Heap write primitive via size round-up wrap during JSON parsing on 32-bit builds

An integer wraparound in an allocation size calculation in the BSON library's JSON parsing code can cause a buffer to be released while a following copy operation still writes through the stale pointer. On builds where sizes are 32 bits, an unauthenticated party able to supply a sufficiently larg...

SUSE-SU-2026:3963-1 Security update for postgresql16

This update for postgresql16 fixes the following issues: - CVE-2026-6464: psql COPY FROM STDIN early failure processes data lines as psql commands bsc1275046. - CVE-2026-6469: ALTER TABLE ALTER TYPE resets extended statistics ownership bsc1275044. - CVE-2026-6470: failure to check type USAGE...

Security update for postgresql14

This update for postgresql14 fixes the following issues: CVE-2026-6464: psql COPY FROM STDIN early failure processes data lines as psql commands bsc1275046. CVE-2026-6469: ALTER TABLE ALTER TYPE resets extended statistics ownership bsc1275044. CVE-2026-6470: failure to check type USAGE privilege...

SUSE-SU-2026:3944-1 Security update for postgresql14

This update for postgresql14 fixes the following issues: - CVE-2026-6464: psql COPY FROM STDIN early failure processes data lines as psql commands bsc1275046. - CVE-2026-6469: ALTER TABLE ALTER TYPE resets extended statistics ownership bsc1275044. - CVE-2026-6470: failure to check type USAGE...

Security update for postgresql16

This update for postgresql16 fixes the following issues: CVE-2026-6464: psql COPY FROM STDIN early failure processes data lines as psql commands bsc1275046. CVE-2026-6469: ALTER TABLE ALTER TYPE resets extended statistics ownership bsc1275044. CVE-2026-6470: failure to check type USAGE privilege...

SUSE-SU-2026:3943-1 Security update for postgresql16

This update for postgresql16 fixes the following issues: - CVE-2026-6464: psql COPY FROM STDIN early failure processes data lines as psql commands bsc1275046. - CVE-2026-6469: ALTER TABLE ALTER TYPE resets extended statistics ownership bsc1275044. - CVE-2026-6470: failure to check type USAGE...

Security update for postgresql18

This update for postgresql18 fixes the following issues: CVE-2026-6464: psql COPY FROM STDIN early failure processes data lines as psql commands bsc1275046. CVE-2026-6469: ALTER TABLE ALTER TYPE resets extended statistics ownership bsc1275044. CVE-2026-6470: failure to check type USAGE privilege...

SUSE-SU-2026:3942-1 Security update for postgresql18

This update for postgresql18 fixes the following issues: - CVE-2026-6464: psql COPY FROM STDIN early failure processes data lines as psql commands bsc1275046. - CVE-2026-6469: ALTER TABLE ALTER TYPE resets extended statistics ownership bsc1275044. - CVE-2026-6470: failure to check type USAGE...

Security update for postgresql14

This update for postgresql14 fixes the following issues: CVE-2026-6464: psql COPY FROM STDIN early failure processes data lines as psql commands bsc1275046. CVE-2026-6469: ALTER TABLE ALTER TYPE resets extended statistics ownership bsc1275044. CVE-2026-6470: failure to check type USAGE privilege...

Security update for postgresql15

This update for postgresql15 fixes the following issues: CVE-2026-6464: psql COPY FROM STDIN early failure processes data lines as psql commands bsc1275046. CVE-2026-6469: ALTER TABLE ALTER TYPE resets extended statistics ownership bsc1275044. CVE-2026-6470: failure to check type USAGE privilege...

PT-2026-85069

Name of the Vulnerable Software and Affected Versions bson-devel versions prior to 2.5.2-1.1 Description An integer wraparound occurs during an allocation size calculation within the BSON library's JSON parsing code. This flaw can lead to a buffer being released while a subsequent copy operation...

CVE-2026-82737 Ash.Vector wraps the 16-bit dimension header for vectors over 65,535 elements, corrupting data and crashing reads

Integer Overflow or Wraparound vulnerability in ash-project ash lets an attacker corrupt a stored vector and crash later reads of it by submitting a vector with more than 65,535 elements. Ash.Vector.new/1 lib/ash/vector.ex encodes a vector as followed by the element floats, packing the element...

openSUSE 16: postgresql15 / postgresql15-contrib / postgresql15-devel / etc (openSUSE-SU-2026:21700-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21700-1 advisory. - CVE-2026-6464: psql COPY FROM STDIN early failure processes data lines as psql commands bsc1275046. - CVE-2026-6469: ALTER TABLE ALTER TYPE...

PostgreSQL 14.x < 14.24 / 15.x < 15.19 / 16.x < 16.15 / 17.x < 17.11 / 18.x < 18.6 Multiple Vulnerabilities

The version of PostgreSQL installed on the remote host is 14 prior to 14.24, 15 prior to 15.19, 16 prior to 16.15, 17 prior to 17.11, or 18 prior to 18.6. As such, it is potentially affected by multiple vulnerabilities: - Type confusion with PostgreSQL 'internal' data type arguments allows any us...

openSUSE 16: postgresql16 / postgresql16-contrib / postgresql16-devel / etc (openSUSE-SU-2026:21701-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21701-1 advisory. - CVE-2026-6464: psql COPY FROM STDIN early failure processes data lines as psql commands bsc1275046. - CVE-2026-6469: ALTER TABLE ALTER TYPE...

openSUSE 16: postgresql17 / postgresql17-contrib / postgresql17-devel / etc (openSUSE-SU-2026:21702-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21702-1 advisory. - CVE-2026-6464: psql COPY FROM STDIN early failure processes data lines as psql commands bsc1275046. - CVE-2026-6469: ALTER TABLE ALTER TYPE...

openSUSE 16: libecpg6 / libpq5 / postgresql18 / postgresql18-contrib / etc (openSUSE-SU-2026:21703-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21703-1 advisory. - CVE-2026-6464: psql COPY FROM STDIN early failure processes data lines as psql commands bsc1275046. - CVE-2026-6469: ALTER TABLE ALTER TYPE...

SUSE CVE-2026-72250

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfconntrackreasm: guard macheader adjustment after IPv6 defrag nfctfrag6reasm slides the packet head forward to drop the IPv6 fragment header and then unconditionally advances skb-macheader: skb-macheader += sizeofstru...

Updated postgresql18 & postgresql15 packages fix security vulnerabilities

psql COPY FROM STDIN early failure processes data lines as psql commands. CVE-2026-6464 ALTER TABLE ALTER TYPE resets extended statistics ownership. CVE-2026-6469 Fails to check type USAGE privilege. CVE-2026-6470 Logical decoding can dlopen arbitrary file. CVE-2026-6471 tsvector and tsquery...

MGASA-2026-0347 Updated postgresql18 & postgresql15 packages fix security vulnerabilities

psql COPY FROM STDIN early failure processes data lines as psql commands. CVE-2026-6464 ALTER TABLE ALTER TYPE resets extended statistics ownership. CVE-2026-6469 Fails to check type USAGE privilege. CVE-2026-6470 Logical decoding can dlopen arbitrary file. CVE-2026-6471 tsvector and tsquery...