{"schemaVersion":3,"id":"MGASA-2026-0347","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"Updated postgresql18 & postgresql15 packages fix security vulnerabilities\n\npsql COPY FROM STDIN early failure processes data lines as psql\ncommands. (CVE-2026-6464)\nALTER TABLE ALTER TYPE resets extended statistics ownership.\n(CVE-2026-6469)\nFails to check type USAGE privilege. (CVE-2026-6470)\nLogical decoding can dlopen arbitrary file. (CVE-2026-6471)\ntsvector and tsquery undersize allocations, via integer wraparound.\n(CVE-2026-14662)\npgcrypto, for OpenSSL-disabled ciphers, silently encrypts to and\ndecrypts from cleartext. (CVE-2026-14663)\nRegexp heap buffer overflow executes arbitrary code. (CVE-2026-14664)\nRow security caching disregards role modifications. (CVE-2026-14666)\nctid type confusion in selectivity estimator discloses derivative of\narbitrary read. (CVE-2026-14668)\nto_char heap buffer overflow executes arbitrary code. (CVE-2026-14669)\nplperl tied object heap buffer overflow executes arbitrary code.\n(CVE-2026-14670)\nrefint plan cache type confusion executes arbitrary code.\n(CVE-2026-14671)\nObservable response discrepancy with non-default scram_iterations\nprovides user existence oracle. (CVE-2026-14672)\namcheck does not clear untrusted search path. (CVE-2026-14673)\npg_stat_statements heap buffer overflow executes arbitrary code.\n(CVE-2026-14676)\n32-bit pltcl and plperl undersize allocations, via integer wraparound.\n(CVE-2026-14677)\npg_trgm picksplit reads past end of buffer. (CVE-2026-14678)\nStack buffer overflow in argument match writes 0x0 and 0x1 to server\nmemory. (CVE-2026-14679)\nType confusion via \"internal\" arguments. (CVE-2026-14680)\nImproper enforcement of GSSAPI encryption when coupled with SSL.\n(CVE-2026-14681)\nExpression deparse allows SQL injection via EXTRACT argument.\n(CVE-2026-15741)\nfuzzystrmatch writes effectively-arbitrary addresses, via integer\nwraparound. (CVE-2026-15742)\nType confusion in pg_restore_attribute_stats() executes arbitrary code.\n(CVE-2026-16238)\nType confusion in cursor CLOSE + DECLARE executes arbitrary code.\n(CVE-2026-16239)\nECPG integer underflow can crash the client. (CVE-2026-16241)\nascii() function reads past end of buffer. (CVE-2026-18024)\npsql \\unrestrict lets superuser of pg_dump origin server execute\narbitrary code in psql client. (CVE-2026-18408)\npg_dump heap buffer overflow executes arbitrary code. (CVE-2026-19385)","dates":{"published":"2026-08-31T16:22:02.000Z","modified":"2026-08-31T16:41:22.878Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":null,"severity":"unknown","version":null,"versionLabel":null,"source":null,"vector":null,"computed":false,"selection":"none"},"metrics":[]},"epss":{"probability":null,"percentile":null,"severity":"unknown","asOf":null,"change":{"pp":null,"baselineDate":null,"baselineScore":null},"history":[],"last30":[]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[],"affected":[{"vendor":"mageia","product":"postgresql15","name":"postgresql15","label":"postgresql15","ecosystem":"Mageia","cpePart":null,"purl":"pkg:rpm/mageia/postgresql15","purlType":"rpm","versions":[{"text":"< 15.19-1.mga10","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 15.19-1.mga10","eol":null,"hubHref":null},{"vendor":"mageia","product":"postgresql18","name":"postgresql18","label":"postgresql18","ecosystem":"Mageia","cpePart":null,"purl":"pkg:rpm/mageia/postgresql18","purlType":"rpm","versions":[{"text":"< 18.6-1.mga10","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 18.6-1.mga10","eol":null,"hubHref":null},{"vendor":"mageia","product":"postgresql15","name":"postgresql15","label":"postgresql15","ecosystem":"Mageia","cpePart":null,"purl":"pkg:rpm/mageia/postgresql15","purlType":"rpm","versions":[{"text":"< 15.19-1.mga9","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 15.19-1.mga9","eol":null,"hubHref":null}],"affectedCount":3,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://advisories.mageia.org/MGASA-2026-0347.html","label":"advisories.mageia.org/MGASA-2026-0347.html","hostname":"advisories.mageia.org","tags":["Advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=36165","label":"bugs.mageia.org/show_bug.cgi?id=36165","hostname":"bugs.mageia.org","tags":["REPORT"]},{"url":"https://www.postgresql.org/about/news/postgresql-186-1711-1615-1519-1424-and-19-beta-3-released-3365/","label":"www.postgresql.org/about/news/postgresql-186-1711-1615-1519-1424-and-19-beta-3-released-3365/","hostname":"www.postgresql.org","tags":["WEB"]}],"lineage":{"upstream":["CVE-2026-14662","CVE-2026-14663","CVE-2026-14664","CVE-2026-14666","CVE-2026-14668","CVE-2026-14669","CVE-2026-14670","CVE-2026-14671","CVE-2026-14672","CVE-2026-14673","CVE-2026-14676","CVE-2026-14677","CVE-2026-14678","CVE-2026-14679","CVE-2026-14680","CVE-2026-14681","CVE-2026-15741","CVE-2026-15742","CVE-2026-16238","CVE-2026-16239","CVE-2026-16241","CVE-2026-18024","CVE-2026-18408","CVE-2026-19385","CVE-2026-6464","CVE-2026-6469","CVE-2026-6470","CVE-2026-6471"],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2026-08-31T16:22:02.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-08-31T16:41:22.878Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":0,"level":"minimal","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T12:24:15.029Z","stale":false,"partial":false}}