SUSE-SU-2026:4013-1

See a problem?
Please try reporting it to the source first.
Source
https://www.suse.com/support/update/announcement/2026/suse-su-20264013-1/
Import Source
https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4013-1.json
JSON Data
https://api.osv.dev/v1/vulns/SUSE-SU-2026:4013-1
Upstream
  • CVE-2026-14662
  • CVE-2026-14663
  • CVE-2026-14664
  • CVE-2026-14666
  • CVE-2026-14668
  • CVE-2026-14669
  • CVE-2026-14670
  • CVE-2026-14671
  • CVE-2026-14672
  • CVE-2026-14677
  • CVE-2026-14678
  • CVE-2026-14679
  • CVE-2026-14680
  • CVE-2026-14681
  • CVE-2026-15741
  • CVE-2026-15742
  • CVE-2026-16239
  • CVE-2026-16241
  • CVE-2026-18024
  • CVE-2026-18408
  • CVE-2026-19385
  • CVE-2026-6464
  • CVE-2026-6469
  • CVE-2026-6470
  • CVE-2026-6471
Related
  • CVE-2026-14662
  • CVE-2026-14663
  • CVE-2026-14664
  • CVE-2026-14666
  • CVE-2026-14668
  • CVE-2026-14669
  • CVE-2026-14670
  • CVE-2026-14671
  • CVE-2026-14672
  • CVE-2026-14677
  • CVE-2026-14678
  • CVE-2026-14679
  • CVE-2026-14680
  • CVE-2026-14681
  • CVE-2026-15741
  • CVE-2026-15742
  • CVE-2026-16239
  • CVE-2026-16241
  • CVE-2026-18024
  • CVE-2026-18408
  • CVE-2026-19385
  • CVE-2026-6464
  • CVE-2026-6469
  • CVE-2026-6470
  • CVE-2026-6471
Published
2026-09-07T07:35:47Z
Modified
2026-09-13T18:23:15Z
Summary
Security update for postgresql17
Details

This update for postgresql17 fixes the following issues:

  • CVE-2026-6464: psql COPY FROM STDIN early failure processes data lines as psql commands (bsc#1275046).
  • CVE-2026-6469: ALTER TABLE ALTER TYPE resets extended statistics ownership (bsc#1275044).
  • CVE-2026-6470: failure to check type USAGE privilege (bsc#1275043).
  • CVE-2026-6471: logical decoding can dlopen arbitrary file (bsc#1275042).
  • CVE-2026-14662: tsvector and tsquery undersize allocations, via integer wraparound (bsc#1275001).
  • CVE-2026-14663: pgcrypto, for OpenSSL-disabled ciphers, silently encrypts to and decrypts from cleartext (bsc#1275002).
  • CVE-2026-14664: regexp heap buffer overflow executes arbitrary code (bsc#1275068).
  • CVE-2026-14666: row security caching disregards role modifications (bsc#1275067).
  • CVE-2026-14668: ctid type confusion in selectivity estimator discloses derivative of arbitrary read (bsc#1275066).
  • CVE-2026-14669: to_char heap buffer overflow executes arbitrary code (bsc#1275065).
  • CVE-2026-14670: plperl tied object heap buffer overflow executes arbitrary code (bsc#1275064).
  • CVE-2026-14671: refint plan cache type confusion executes arbitrary code (bsc#1275063).
  • CVE-2026-14672: observable response discrepancy with non-default scram_iterations provides user existence oracle (bsc#1275062).
  • CVE-2026-14677: 32-bit pltcl and plperl undersize allocations, via integer wraparound (bsc#1275059).
  • CVE-2026-14678: pg_trgm picksplit reads past end of buffer (bsc#1275058).
  • CVE-2026-14679: stack buffer overflow in argument match writes 0x0 and 0x1 to server memory (bsc#1275057).
  • CVE-2026-14680: type confusion via 'internal' arguments (bsc#1275056).
  • CVE-2026-14681: improper enforcement of GSSAPI encryption when coupled with SSL (bsc#1275055).
  • CVE-2026-15741: expression deparse allows SQL injection via EXTRACT argument (bsc#1275054).
  • CVE-2026-15742: fuzzystrmatch writes effectively-arbitrary addresses, via integer wraparound (bsc#1275053).
  • CVE-2026-16239: type confusion in cursor CLOSE + DECLARE executes arbitrary code (bsc#1275051).
  • CVE-2026-16241: ECPG integer underflow can crash the client (bsc#1275050).
  • CVE-2026-18024: ascii() function reads past end of buffer (bsc#1275049).
  • CVE-2026-18408: psql \unrestrict lets superuser of pg_dump origin server execute arbitrary code in psql client (bsc#1275048).
  • CVE-2026-19385: pg_dump heap buffer overflow executes arbitrary code (bsc#1275047).

Changes for postgresql17:

References

Affected packages

SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
postgresql17

Package

Name
postgresql17
Purl
pkg:rpm/suse/postgresql17&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-ESPOS

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
17.11-150200.5.33.1

Ecosystem specific 

{
    "binaries": [
        {}
    ]
}

Database specific

source 
"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4013-1.json"
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
postgresql17

Package

Name
postgresql17
Purl
pkg:rpm/suse/postgresql17&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-LTSS

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
17.11-150200.5.33.1

Ecosystem specific 

{
    "binaries": [
        {}
    ]
}

Database specific

source 
"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4013-1.json"
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
postgresql17

Package

Name
postgresql17
Purl
pkg:rpm/suse/postgresql17&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP5-ESPOS

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
17.11-150200.5.33.1

Ecosystem specific 

{
    "binaries": [
        {
            "postgresql17": "17.11-150200.5.33.1",
            "postgresql17-contrib": "17.11-150200.5.33.1",
            "postgresql17-devel": "17.11-150200.5.33.1",
            "postgresql17-docs": "17.11-150200.5.33.1",
            "postgresql17-plperl": "17.11-150200.5.33.1",
            "postgresql17-plpython": "17.11-150200.5.33.1",
            "postgresql17-pltcl": "17.11-150200.5.33.1",
            "postgresql17-server": "17.11-150200.5.33.1",
            "postgresql17-server-devel": "17.11-150200.5.33.1"
        }
    ]
}

Database specific

source 
"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4013-1.json"
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
postgresql17

Package

Name
postgresql17
Purl
pkg:rpm/suse/postgresql17&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP5-LTSS

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
17.11-150200.5.33.1

Ecosystem specific 

{
    "binaries": [
        {
            "postgresql17": "17.11-150200.5.33.1",
            "postgresql17-contrib": "17.11-150200.5.33.1",
            "postgresql17-devel": "17.11-150200.5.33.1",
            "postgresql17-docs": "17.11-150200.5.33.1",
            "postgresql17-plperl": "17.11-150200.5.33.1",
            "postgresql17-plpython": "17.11-150200.5.33.1",
            "postgresql17-pltcl": "17.11-150200.5.33.1",
            "postgresql17-server": "17.11-150200.5.33.1",
            "postgresql17-server-devel": "17.11-150200.5.33.1"
        }
    ]
}

Database specific

source 
"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4013-1.json"
SUSE:Linux Enterprise Server 15 SP4-LTSS
postgresql17

Package

Name
postgresql17
Purl
pkg:rpm/suse/postgresql17&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP4-LTSS

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
17.11-150200.5.33.1

Ecosystem specific 

{
    "binaries": [
        {}
    ]
}

Database specific

source 
"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4013-1.json"
SUSE:Linux Enterprise Server 15 SP5-LTSS
postgresql17

Package

Name
postgresql17
Purl
pkg:rpm/suse/postgresql17&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP5-LTSS

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
17.11-150200.5.33.1

Ecosystem specific 

{
    "binaries": [
        {
            "postgresql17": "17.11-150200.5.33.1",
            "postgresql17-contrib": "17.11-150200.5.33.1",
            "postgresql17-devel": "17.11-150200.5.33.1",
            "postgresql17-docs": "17.11-150200.5.33.1",
            "postgresql17-llvmjit": "17.11-150200.5.33.1",
            "postgresql17-llvmjit-devel": "17.11-150200.5.33.1",
            "postgresql17-plperl": "17.11-150200.5.33.1",
            "postgresql17-plpython": "17.11-150200.5.33.1",
            "postgresql17-pltcl": "17.11-150200.5.33.1",
            "postgresql17-server": "17.11-150200.5.33.1",
            "postgresql17-server-devel": "17.11-150200.5.33.1"
        }
    ]
}

Database specific

source 
"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4013-1.json"
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
postgresql17

Package

Name
postgresql17
Purl
pkg:rpm/suse/postgresql17&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP4

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
17.11-150200.5.33.1

Ecosystem specific 

{
    "binaries": [
        {}
    ]
}

Database specific

source 
"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4013-1.json"
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
postgresql17

Package

Name
postgresql17
Purl
pkg:rpm/suse/postgresql17&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP5

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
17.11-150200.5.33.1

Ecosystem specific 

{
    "binaries": [
        {
            "postgresql17": "17.11-150200.5.33.1",
            "postgresql17-contrib": "17.11-150200.5.33.1",
            "postgresql17-devel": "17.11-150200.5.33.1",
            "postgresql17-docs": "17.11-150200.5.33.1",
            "postgresql17-llvmjit": "17.11-150200.5.33.1",
            "postgresql17-llvmjit-devel": "17.11-150200.5.33.1",
            "postgresql17-plperl": "17.11-150200.5.33.1",
            "postgresql17-plpython": "17.11-150200.5.33.1",
            "postgresql17-pltcl": "17.11-150200.5.33.1",
            "postgresql17-server": "17.11-150200.5.33.1",
            "postgresql17-server-devel": "17.11-150200.5.33.1"
        }
    ]
}

Database specific

source 
"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4013-1.json"