openSUSE-SU-2026:22261-1

This update for psqlODBC fixes the following issues:

Changes in psqlODBC:

• Update to 18.00.0006:
  • Large-object read overflows the application buffer (CVE-2026-120057, bsc#1289252).
  • Row cache overflow when a later FETCH changes the column count (CVE-2026-120058, bsc#1289253).
  • Driver uses a server-supplied column name as a format string (CVE-2026-120059, bsc#1289254).
  • Driver does not validate server-supplied counts and lengths (CVE-2026-120060, bsc#1289255).
  • ODBC escape parser stack buffer overflow (CVE-2026-120061, bsc#1289256).
  • SQL injection through SQLSpecialColumns table and schema names (CVE-2026-120062, bsc#1289257).
  • Stack buffer overflow when quoting long schema and table names (CVE-2026-120063, bsc#1289258).
  • Driver does not validate column numbers and row indexes in binding and descriptor functions (CVE-2026-120064, bsc#1289259).
  • Driver does not escape a server-supplied column name in its updatable-cursor queries (CVE-2026-120065, bsc#1289260).
  • Log files are created with default permissions at a predictable path and follow symbolic links (CVE-2026-120066, bsc#1289261).
  • Stack buffer overflow when reading the keyset (ctid/oid) columns of an updatable cursor (CVE-2026-120067, bsc#1289262).
  • Hardening: SQLSetDescRecW stored a freed buffer and the address of a local variable as deferred bound data. It now stores the application's pointers, as SQLSetDescRec does.
  • Hardening: SQLColumns returned uninitialized relkind and table OID values when the table query returned no rows.
  • Hardening: convert_linefeeds could dereference a NULL pointer in one build configuration.
  • Hardening: secure_sscanf limits an over-wide %Ns width, msgtowstr checks for a zero buffer length, and the MSDTC connect-string append is bounded.