Описание
Security update for postgresql16
This update for postgresql16 fixes the following issues:
Upgraded to 16.11:
- CVE-2025-12817: Fixed missing check for CREATE privileges on the schema in CREATE STATISTICS (bsc#1253332)
- CVE-2025-12818: Fixed integer overflow in allocation-size calculations within libpq (bsc#1253333)
Other fixes:
- Use %product_libs_llvm_ver to determine the LLVM version.
- Remove conditionals for obsolete PostgreSQL releases.
- Sync spec file from version 18.
Список пакетов
Container suse/postgres:16
SUSE Linux Enterprise Module for Basesystem 15 SP6
SUSE Linux Enterprise Module for Legacy 15 SP7
SUSE Linux Enterprise Module for Package Hub 15 SP6
SUSE Linux Enterprise Module for Package Hub 15 SP7
SUSE Linux Enterprise Module for Server Applications 15 SP6
SUSE Linux Enterprise Module for Server Applications 15 SP7
openSUSE Leap 15.6
Ссылки
- Link for SUSE-SU-2025:4388-1
- E-Mail link for SUSE-SU-2025:4388-1
- SUSE Security Ratings
- SUSE Bug 1253332
- SUSE Bug 1253333
- SUSE CVE CVE-2025-12817 page
- SUSE CVE CVE-2025-12818 page
Описание
Missing authorization in PostgreSQL CREATE STATISTICS command allows a table owner to achieve denial of service against other CREATE STATISTICS users by creating in any schema. A later CREATE STATISTICS for the same name, from a user having the CREATE privilege, would then fail. Versions before PostgreSQL 18.1, 17.7, 16.11, 15.15, 14.20, and 13.23 are affected.
Затронутые продукты
Ссылки
- CVE-2025-12817
- SUSE Bug 1253332
Описание
Integer wraparound in multiple PostgreSQL libpq client library functions allows an application input provider or network peer to cause libpq to undersize an allocation and write out-of-bounds by hundreds of megabytes. This results in a segmentation fault for the application using libpq. Versions before PostgreSQL 18.1, 17.7, 16.11, 15.15, 14.20, and 13.23 are affected.
Затронутые продукты
Ссылки
- CVE-2025-12818
- SUSE Bug 1253333