CLSA-2026-1788785141
See a problem?- Import Source
- https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1788785141.json
- JSON Data
- https://api.osv.dev/v1/vulns/CLSA-2026-1788785141
- Upstream
- CVE-2026-14669
- Published
- 2026-09-07T12:45:51Z
- Modified
- 2026-10-26T09:31:40Z
- Summary
- Fix CVE(s): CVE-2026-14669
- Details
-
- SECURITY UPDATE: Heap buffer overflow in to_char(timestamptz).
DCH_to_char() copies the timezone abbreviation into a
DCH_MAX_ITEM_SIZ-budgeted workspace with an unchecked strcpy(), and
any client can select a longer POSIX abbreviation via SET TIME ZONE
(CVSS 8.8, arbitrary code execution as the database OS user).
- debian/patches/CVE-2026-14669.patch: reject POSIX timezone abbreviations longer than n->key->len * DCH_MAX_ITEM_SIZ in the TZ/tz items of DCH_to_char() with an error, instead of strcpy()ing them past the palloc'd buffer (upstream 3d724bf4fd by Tom Lane, carried on REL_14_STABLE inside 5fb3c63 and shipped in 14.24; applies verbatim to 12.22).
- CVE-2026-14669
- SECURITY UPDATE: Heap buffer overflow in to_char(timestamptz).
DCH_to_char() copies the timezone abbreviation into a
DCH_MAX_ITEM_SIZ-budgeted workspace with an unchecked strcpy(), and
any client can select a longer POSIX abbreviation via SET TIME ZONE
(CVSS 8.8, arbitrary code execution as the database OS user).
- References