CLSA-2026-1788270629
See a problem?- Import Source
- https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1788270629.json
- JSON Data
- https://api.osv.dev/v1/vulns/CLSA-2026-1788270629
- Upstream
- CVE-2026-14669
- Published
- 2026-09-04T14:04:18Z
- Modified
- 2026-10-26T09:32:02Z
- Summary
- Fix CVE(s): CVE-2026-14669
- Details
-
- SECURITY UPDATE: Heap buffer overflow in to_char(timestamptz).
DCH_to_char() copied the timezone abbreviation into a workspace
budgeted at DCH_MAX_ITEM_SIZ bytes per format character with an
unchecked strcpy(), and any client can select a longer POSIX
abbreviation via SET TIME ZONE (CVSS 8.8, arbitrary code execution
as the database OS user).
- debian/patches/CVE-2026-14669.patch: reject POSIX timezone abbreviations longer than n->key->len * DCH_MAX_ITEM_SIZ in the TZ/tz items of DCH_to_char() with an error, instead of strcpy()ing them past the palloc'd buffer (upstream 3d724bf4fd, backpatched to REL_14_STABLE as the formatting.c hunk of 5fb3c638 and shipped in 14.24; applies verbatim).
- CVE-2026-14669
- SECURITY UPDATE: Heap buffer overflow in to_char(timestamptz).
DCH_to_char() copied the timezone abbreviation into a workspace
budgeted at DCH_MAX_ITEM_SIZ bytes per format character with an
unchecked strcpy(), and any client can select a longer POSIX
abbreviation via SET TIME ZONE (CVSS 8.8, arbitrary code execution
as the database OS user).
- References