Описание
Security update for postgresql16
This update for postgresql16 fixes the following issues:
Upgraded to 16.11:
- CVE-2025-12817: Fixed missing check for CREATE privileges on the schema in CREATE STATISTICS (bsc#1253332)
- CVE-2025-12818: Fixed integer overflow in allocation-size calculations within libpq (bsc#1253333)
Other fixes:
- Use %product_libs_llvm_ver to determine the LLVM version.
- Remove conditionals for obsolete PostgreSQL releases.
- Sync spec file from version 18.
Список пакетов
SUSE Linux Enterprise Server 12 SP5-LTSS
SUSE Linux Enterprise Server LTSS Extended Security 12 SP5
Ссылки
- Link for SUSE-SU-2025:4386-1
- E-Mail link for SUSE-SU-2025:4386-1
- SUSE Security Ratings
- SUSE Bug 1253332
- SUSE Bug 1253333
- SUSE CVE CVE-2025-12817 page
- SUSE CVE CVE-2025-12818 page
Описание
Missing authorization in PostgreSQL CREATE STATISTICS command allows a table owner to achieve denial of service against other CREATE STATISTICS users by creating in any schema. A later CREATE STATISTICS for the same name, from a user having the CREATE privilege, would then fail. Versions before PostgreSQL 18.1, 17.7, 16.11, 15.15, 14.20, and 13.23 are affected.
Затронутые продукты
Ссылки
- CVE-2025-12817
- SUSE Bug 1253332
Описание
Integer wraparound in multiple PostgreSQL libpq client library functions allows an application input provider or network peer to cause libpq to undersize an allocation and write out-of-bounds by hundreds of megabytes. This results in a segmentation fault for the application using libpq. Versions before PostgreSQL 18.1, 17.7, 16.11, 15.15, 14.20, and 13.23 are affected.
Затронутые продукты
Ссылки
- CVE-2025-12818
- SUSE Bug 1253333