CVE-2025-62728: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in Hive Metastore Server HMS when processing delete column statistics requests via the Thrift APIs. The vulnerability is only exploitable by trusted/authorized users/applications that are allowed to call directly the Thrift APIs. In most real-world deployments, HMS is...

PT-2025-48132

Name of the Vulnerable Software and Affected Versions Apache Hive versions 4.1.0 through 4.2.0 Description A SQL injection issue exists in the Hive Metastore Server HMS when handling delete column statistics requests through the Thrift APIs. This issue is exploitable only by authorized users or...

kernel: smb: client: fix potential UAF in cifs_stats_proc_write()

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential UAF in cifsstatsprocwrite Skip sessions that are being teared down status == SESEXITING to avoid UAF...

kernel: RDMA/mlx5: Fix mlx5_ib_get_hw_stats when used for device

An out-of-bounds write vulnerability exists in the linux kernel, such that when mlx5ibgethwstats is used forthe device portnum = 0, There is a special handling in order to use the correct counters, but, portnum is being passed down the stack without any change leading to damage in system...

The vulnerabilities of the security mechanism of the Spotfire Server Software, the Spotfire Statistics Services platform for visualization and advanced data analysis, the Spotfire Enterprise Runtime Download Manager, the Deployment Kit Download Manager, the Spotfire Desktop Data Analysis Application, and the Spotfire for AWS Marketplace analytics platform allow a perpetrator to execute arbitrary code, circumvent existing security restrictions, and cause service interruptions.

The vulnerabilities of the security mechanism of the Spotfire Server Software, the Visualization and Extended Data Analysis Platform Spotfire Analyst, the Spotfire Enterprise Runtime Download Manager, the Deployment Kit Download Manager, the Spotfire Desktop Data Analysis Application, and the...

OESA-2025-2730 libpq security update

PostgreSQL is a powerful, open source object-relational database system that uses and extends the SQL language combined with many features that safely store and scale the most complicated data workloads. This package provides the essential shared library for any PostgreSQL client program or...

OESA-2025-2728 libpq security update

PostgreSQL is a powerful, open source object-relational database system that uses and extends the SQL language combined with many features that safely store and scale the most complicated data workloads. This package provides the essential shared library for any PostgreSQL client program or...

OESA-2025-2726 libpq security update

PostgreSQL is a powerful, open source object-relational database system that uses and extends the SQL language combined with many features that safely store and scale the most complicated data workloads. This package provides the essential shared library for any PostgreSQL client program or...

OESA-2025-2725 postgresql security update

PostgreSQL is an advanced Object-Relational database management system DBMS. The base postgresql package contains the client programs that you'll need to access a PostgreSQL DBMS server, as well as HTML documentation for the whole system. These client programs can be located on the same machine a...

OESA-2025-2724 postgresql security update

PostgreSQL is an advanced Object-Relational database management system DBMS. The base postgresql package contains the client programs that you'll need to access a PostgreSQL DBMS server, as well as HTML documentation for the whole system. These client programs can be located on the same machine a...

OESA-2025-2727 libpq security update

PostgreSQL is a powerful, open source object-relational database system that uses and extends the SQL language combined with many features that safely store and scale the most complicated data workloads. This package provides the essential shared library for any PostgreSQL client program or...

OESA-2025-2715 postgresql-13 security update

PostgreSQL is an advanced Object-Relational database management system DBMS. The base postgresql package contains the client programs that you'll need to access a PostgreSQL DBMS server, as well as HTML documentation for the whole system. These client programs can be located on the same machine a...

OESA-2025-2723 postgresql security update

PostgreSQL is an advanced Object-Relational database management system DBMS. The base postgresql package contains the client programs that you'll need to access a PostgreSQL DBMS server, as well as HTML documentation for the whole system. These client programs can be located on the same machine a...

OESA-2025-2722 postgresql security update

PostgreSQL is an advanced Object-Relational database management system DBMS. The base postgresql package contains the client programs that you'll need to access a PostgreSQL DBMS server, as well as HTML documentation for the whole system. These client programs can be located on the same machine a...

BIT-POSTGRESQL-2025-12817 PostgreSQL CREATE STATISTICS does not check for schema CREATE privilege

Missing authorization in PostgreSQL CREATE STATISTICS command allows a table owner to achieve denial of service against other CREATE STATISTICS users by creating in any schema. A later CREATE STATISTICS for the same name, from a user having the CREATE privilege, would then fail. Versions before...

drm/v3d: Avoid NULL pointer dereference in `v3d_job_update_stats()`

...

PostgreSQL 13.x < 13.23 / 14.x < 14.20 / 15.x < 15.15 / 16.x < 16.11 / 17.x < 17.7 / 18.x < 18.1 Multiple Vulnerabilities

The version of PostgreSQL installed on the remote host is 13 prior to 13.23, 14 prior to 14.20, 15 prior to 15.15, 16 prior to 16.11, 17 prior to 17.7, or 18 prior to 18.1. As such, it is potentially affected by multiple vulnerabilities: - Integer wraparound in multiple PostgreSQL libpq client...

TencentOS Server 4: postgresql (TSSA-2024:0413)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2024:0413 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities...

Updated postgresql15 & postgresql13 packages fix security vulnerabilities

PostgreSQL CREATE STATISTICS does not check for schema CREATE privilege. CVE-2025-12817 PostgreSQL libpq undersizes allocations, via integer wraparound. CVE-2025-12818...

CVE-2025-12817

A vulnerability has been identified in PostgreSQL’s CREATE STATISTICS command where the database does not check that the user has the required schema CREATE privilege. A table owner user could create a statistics object in any schema, blocking other users who legitimately hold CREATE STATISTICS...