CLSA-2026-1788270306
See a problem?- Import Source
- https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1788270306.json
- JSON Data
- https://api.osv.dev/v1/vulns/CLSA-2026-1788270306
- Upstream
- CVE-2026-14669
- Published
- 2026-09-01T13:45:16Z
- Modified
- 2026-10-26T09:32:04Z
- Summary
- Fix CVE(s): CVE-2026-14669
- Details
-
- SECURITY UPDATE: Heap buffer overflow in to_char(timestamptz):
DCH_to_char() copies the timezone abbreviation into a
DCH_MAX_ITEM_SIZ-budgeted workspace with an unchecked strcpy(), and
any client can select a longer POSIX abbreviation via SET TIME ZONE
(CVSS 8.8, arbitrary code execution as the database OS user).
- debian/patches/CVE-2026-14669.patch: reject POSIX timezone abbreviations longer than n->key->len * DCH_MAX_ITEM_SIZ in DCH_to_char()'s TZ/tz items with an error instead of strcpy()ing them past the palloc'd buffer (upstream 12a6206864, folded into REL_14_STABLE 5fb3c638 and shipped in 14.24; applies verbatim).
- CVE-2026-14669
- SECURITY UPDATE: Heap buffer overflow in to_char(timestamptz):
DCH_to_char() copies the timezone abbreviation into a
DCH_MAX_ITEM_SIZ-budgeted workspace with an unchecked strcpy(), and
any client can select a longer POSIX abbreviation via SET TIME ZONE
(CVSS 8.8, arbitrary code execution as the database OS user).
- References