[CLSA-2026:1788603222] Fix CVE(s): CVE-2026-14669
Type:
security
Severity:
Important
Release date:
2026-09-05 10:29:00 UTC
Description:
* SECURITY UPDATE: Heap buffer overflow in to_char(timestamptz): DCH_to_char() copies the timezone abbreviation into a DCH_MAX_ITEM_SIZ-budgeted workspace with an unchecked strcpy(), and any client can select a longer POSIX abbreviation via SET TIME ZONE (CVSS 8.8, arbitrary code execution as the database OS user) - debian/patches/CVE-2026-14669.patch: Reject POSIX timezone abbreviations that would overflow the TZ/tz item budget in DCH_to_char() with an error instead of strcpy()ing them past the palloc'd buffer (upstream commit 3d724bf, shipped in 14.24 via the REL_14_STABLE carrier 5fb3c63; applies verbatim) - CVE-2026-14669
CVEs fixed:
Updated packages:
  • libecpg-compat3_11.22-0+deb10u2+tuxcare.els3_amd64.deb
    sha:cc4baf460c7f2ce9a9fb5e5f8d20d0f28aef6c5f
  • libecpg-dev_11.22-0+deb10u2+tuxcare.els3_amd64.deb
    sha:b5d4b1a38967b7368292460ffb3c1857c2ba43a3
  • libecpg6_11.22-0+deb10u2+tuxcare.els3_amd64.deb
    sha:b45bdb7ff83e8cf4474cea6eab7254edcd3f4a2f
  • libpgtypes3_11.22-0+deb10u2+tuxcare.els3_amd64.deb
    sha:cfaf4218b65683e879ae36ec77cc18424fea3690
  • libpq-dev_11.22-0+deb10u2+tuxcare.els3_amd64.deb
    sha:0688cbfe64c06bfc7550fc4b6e4f550a1b38a5af
  • libpq5_11.22-0+deb10u2+tuxcare.els3_amd64.deb
    sha:6b35a5a61b975a47ad54aceb3d2aac4552b59438
  • postgresql-11_11.22-0+deb10u2+tuxcare.els3_amd64.deb
    sha:6ecac99c22500e54adb4bc82ca95fde4c299fe66
  • postgresql-client-11_11.22-0+deb10u2+tuxcare.els3_amd64.deb
    sha:5cd3159fc4b53ea27f515bbcf10560406a5c01dc
  • postgresql-doc-11_11.22-0+deb10u2+tuxcare.els3_all.deb
    sha:ec71c74875291198f0283e9d7303f59393b9ddd9
  • postgresql-plperl-11_11.22-0+deb10u2+tuxcare.els3_amd64.deb
    sha:ae57d80cb27e03bea7d378217b009dd0c7704223
  • postgresql-plpython-11_11.22-0+deb10u2+tuxcare.els3_amd64.deb
    sha:680118b826db25bdc939aebfa862b63e5e526213
  • postgresql-plpython3-11_11.22-0+deb10u2+tuxcare.els3_amd64.deb
    sha:8dce90e6cfd9a0bac2c03a395086143e4e0d942a
  • postgresql-pltcl-11_11.22-0+deb10u2+tuxcare.els3_amd64.deb
    sha:cdb3884b3f9cbe8f1c9e70635720dc826229d71d
  • postgresql-server-dev-11_11.22-0+deb10u2+tuxcare.els3_amd64.deb
    sha:b11f3405e2e1cfbfd4ecd36200c25a7e118cea0c
  • libecpg-compat3_11.22-0+deb10u2+tuxcare.els3_arm64.deb
    sha:06310acfc90857804dfaba2e7d5ae8fd97dc06ed
  • libecpg-dev_11.22-0+deb10u2+tuxcare.els3_arm64.deb
    sha:2851d6eff4fa83dbec36acea9c402e91916f27bc
  • libecpg6_11.22-0+deb10u2+tuxcare.els3_arm64.deb
    sha:81ac2fba1e0da30ac8d6d816130942d598eae0f1
  • libpgtypes3_11.22-0+deb10u2+tuxcare.els3_arm64.deb
    sha:86e9a83b7cef693b40d0a70b47fdfe9c537be358
  • libpq-dev_11.22-0+deb10u2+tuxcare.els3_arm64.deb
    sha:5f6ee938c62f22f0d2db5d52d3131d1d717fb23c
  • libpq5_11.22-0+deb10u2+tuxcare.els3_arm64.deb
    sha:e9511c0bd4fbde02f1d24d227dc728eb63bbb0d4
  • postgresql-11_11.22-0+deb10u2+tuxcare.els3_arm64.deb
    sha:7b424a5df5276a03817d86934213461d870eb4dc
  • postgresql-client-11_11.22-0+deb10u2+tuxcare.els3_arm64.deb
    sha:5efdab0b0edde2360118e03b3f227fc974826bc7
  • postgresql-plperl-11_11.22-0+deb10u2+tuxcare.els3_arm64.deb
    sha:5b3285806afee987d5d993d24afb1507590ee11b
  • postgresql-plpython-11_11.22-0+deb10u2+tuxcare.els3_arm64.deb
    sha:f5274787fd47906be53a62f4b42aa6ff9ebf6b13
  • postgresql-plpython3-11_11.22-0+deb10u2+tuxcare.els3_arm64.deb
    sha:c08a52b9cc54f0f7ddf94225e140f768fecfdcff
  • postgresql-pltcl-11_11.22-0+deb10u2+tuxcare.els3_arm64.deb
    sha:21a7b442979f9e8f8c35edb7615ae2b6b0c3ad68
  • postgresql-server-dev-11_11.22-0+deb10u2+tuxcare.els3_arm64.deb
    sha:163abd3990f95cc25cb169ac26692a655be527d9
  • libecpg-compat3_11.22-0+deb10u2+tuxcare.els3_armel.deb
    sha:31c8caab7950b77cea176c0628f416967a72f28a
  • libecpg-dev_11.22-0+deb10u2+tuxcare.els3_armel.deb
    sha:2114dba45684c82803a428292ff41ade3f6005d4
  • libecpg6_11.22-0+deb10u2+tuxcare.els3_armel.deb
    sha:af418618fdf375eb0254c1c5d3d1328c630522e4
  • libpgtypes3_11.22-0+deb10u2+tuxcare.els3_armel.deb
    sha:5ee3a088459f60c34d85b7fcdc0f01f3a2282f28
  • libpq-dev_11.22-0+deb10u2+tuxcare.els3_armel.deb
    sha:261fa407e2d0b9fac594168bc3dab79aaf81f590
  • libpq5_11.22-0+deb10u2+tuxcare.els3_armel.deb
    sha:36a95ba0577a3671d4421a9e812f0c7f58d651d4
  • postgresql-11_11.22-0+deb10u2+tuxcare.els3_armel.deb
    sha:61065b561412b80acc3aa5e57072e6b0325488c5
  • postgresql-client-11_11.22-0+deb10u2+tuxcare.els3_armel.deb
    sha:fe09a743561691aa27e8804a8e3c3b70c4d6764a
  • postgresql-plperl-11_11.22-0+deb10u2+tuxcare.els3_armel.deb
    sha:d08b293d3de02aa6eb00ad6ac7efb7c75b3c7135
  • postgresql-plpython-11_11.22-0+deb10u2+tuxcare.els3_armel.deb
    sha:5b932bca7f3627f43ac9dd93975e659e626d9555
  • postgresql-plpython3-11_11.22-0+deb10u2+tuxcare.els3_armel.deb
    sha:23a042e5c92fc695181095ebe58b998b1711ae4d
  • postgresql-pltcl-11_11.22-0+deb10u2+tuxcare.els3_armel.deb
    sha:734b5538d2cdb5b49340df97645fde573f1553ab
  • postgresql-server-dev-11_11.22-0+deb10u2+tuxcare.els3_armel.deb
    sha:7d85d8f0d3d2dceeed8ebc78c0c2d2333d6ba3b2
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.