a413514ef2ee50d2
  • postgresql-doc-9.6_9.6.24-0+deb10u1+tuxcare.els4_all.deb
    sha:ea210ef8f0f938f71a0d8738aaf251be10a04b7f
  • postgresql-plperl-9.6_9.6.24-0+deb10u1+tuxcare.els4_amd64.deb
    sha:714a5edd3f8f07d758b19f558bd7b3989d425772
  • postgresql-plpython-9.6_9.6.24-0+deb10u1+tuxcare.els4_amd64.deb
    sha:f27479829fe01bce7cafa9fd10526203aa20ef07
  • postgresql-plpython3-9.6_9.6.24-0+deb10u1+tuxcare.els4_amd64.deb
    sha:7b3fb7a874a5b2fe1f4ff7279f86ac75f6ec8e19
  • postgresql-pltcl-9.6_9.6.24-0+deb10u1+tuxcare.els4_amd64.deb
    sha:24f85f815aba0e4c81ddc1306016383659824db0
  • postgresql-server-dev-9.6_9.6.24-0+deb10u1+tuxcare.els4_amd64.deb
    sha:0eeb55224af1b447ef659e669d9d6c334e3fa2f6
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.