CLSA-2026-1788163557

See a problem?
Import Source
https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1788163557.json
JSON Data
https://api.osv.dev/v1/vulns/CLSA-2026-1788163557
Upstream
  • CVE-2026-14669
Published
2026-08-31T08:06:08Z
Modified
2026-10-26T09:31:53Z
Summary
Fix CVE(s): CVE-2026-14669
Details
  • SECURITY UPDATE: Heap buffer overflow in to_char(timestamptz): DCH_to_char() copies the timezone abbreviation into a DCH_MAX_ITEM_SIZ-budgeted workspace with an unchecked strcpy(), and any client can select a longer POSIX abbreviation via SET TIME ZONE (CVSS 8.8, arbitrary code execution as the database OS user)
    • debian/patches/CVE-2026-14669.patch: Reject POSIX timezone abbreviations that would overflow the TZ/tz item budget in DCH_to_char() with an error instead of strcpy()ing them past the palloc'd buffer (upstream commit 12a620686, shipped in 14.24 via the REL_14_STABLE carrier 5fb3c63; applies verbatim)
    • CVE-2026-14669
References

Affected packages

TuxCare:Debian:10
libecpg-compat3-9.6

Package

Name
libecpg-compat3-9.6
Purl
pkg:deb/tuxcare/libecpg-compat3-9.6?distro=debian-10

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
9.6.24-0+deb10u1+tuxcare.els4

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1788163557.json"
libecpg-dev-9.6

Package

Name
libecpg-dev-9.6
Purl
pkg:deb/tuxcare/libecpg-dev-9.6?distro=debian-10

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
9.6.24-0+deb10u1+tuxcare.els4

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1788163557.json"
libecpg6-9.6

Package

Name
libecpg6-9.6
Purl
pkg:deb/tuxcare/libecpg6-9.6?distro=debian-10

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
9.6.24-0+deb10u1+tuxcare.els4

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1788163557.json"
libpgtypes3-9.6

Package

Name
libpgtypes3-9.6
Purl
pkg:deb/tuxcare/libpgtypes3-9.6?distro=debian-10

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
9.6.24-0+deb10u1+tuxcare.els4

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1788163557.json"
libpq-dev-9.6

Package

Name
libpq-dev-9.6
Purl
pkg:deb/tuxcare/libpq-dev-9.6?distro=debian-10

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
9.6.24-0+deb10u1+tuxcare.els4

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1788163557.json"
libpq5-9.6

Package

Name
libpq5-9.6
Purl
pkg:deb/tuxcare/libpq5-9.6?distro=debian-10

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
9.6.24-0+deb10u1+tuxcare.els4

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1788163557.json"
postgresql-9.6

Package

Name
postgresql-9.6
Purl
pkg:deb/tuxcare/postgresql-9.6?distro=debian-10

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
9.6.24-0+deb10u1+tuxcare.els4

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1788163557.json"
postgresql-client-9.6

Package

Name
postgresql-client-9.6
Purl
pkg:deb/tuxcare/postgresql-client-9.6?distro=debian-10

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
9.6.24-0+deb10u1+tuxcare.els4

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1788163557.json"
postgresql-contrib-9.6

Package

Name
postgresql-contrib-9.6
Purl
pkg:deb/tuxcare/postgresql-contrib-9.6?distro=debian-10

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
9.6.24-0+deb10u1+tuxcare.els4

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1788163557.json"
postgresql-doc-9.6

Package

Name
postgresql-doc-9.6
Purl
pkg:deb/tuxcare/postgresql-doc-9.6?distro=debian-10

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
9.6.24-0+deb10u1+tuxcare.els4

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1788163557.json"
postgresql-plperl-9.6

Package

Name
postgresql-plperl-9.6
Purl
pkg:deb/tuxcare/postgresql-plperl-9.6?distro=debian-10

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
9.6.24-0+deb10u1+tuxcare.els4

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1788163557.json"
postgresql-plpython-9.6

Package

Name
postgresql-plpython-9.6
Purl
pkg:deb/tuxcare/postgresql-plpython-9.6?distro=debian-10

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
9.6.24-0+deb10u1+tuxcare.els4

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1788163557.json"
postgresql-plpython3-9.6

Package

Name
postgresql-plpython3-9.6
Purl
pkg:deb/tuxcare/postgresql-plpython3-9.6?distro=debian-10

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
9.6.24-0+deb10u1+tuxcare.els4

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1788163557.json"
postgresql-pltcl-9.6

Package

Name
postgresql-pltcl-9.6
Purl
pkg:deb/tuxcare/postgresql-pltcl-9.6?distro=debian-10

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
9.6.24-0+deb10u1+tuxcare.els4

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1788163557.json"
postgresql-server-dev-9.6

Package

Name
postgresql-server-dev-9.6
Purl
pkg:deb/tuxcare/postgresql-server-dev-9.6?distro=debian-10

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
9.6.24-0+deb10u1+tuxcare.els4

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1788163557.json"