[CLSA-2026:1789731560] Fix CVE(s): CVE-2026-14673, CVE-2026-19385
Type:
security
Severity:
Critical
Release date:
2026-09-18 11:39:31 UTC
Description:
* SECURITY UPDATE: Heap buffer overflow in pg_dump of long transform lists - debian/patches/CVE-2026-19385.patch: make parseOidArray() allocate the OID array itself and verify the element count, add parseIntArray() for the potentially-signed callers, and drop dumpFunc()'s fixed FUNC_MAX_ARGS allocation for pg_proc.protrftypes, so a crafted transform list can no longer overrun the array or run the caller loop off its end - CVE-2026-19385 * SECURITY UPDATE: Untrusted search path in amcheck - debian/patches/CVE-2026-14673.patch: set search_path to "pg_catalog, pg_temp" inside the security-restricted context that bt_index_check_internal() establishes, so index expressions and predicates run by amcheck cannot resolve to attacker-supplied functions placed on the caller's search_path - CVE-2026-14673
CVEs fixed:
Updated packages:
  • libecpg-compat3-13_13.23-1~trixie+tuxcare.els14_amd64.deb
    sha:a63f0711ed7dd06a24cb3f13891040fbc7352921
  • libecpg-dev-13_13.23-1~trixie+tuxcare.els14_amd64.deb
    sha:4e77e146f37bff573329eac5801b0d907148fb39
  • libecpg6-13_13.23-1~trixie+tuxcare.els14_amd64.deb
    sha:1bcc5f41874a53574a8307c8ff82710e1466e23c
  • libpgtypes3-13_13.23-1~trixie+tuxcare.els14_amd64.deb
    sha:00b830edb8ba8ccff1ec8c27fb5b7c3954274375
  • libpq-dev-13_13.23-1~trixie+tuxcare.els14_amd64.deb
    sha:3602b86c8deae6b022dc4e2dc9429ced0da5a4a4
  • libpq5-13_13.23-1~trixie+tuxcare.els14_amd64.deb
    sha:094daa56971d74e4d99dd29959cd35adba198ee3
  • postgresql13_13.23-1~trixie+tuxcare.els14_amd64.deb
    sha:4b70f0724e43f984ee95c8880543c6d7eff9e43b
  • postgresql13-client_13.23-1~trixie+tuxcare.els14_amd64.deb
    sha:455e5fcbbcae3a2c604698dc5f3b9c12b833cbcc
  • postgresql13-doc_13.23-1~trixie+tuxcare.els14_all.deb
    sha:153be5e39ff921360e620541a9fc4a37e50d322a
  • postgresql13-plperl_13.23-1~trixie+tuxcare.els14_amd64.deb
    sha:21721db2c96598ab061338ad3f097f11e3f20134
  • postgresql13-plpython3_13.23-1~trixie+tuxcare.els14_amd64.deb
    sha:414631b283a87fd6a4622bfd2a98e05f2042f30b
  • postgresql13-pltcl_13.23-1~trixie+tuxcare.els14_amd64.deb
    sha:32c96c7d3e66470289df59239a0a47cd29a88729
  • postgresql13-server-dev_13.23-1~trixie+tuxcare.els14_amd64.deb
    sha:e97d03ff55484c51f9d9f92132d2a468319cfbeb
  • libecpg-compat3-13_13.23-1~trixie+tuxcare.els14_arm64.deb
    sha:2ccb7ae1be1bbede657790119c19a7623538b413
  • libecpg-dev-13_13.23-1~trixie+tuxcare.els14_arm64.deb
    sha:80761f9c9f98ce4220d2c7549d2684e968d55c3e
  • libecpg6-13_13.23-1~trixie+tuxcare.els14_arm64.deb
    sha:beb5dc009c4da45d2d29f40554ae3c1df347d468
  • libpgtypes3-13_13.23-1~trixie+tuxcare.els14_arm64.deb
    sha:48245f5b8310754a2c55ecd07256febf3feb6817
  • libpq-dev-13_13.23-1~trixie+tuxcare.els14_arm64.deb
    sha:23bf5425ae74f12545c7fa340b5652eb97f429ab
  • libpq5-13_13.23-1~trixie+tuxcare.els14_arm64.deb
    sha:4c31fe03c8a04113c6b82e0684777152e7c85601
  • postgresql13_13.23-1~trixie+tuxcare.els14_arm64.deb
    sha:c1b16d01e0f0742084a19361544015540991149e
  • postgresql13-client_13.23-1~trixie+tuxcare.els14_arm64.deb
    sha:300fdaba3c54a80b452aacef234641f328d28859
  • postgresql13-plperl_13.23-1~trixie+tuxcare.els14_arm64.deb
    sha:08acff180062047e48f6d263162d89f7a85dcd72
  • postgresql13-plpython3_13.23-1~trixie+tuxcare.els14_arm64.deb
    sha:4bb757155fa641c0451ae0a9ad5213a66d6a6a6a
  • postgresql13-pltcl_13.23-1~trixie+tuxcare.els14_arm64.deb
    sha:5bb5aa42fa465c4310ab64f5f4512cc3f7ffa1e0
  • postgresql13-server-dev_13.23-1~trixie+tuxcare.els14_arm64.deb
    sha:34b8083bf1fcc3afa9298124d7cb4567ad67223d
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.