boofuzz

.. image:: https://github.com/jtpereyda/boofuzz/raw/master/artwork/boo-logo-dark.svg :width: 60% :alt: boofuzz logo boofuzz: Network Protocol Fuzzing for Humans .. image:: https://github.com/jtpereyda/boofuzz/actions/workflows/test.yml/badge.svg?branch=master :target:...

CVE-2026-14669

CVE-2026-14669 - PostgreSQL tochar 시간대 약어 힙 버퍼 오버플로 PostgreSQL tochar 함수는 시간대 형식화를 처리할 때 힙 버퍼 오버플로 취약점이 존재합니다. 공격자는 과도하게 긴 POSIX 시간대 약어를 설정하여 25바이트 고정 버퍼의 경계를 벗어난 쓰기를 트리거할 수 있으며, 정보 유출 및 ROP 체인과 결합하여 원격 코드 실행을 달성할 수 있습니다. 취약점 정보 CVE 번호 : CVE-2026-14669 CVSS 점수 : 8.8 높음 취약점 유형 : 힙 버퍼 오버플로 → 원격 코드 ...

GitPython: Command Injection via git long-option prefix abbreviation bypass of CVE-2026-42215 blocklist

Command injection via long-option prefix abbreviation bypassing checkunsafeoptions incomplete fix of CVE-2026-42215 / GHSA-rpm5-65cw-6hj4Component: gitpython-developers/GitPython PyPI: GitPythonAffected: all versions carrying the 3.1.47 blocklist fix, through current main verified at commit...

CVE-2026-14669

A heap buffer overflow flaw was found in the PostgreSQL tochartimestamptz function. An attacker can exploit this by supplying an overly long POSIX timezone abbreviation to execute arbitrary code as the database's operating system user, potentially resulting in complete system compromise. Mitigati...

gitpython: GitPython: Command Injection via Git option prefix abbreviation

A flaw was found in GitPython. This vulnerability stems from an incomplete command injection blocklist that fails to account for Git's long-option prefix abbreviation feature. An attacker can bypass existing security measures by using abbreviated option names, which Git then resolves to dangerous...

gitpython: GitPython: Command Injection via Git option prefix abbreviation

A flaw was found in GitPython. This vulnerability stems from an incomplete command injection blocklist that fails to account for Git's long-option prefix abbreviation feature. An attacker can bypass existing security measures by using abbreviated option names, which Git then resolves to dangerous...

BIT-POSTGRESQL-2026-14669 PostgreSQL to_char heap buffer overflow executes arbitrary code

Heap buffer overflow in PostgreSQL tochartimestamptz allows the party choosing the timezone to execute arbitrary code as the operating system user running the database, via a long POSIX timezone abbreviation. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected...

AZL-95693 CVE-2026-14669 affecting package postgresql for versions less than 16.15-1

Heap buffer overflow in PostgreSQL tochartimestamptz allows the party choosing the timezone to execute arbitrary code as the operating system user running the database, via a long POSIX timezone abbreviation. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected...

CVE-2026-14669

Heap buffer overflow in PostgreSQL tochartimestamptz allows the party choosing the timezone to execute arbitrary code as the operating system user running the database, via a long POSIX timezone abbreviation. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected...

ALPINE-CVE-2026-14669

Heap buffer overflow in PostgreSQL tochartimestamptz allows the party choosing the timezone to execute arbitrary code as the operating system user running the database, via a long POSIX timezone abbreviation. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected...

CVE-2026-14669

Heap buffer overflow in PostgreSQL tochartimestamptz allows the party choosing the timezone to execute arbitrary code as the operating system user running the database, via a long POSIX timezone abbreviation. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected...

UBUNTU-CVE-2026-14669

Heap buffer overflow in PostgreSQL tochartimestamptz allows the party choosing the timezone to execute arbitrary code as the operating system user running the database, via a long POSIX timezone abbreviation. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected...

EUVD-2026-57836

Heap buffer overflow in PostgreSQL tochartimestamptz allows the party choosing the timezone to execute arbitrary code as the operating system user running the database, via a long POSIX timezone abbreviation. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected...

CVE-2026-14669

CVE-2026-14669 describes a heap buffer overflow in PostgreSQL's to_char(timestamptz), allowing an attacker who can choose the database timezone to execute arbitrary code as the OS user running the database. The vulnerability is triggered by a long POSIX timezone abbreviation. Affected versions ar...

CVE-2026-14669

Heap buffer overflow in PostgreSQL tochartimestamptz allows the party choosing the timezone to execute arbitrary code as the operating system user running the database, via a long POSIX timezone abbreviation. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected...

Linux Distros Unpatched Vulnerability : CVE-2026-14669

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Heap buffer overflow in PostgreSQL tochartimestamptz allows the party choosing the timezone to execute arbitrary code as the operating system user running the...

PT-2026-71467

Name of the Vulnerable Software and Affected Versions PostgreSQL versions prior to 18.5 PostgreSQL versions prior to 17.11 PostgreSQL versions prior to 16.15 PostgreSQL versions prior to 15.19 PostgreSQL versions prior to 14.24 Description A heap buffer overflow occurs in the to chartimestamptz...

CVE-2026-67325

A flaw was found in GitPython. This vulnerability stems from an incomplete command injection blocklist that fails to account for Git's long-option prefix abbreviation feature. An attacker can bypass existing security measures by using abbreviated option names, which Git then resolves to dangerous...

Duplicate Advisory: GitPython: Command Injection via git long-option prefix abbreviation bypass of CVE-2026-42215 blocklist

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-2f96-g7mh-g2hx. This link is maintained to preserve external references. Original Description GitPython before 3.1.51 contains an incomplete command injection blocklist that fails to account for git's long-optio...

gitpython: GitPython: Command Injection via Git option prefix abbreviation

A flaw was found in GitPython. This vulnerability stems from an incomplete command injection blocklist that fails to account for Git's long-option prefix abbreviation feature. An attacker can bypass existing security measures by using abbreviated option names, which Git then resolves to dangerous...