{"schemaVersion":3,"id":"SUSE-SU-2026:4017-1","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"Security update for postgresql15\n\nThis update for postgresql15 fixes the following issues:\n\n- CVE-2026-6464: `psql` `COPY FROM STDIN` early failure processes data lines as `psql` commands (bsc#1275046).\n- CVE-2026-6469: `ALTER TABLE ALTER TYPE` resets extended statistics ownership (bsc#1275044).\n- CVE-2026-6470: failure to check type `USAGE` privilege (bsc#1275043).\n- CVE-2026-6471: logical decoding can `dlopen` arbitrary file (bsc#1275042).\n- CVE-2026-14662: `tsvector` and `tsquery` undersize allocations, via integer wraparound (bsc#1275001).\n- CVE-2026-14663: `pgcrypto`, for OpenSSL-disabled ciphers, silently encrypts to and decrypts from cleartext\n  (bsc#1275002).\n- CVE-2026-14664: `regexp` heap buffer overflow executes arbitrary code (bsc#1275068).\n- CVE-2026-14666: row security caching disregards role modifications (bsc#1275067).\n- CVE-2026-14668: `ctid` type confusion in selectivity estimator discloses derivative of arbitrary read\n  (bsc#1275066).\n- CVE-2026-14669: `to_char` heap buffer overflow executes arbitrary code (bsc#1275065).\n- CVE-2026-14670: `plperl` tied object heap buffer overflow executes arbitrary code (bsc#1275064).\n- CVE-2026-14671: `refint` plan cache type confusion executes arbitrary code (bsc#1275063).\n- CVE-2026-14673: `amcheck` does not clear untrusted search path (bsc#1275061).\n- CVE-2026-14677: 32-bit `pltcl` and `plperl` undersize allocations, via integer wraparound (bsc#1275059).\n- CVE-2026-14678: `pg_trgm` `picksplit` reads past end of buffer (bsc#1275058).\n- CVE-2026-14679: stack buffer overflow in argument match writes `0x0` and `0x1` to server memory (bsc#1275057).\n- CVE-2026-14680: type confusion via 'internal' arguments (bsc#1275056).\n- CVE-2026-15741: expression deparse allows SQL injection via `EXTRACT` argument (bsc#1275054).\n- CVE-2026-15742: `fuzzystrmatch` writes effectively-arbitrary addresses, via integer wraparound (bsc#1275053).\n- CVE-2026-16239: type confusion in cursor `CLOSE + DECLARE` executes arbitrary code (bsc#1275051).\n- CVE-2026-16241: ECPG integer underflow can crash the client (bsc#1275050).\n- CVE-2026-18024: `ascii()` function reads past end of buffer (bsc#1275049).\n- CVE-2026-18408: `psql` `\\unrestrict` lets superuser of `pg_dump` origin server execute arbitrary code in `psql`\n  client (bsc#1275048).\n- CVE-2026-19385: `pg_dump` heap buffer overflow executes arbitrary code (bsc#1275047).\n\nChanges for postgresql15:\n\n- Update to version 15.19:\n  * https://www.postgresql.org/docs/15/release-15-19.html\n  * https://www.postgresql.org/about/news/postgresql-186-1711-1615-1519-1424-and-19-beta-3-released-3365/","dates":{"published":"2026-09-07T07:38:39.000Z","modified":"2026-09-13T18:23:15.456Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":null,"severity":"unknown","version":null,"versionLabel":null,"source":null,"vector":null,"computed":false,"selection":"none"},"metrics":[]},"epss":{"probability":null,"percentile":null,"severity":"unknown","asOf":null,"change":{"pp":null,"baselineDate":null,"baselineScore":null},"history":[],"last30":[]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[],"affected":[{"vendor":"suse","product":"postgresql15&distro=SUSE Linux Enterprise Module for Legacy 15 SP7","name":"postgresql15","label":"postgresql15&distro=SUSE Linux Enterprise Module for Legacy 15 SP7","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/postgresql15&distro=SUSE Linux Enterprise Module for Legacy 15 SP7","purlType":"rpm","versions":[{"text":"< 15.19-150600.16.36.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 15.19-150600.16.36.1","eol":null,"hubHref":null},{"vendor":"suse","product":"postgresql15&distro=SUSE Linux Enterprise Server 15 SP6-LTSS","name":"postgresql15","label":"postgresql15&distro=SUSE Linux Enterprise Server 15 SP6-LTSS","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/postgresql15&distro=SUSE Linux Enterprise Server 15 SP6-LTSS","purlType":"rpm","versions":[{"text":"< 15.19-150600.16.36.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 15.19-150600.16.36.1","eol":null,"hubHref":null},{"vendor":"suse","product":"postgresql15&distro=SUSE Linux Enterprise Server for SAP Applications 15 SP6","name":"postgresql15","label":"postgresql15&distro=SUSE Linux Enterprise Server for SAP Applications 15 SP6","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/postgresql15&distro=SUSE Linux Enterprise Server for SAP Applications 15 SP6","purlType":"rpm","versions":[{"text":"< 15.19-150600.16.36.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 15.19-150600.16.36.1","eol":null,"hubHref":null}],"affectedCount":3,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264017-1/","label":"www.suse.com/support/update/announcement/2026/suse-su-20264017-1/","hostname":"www.suse.com","tags":["Advisory"]},{"url":"https://bugzilla.suse.com/1275001","label":"bugzilla.suse.com/1275001","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1275002","label":"bugzilla.suse.com/1275002","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1275042","label":"bugzilla.suse.com/1275042","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1275043","label":"bugzilla.suse.com/1275043","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1275044","label":"bugzilla.suse.com/1275044","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1275046","label":"bugzilla.suse.com/1275046","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1275047","label":"bugzilla.suse.com/1275047","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1275048","label":"bugzilla.suse.com/1275048","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1275049","label":"bugzilla.suse.com/1275049","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1275050","label":"bugzilla.suse.com/1275050","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1275051","label":"bugzilla.suse.com/1275051","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1275053","label":"bugzilla.suse.com/1275053","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1275054","label":"bugzilla.suse.com/1275054","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1275056","label":"bugzilla.suse.com/1275056","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1275057","label":"bugzilla.suse.com/1275057","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1275058","label":"bugzilla.suse.com/1275058","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1275059","label":"bugzilla.suse.com/1275059","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1275061","label":"bugzilla.suse.com/1275061","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1275063","label":"bugzilla.suse.com/1275063","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1275064","label":"bugzilla.suse.com/1275064","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1275065","label":"bugzilla.suse.com/1275065","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1275066","label":"bugzilla.suse.com/1275066","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1275067","label":"bugzilla.suse.com/1275067","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1275068","label":"bugzilla.suse.com/1275068","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://www.suse.com/security/cve/CVE-2026-14662","label":"www.suse.com/security/cve/CVE-2026-14662","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-14663","label":"www.suse.com/security/cve/CVE-2026-14663","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-14664","label":"www.suse.com/security/cve/CVE-2026-14664","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-14666","label":"www.suse.com/security/cve/CVE-2026-14666","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-14668","label":"www.suse.com/security/cve/CVE-2026-14668","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-14669","label":"www.suse.com/security/cve/CVE-2026-14669","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-14670","label":"www.suse.com/security/cve/CVE-2026-14670","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-14671","label":"www.suse.com/security/cve/CVE-2026-14671","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-14673","label":"www.suse.com/security/cve/CVE-2026-14673","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-14677","label":"www.suse.com/security/cve/CVE-2026-14677","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-14678","label":"www.suse.com/security/cve/CVE-2026-14678","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-14679","label":"www.suse.com/security/cve/CVE-2026-14679","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-14680","label":"www.suse.com/security/cve/CVE-2026-14680","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-15741","label":"www.suse.com/security/cve/CVE-2026-15741","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-15742","label":"www.suse.com/security/cve/CVE-2026-15742","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-16239","label":"www.suse.com/security/cve/CVE-2026-16239","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-16241","label":"www.suse.com/security/cve/CVE-2026-16241","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-18024","label":"www.suse.com/security/cve/CVE-2026-18024","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-18408","label":"www.suse.com/security/cve/CVE-2026-18408","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-19385","label":"www.suse.com/security/cve/CVE-2026-19385","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6464","label":"www.suse.com/security/cve/CVE-2026-6464","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6469","label":"www.suse.com/security/cve/CVE-2026-6469","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6470","label":"www.suse.com/security/cve/CVE-2026-6470","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6471","label":"www.suse.com/security/cve/CVE-2026-6471","hostname":"www.suse.com","tags":["WEB"]}],"lineage":{"upstream":["CVE-2026-14662","CVE-2026-14663","CVE-2026-14664","CVE-2026-14666","CVE-2026-14668","CVE-2026-14669","CVE-2026-14670","CVE-2026-14671","CVE-2026-14673","CVE-2026-14677","CVE-2026-14678","CVE-2026-14679","CVE-2026-14680","CVE-2026-15741","CVE-2026-15742","CVE-2026-16239","CVE-2026-16241","CVE-2026-18024","CVE-2026-18408","CVE-2026-19385","CVE-2026-6464","CVE-2026-6469","CVE-2026-6470","CVE-2026-6471"],"downstream":[],"duplicates":[],"related":["CVE-2026-14662","CVE-2026-14663","CVE-2026-14664","CVE-2026-14666","CVE-2026-14668","CVE-2026-14669","CVE-2026-14670","CVE-2026-14671","CVE-2026-14673","CVE-2026-14677","CVE-2026-14678","CVE-2026-14679","CVE-2026-14680","CVE-2026-15741","CVE-2026-15742","CVE-2026-16239","CVE-2026-16241","CVE-2026-18024","CVE-2026-18408","CVE-2026-19385","CVE-2026-6464","CVE-2026-6469","CVE-2026-6470","CVE-2026-6471"]},"timeline":[{"kind":"published","date":"2026-09-07T07:38:39.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-09-13T18:23:15.456Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":0,"level":"minimal","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-21T20:47:05.187Z","stale":false,"partial":false}}