-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Tue, 12 May 2026 12:51:10 +0200 Source: postgresql-15 Binary: libecpg-compat3 libecpg-compat3-dbgsym libecpg-dev libecpg-dev-dbgsym libecpg6 libecpg6-dbgsym libpgtypes3 libpgtypes3-dbgsym libpq-dev libpq5 libpq5-dbgsym postgresql-15 postgresql-15-dbgsym postgresql-client-15 postgresql-client-15-dbgsym postgresql-plperl-15 postgresql-plperl-15-dbgsym postgresql-plpython3-15 postgresql-plpython3-15-dbgsym postgresql-pltcl-15 postgresql-pltcl-15-dbgsym postgresql-server-dev-15 Architecture: ppc64el Version: 15.18-0+deb12u1 Distribution: bookworm-security Urgency: medium Maintainer: ppc64el Build Daemon (ppc64el-osuosl-01) Changed-By: Christoph Berg Description: libecpg-compat3 - older version of run-time library for ECPG programs libecpg-dev - development files for ECPG (Embedded PostgreSQL for C) libecpg6 - run-time library for ECPG programs libpgtypes3 - shared library libpgtypes for PostgreSQL 15 libpq-dev - header files for libpq5 (PostgreSQL library) libpq5 - PostgreSQL C client library postgresql-15 - The World's Most Advanced Open Source Relational Database postgresql-client-15 - front-end programs for PostgreSQL 15 postgresql-plperl-15 - PL/Perl procedural language for PostgreSQL 15 postgresql-plpython3-15 - PL/Python 3 procedural language for PostgreSQL 15 postgresql-pltcl-15 - PL/Tcl procedural language for PostgreSQL 15 postgresql-server-dev-15 - development files for PostgreSQL 15 server-side programming Changes: postgresql-15 (15.18-0+deb12u1) bookworm-security; urgency=medium . * New upstream version 15.18. . + Prevent unbounded recursion while processing startup packets (Michael Paquier) . A malicious client could crash the connected backend by alternating rejected SSL and GSS encryption requests indefinitely. . The PostgreSQL Project thanks Calif.io (in collaboration with Claude and Anthropic Research) for reporting this problem. (CVE-2026-6479) . + Fix assorted integer overflows in memory-allocation calculations (Tom Lane, Nathan Bossart, Heikki Linnakangas) . Various places were incautious about the possibility of integer overflow in calculations of how much memory to allocate. Overflow would lead to allocating a too-small buffer which the caller would then write past the end of. This would at least trigger server crashes, and probably could be exploited for arbitrary code execution. In many but by no means all cases, the hazard exists only in 32-bit builds. . The PostgreSQL Project thanks Xint Code, Bruce Dang, Sven Klemm, and Pavel Kohout for reporting these problems. (CVE-2026-6473) . + Reject over-length options in ts_headline() (Michael Paquier) . The StartSel, StopSel and FragmentDelimiter strings must not exceed 32Kb in length, but this was not checked for. An over-length value would typically crash the server. . The PostgreSQL Project thanks Xint Code for reporting this problem. (CVE-2026-6473) . + Guard against malicious time zone names in timeofday() and pg_strftime() (Tom Lane) . A crafted time zone setting could pass % sequences to snprintf(), potentially causing crashes or disclosure of server memory. Another path to similar results was to overflow the limited-size output buffer used by pg_strftime(). . The PostgreSQL Project thanks Xint Code for reporting this problem. (CVE-2026-6474) . + When creating a multirange type, ensure the user has CREATE privilege on the schema specified for the multirange type (Jelte Fennema-Nio) . The multirange type can be put into a different schema than its parent range type, but we neglected to apply the required privilege check when doing so. . The PostgreSQL Project thanks Jelte Fennema-Nio for reporting this problem. (CVE-2026-6472) . + Use timing-safe string comparisons in authentication code (Michael Paquier) . Use timingsafe_bcmp() instead of memcpy() or strcmp() when checking passwords, hashes, etc. It is not known whether the data dependency of those functions is usefully exploitable in any of these places, but in the interests of safety, replace them. . The PostgreSQL Project thanks Joe Conway for reporting this problem. (CVE-2026-6478) . + Mark PQfn() as unsafe, and avoid using it within libpq (Nathan Bossart) . For a non-integral result type, PQfn() is not passed the size of the output buffer, so it cannot check that the data returned by the server will fit. A malicious server could therefore overwrite client memory. This is unfixable without an API change, so mark the function as deprecated. Internally to libpq, use a variant version that can apply the missing check. . The PostgreSQL Project thanks Yu Kunpeng and Martin Heistermann for reporting this problem. (CVE-2026-6477) . + Prevent path traversal in pg_basebackup and pg_rewind (Michael Paquier) . These applications failed to validate output file paths read from their input, so that a malicious source could overwrite any file writable by these applications. Constrain where data can be written by rejecting paths that are absolute or contain parent-directory references. . The PostgreSQL Project thanks XlabAI Team of Tencent Xuanwu Lab and Valery Gubanov for reporting this problem. (CVE-2026-6475) . + Guard against field overflow within contrib/intarray's query_int type and contrib/ltree's ltxtquery type (Tom Lane) . Parsing of these query structures did not check for overflow of 16-bit fields, so that construction of an invalid query tree was possible. This can crash the server when executing the query. . The PostgreSQL Project thanks Xint Code for reporting this problem. (CVE-2026-6473) . + Guard against overly long values of contrib/ltree's lquery type (Michael Paquier) . Values with more than 64K items caused internal overflows, potentially resulting in stack smashes or wrong answers. . The PostgreSQL Project thanks Vergissmeinnicht, A1ex, and Jihe Wang for reporting this problem. (CVE-2026-6473) . + Prevent SQL injection and buffer overruns in contrib/spi (Nathan Bossart) . check_foreign_key() was insufficiently careful about quoting key values, and also used fixed-length buffers for constructing queries. While this module is only meant as example code, it still shouldn't contain such dangerous errors. . The PostgreSQL Project thanks Nikolay Samokhvalov for reporting this problem. (CVE-2026-6637) Checksums-Sha1: cc15d319cd0a6bbdd85ad72712f9a791f0d151da 17584 libecpg-compat3-dbgsym_15.18-0+deb12u1_ppc64el.deb 133d53a77de50f87e2b813ebf0f7f44f64ca6504 23864 libecpg-compat3_15.18-0+deb12u1_ppc64el.deb 37c7816183371739ed0aa7cd96f19142dae5b767 227180 libecpg-dev-dbgsym_15.18-0+deb12u1_ppc64el.deb a45b66e43adb2b31890827d798c93b0a8787fd1c 305792 libecpg-dev_15.18-0+deb12u1_ppc64el.deb e7b7f9b4ebe2fc2a7e390a875a7dbfbdc04c7d3c 114272 libecpg6-dbgsym_15.18-0+deb12u1_ppc64el.deb 1e4ec69dbf54fe875bd9e692d16133ef5670a8c0 70964 libecpg6_15.18-0+deb12u1_ppc64el.deb e623d151d02711d227453edb590963c19ea5d334 90928 libpgtypes3-dbgsym_15.18-0+deb12u1_ppc64el.deb 5300d8ad3b382c731254a8ab3dc91a19b870d029 54476 libpgtypes3_15.18-0+deb12u1_ppc64el.deb 1ddf4a0e5e4f7914d5b9b436deee7df45c23893a 163800 libpq-dev_15.18-0+deb12u1_ppc64el.deb 88dbfe493d7d8c5505b0deeab0dd582038a15986 290380 libpq5-dbgsym_15.18-0+deb12u1_ppc64el.deb 4f8ea0dfe91cde178ed5ef9e53fec2de6ff3b0c1 207672 libpq5_15.18-0+deb12u1_ppc64el.deb 90ec4f5389050c1ee894c0f9ea325a067ad740c5 16870936 postgresql-15-dbgsym_15.18-0+deb12u1_ppc64el.deb 690847cfb35d1efe369928c772e846eb7d3083cd 17441 postgresql-15_15.18-0+deb12u1_ppc64el-buildd.buildinfo 2bd85a3b9962a2e6544ef467c4c5dc1dc92884a5 17236328 postgresql-15_15.18-0+deb12u1_ppc64el.deb 60fc26ec07ccb97ca23acd96b3ae964baa221b44 2574976 postgresql-client-15-dbgsym_15.18-0+deb12u1_ppc64el.deb 60c03b4553e774cac713f519163eb1b6f5504eb6 1770436 postgresql-client-15_15.18-0+deb12u1_ppc64el.deb 9041a8e5afc0b78e6a4c406275d96dee716983c3 186508 postgresql-plperl-15-dbgsym_15.18-0+deb12u1_ppc64el.deb 2a8c850c6805c9f27f592eb8e63b089f64c6c5bf 96764 postgresql-plperl-15_15.18-0+deb12u1_ppc64el.deb aa76de57681dacbf5d00c288e5c471a46b6a5782 176432 postgresql-plpython3-15-dbgsym_15.18-0+deb12u1_ppc64el.deb 3fac6468466ee312058c579508a38070394e7546 117376 postgresql-plpython3-15_15.18-0+deb12u1_ppc64el.deb 316161bdc26ac56b6155401d92d718a5dc519d0b 80048 postgresql-pltcl-15-dbgsym_15.18-0+deb12u1_ppc64el.deb 1457dc660c7245d0e4e5421dd37de4641c6824b5 48084 postgresql-pltcl-15_15.18-0+deb12u1_ppc64el.deb 3c1bfed55f889f2b502bad164f9b3a4bcab499d6 1172192 postgresql-server-dev-15_15.18-0+deb12u1_ppc64el.deb Checksums-Sha256: 06c486bd910fd5c98dd3c5cb622e2636d6cc8bc5e3e14f7f5b08aa33e3a86fbc 17584 libecpg-compat3-dbgsym_15.18-0+deb12u1_ppc64el.deb 8aa1eae6703258396ef135eec036e773ed780c6a26d36739519d18fce5379e86 23864 libecpg-compat3_15.18-0+deb12u1_ppc64el.deb 9a149bd594141b1f990f88b20c53747da74bd01d6218d52a75c6a1bd10739ecf 227180 libecpg-dev-dbgsym_15.18-0+deb12u1_ppc64el.deb aaf2984133e57cffc9f9d3af8f4924c3cb1db5cc02d2f413655e077c54e3768b 305792 libecpg-dev_15.18-0+deb12u1_ppc64el.deb 811024e1ce6642b9a2a0798975734a490c7a980849d6dd28adbacf33ff4572cb 114272 libecpg6-dbgsym_15.18-0+deb12u1_ppc64el.deb e2beca370ac13010e98429263965b3e10dccb5ad8e0e0aaba141c38d48106627 70964 libecpg6_15.18-0+deb12u1_ppc64el.deb c2e97b15d24e020436230432f323f71640fc3a54a417608e3f43e20c53257527 90928 libpgtypes3-dbgsym_15.18-0+deb12u1_ppc64el.deb 1d6ff608cb060e6f302d3ac5a68b8d7c9111e7b277f4a1ac51555af278bdcae6 54476 libpgtypes3_15.18-0+deb12u1_ppc64el.deb 03973a47658734bb9d1d0756040e38b73098efbf0e5e63cfb3b88b79ebdfba50 163800 libpq-dev_15.18-0+deb12u1_ppc64el.deb 4e58d666ae0c40f6c3f87429dceff16eec1f503e9040e884360a27cac6f8f053 290380 libpq5-dbgsym_15.18-0+deb12u1_ppc64el.deb d5a1f506744d610a14f2187153bde7ec93198c50032bdc0fd8799e37f37fff0b 207672 libpq5_15.18-0+deb12u1_ppc64el.deb 6def599083b7fa5dd8d3fd3ba257a1e86ff67b75953a8040081704e4f377fd7b 16870936 postgresql-15-dbgsym_15.18-0+deb12u1_ppc64el.deb 7e63ae0f539283ca89406f59e10e14c8256b758aacc86a6ea0f1e9c66f950ac6 17441 postgresql-15_15.18-0+deb12u1_ppc64el-buildd.buildinfo d4b72a1a6cb5dea931987b1db3e7150f056d71c0122bce61e48f3e607b92bb54 17236328 postgresql-15_15.18-0+deb12u1_ppc64el.deb adf7001b38afb7ad040c3073594a08adc7149d74eb51f78694754bc2ab3f313b 2574976 postgresql-client-15-dbgsym_15.18-0+deb12u1_ppc64el.deb 3c7acceb1275ffb6004c70097431868f388e12deb3c91c7fef62569dca498d00 1770436 postgresql-client-15_15.18-0+deb12u1_ppc64el.deb efc0c29be1fbcfd7b2ec3016c7cf8ea631c52f5a2966fa5394271a431a0094b8 186508 postgresql-plperl-15-dbgsym_15.18-0+deb12u1_ppc64el.deb 90fa2f390ecca8f88eb5dd1069981cb91681110a6d3897e5cdc18118145489b8 96764 postgresql-plperl-15_15.18-0+deb12u1_ppc64el.deb c7aee8843afd16f42fe55b4c365c50732fcf6e6a30028e82d72d6bb5b407c444 176432 postgresql-plpython3-15-dbgsym_15.18-0+deb12u1_ppc64el.deb c963812ef03e5a57ecb8744b7c29b19d959c466fc9ad604fea4c2f733880c3cd 117376 postgresql-plpython3-15_15.18-0+deb12u1_ppc64el.deb b58224dc685cd3a989cd51d87031318b53592e232aff76133eaa33578aad3af9 80048 postgresql-pltcl-15-dbgsym_15.18-0+deb12u1_ppc64el.deb c79f0f875f327760258d9087b240915521780eeafa89191fd0224e4f6c6d6ccf 48084 postgresql-pltcl-15_15.18-0+deb12u1_ppc64el.deb 32d6e4f4fd2855d28eb10f9581529eddb31dbe5db645bcdcb13ebdc7033b7b68 1172192 postgresql-server-dev-15_15.18-0+deb12u1_ppc64el.deb Files: bf27d68cd247649414b1c94cd760e0a6 17584 debug optional libecpg-compat3-dbgsym_15.18-0+deb12u1_ppc64el.deb a08a17b67ac7f3057b58734ca992e08c 23864 libs optional libecpg-compat3_15.18-0+deb12u1_ppc64el.deb e2da3e41494c4184cd09d77c004f6106 227180 debug optional libecpg-dev-dbgsym_15.18-0+deb12u1_ppc64el.deb 04d3b54d6ada4d3e9503eff0b0cedd84 305792 libdevel optional libecpg-dev_15.18-0+deb12u1_ppc64el.deb cddf13a835549a444c83bd227016d1d3 114272 debug optional libecpg6-dbgsym_15.18-0+deb12u1_ppc64el.deb 82d57a34bb6eb629ef831a9cc0605762 70964 libs optional libecpg6_15.18-0+deb12u1_ppc64el.deb 84f7c8534ec686de36465b205a6c30d2 90928 debug optional libpgtypes3-dbgsym_15.18-0+deb12u1_ppc64el.deb 3c3ee3d15979f0568d304cd0fad9e617 54476 libs optional libpgtypes3_15.18-0+deb12u1_ppc64el.deb 1047ae4215da771f867e88aba712e50d 163800 libdevel optional libpq-dev_15.18-0+deb12u1_ppc64el.deb 6801a61c00685d5113479d6ee7b23b4b 290380 debug optional libpq5-dbgsym_15.18-0+deb12u1_ppc64el.deb 5f0bd5fe4ffad2c3deac773a0015e160 207672 libs optional libpq5_15.18-0+deb12u1_ppc64el.deb 36018a917454cfcb99e36bf63f24caf3 16870936 debug optional postgresql-15-dbgsym_15.18-0+deb12u1_ppc64el.deb 4da8d31637b5a4b23640f16845faae8a 17441 database optional postgresql-15_15.18-0+deb12u1_ppc64el-buildd.buildinfo 6d9b3a1850647e7b947533ed06988772 17236328 database optional postgresql-15_15.18-0+deb12u1_ppc64el.deb 3d28b63f827e953a04e7ca942f73d1ea 2574976 debug optional postgresql-client-15-dbgsym_15.18-0+deb12u1_ppc64el.deb f54d23dc43710c1e8c633331b8440d7e 1770436 database optional postgresql-client-15_15.18-0+deb12u1_ppc64el.deb 1482903b29b91fc980a54e43f9b84a16 186508 debug optional postgresql-plperl-15-dbgsym_15.18-0+deb12u1_ppc64el.deb 5843dfc3bce006546a4383e2a7cee417 96764 database optional postgresql-plperl-15_15.18-0+deb12u1_ppc64el.deb ee3b1e9b0505bd5f5927a8c7f7431b8a 176432 debug optional postgresql-plpython3-15-dbgsym_15.18-0+deb12u1_ppc64el.deb a4afbbc081590a7fe9126c4ffb40f648 117376 database optional postgresql-plpython3-15_15.18-0+deb12u1_ppc64el.deb 03b5f5c285f08bf79e37c2dd35e8331e 80048 debug optional postgresql-pltcl-15-dbgsym_15.18-0+deb12u1_ppc64el.deb 37389b089ac21ab1c77548417705dd13 48084 database optional postgresql-pltcl-15_15.18-0+deb12u1_ppc64el.deb bc2d79eeb4dce0edf269ed8d6ee2b5d4 1172192 libdevel optional postgresql-server-dev-15_15.18-0+deb12u1_ppc64el.deb -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEETLpi2USYGUNSlYhoNINNphgym2QFAmoDSqAACgkQNINNphgy m2SL0BAA2Xk26HyJsQRnczRYroMnhG4tscJM2vzAlJLZm/DgHsW4OE2vComadzEc zTNylTl/3uB34/JYjmOQdCF8LNEPCQC/vnMa/ZsMek93TP7Lsy+6iPUcGNCFGndt DQebP6XnrWDWbJBJDwzUPRUK1djh1T05z9pmlkfSon2r3/CDCr3Odv8+pKDd6lv0 UsmA1DZ25jzPot7+12hd+DR1r/tiGf+NUXnj/hyH9cNNhQlovYbZSAymdImkPlNR 5mNRbVT0b8A1ytF4uFpVDZ4tTBU0pHRzBUVLzoxeZayHOR5f5BVpLcGvC0TFI6ru wp0vguSqsePkSjtWY2mgoEhN4lBkZDaZ5mQb3I2eiz+vdfabKrnraJGCfZqunPo4 KQOIqfiaFc1w0ho/ll4casPnIxc2zGMSvYWoEwiAIjmiPs0WO03QFPMtcXPnwjCm r+N0KGZ8sJ73R3AIIhDys8cT9MLzI2MvCdESNpog9jNPN6dYNvaywDesgg6wtgfu jkSV8yUS7p28QrgzGexI8Va1RBgC4eJ/9hC0m1MxnsrMqmfE1oThz7+gJSNWBVyC H9lbH2FjDrY3OszKmZDXCft1ZxYnaiUxZ2V9iQl0FOd05a4SZaFvkp1c2SAuX1sC gEGawUczqXleD2d8XrJfHYIDNTeyMdUzrfqfk8lNgkJUaFOvSwg= =FTNN -----END PGP SIGNATURE-----