{"id":"CLSA-2026-1779494089","summary":"Fix of 7 CVEs","details":"   * SECURITY UPDATE: PostgreSQL 2026-05-14 security batch (CVE-2026-6473,\n     6474, 6475, 6477, 6478, 6479, 6637). Backports adapted from upstream\n     REL_14_STABLE to PG 12 source.\n     - debian/patches/CVE-2026-6473.patch: integer wraparound in ts_headline\n       and ltree lquery parsing; bound StartSel/StopSel/FragmentDelimiter to\n       PG_INT16_MAX and add overflow checks in parse_lquery (no\n       pg_add_u16_overflow() in PG 12, manual PG_UINT16_MAX compare).\n     - debian/patches/CVE-2026-6474.patch: externally-controlled format\n       string in timeofday() via pg_strftime() with crafted timezones; guard\n       against unsafe conditions.\n     - debian/patches/CVE-2026-6475.patch: symlink following in\n       pg_basebackup plain format and in pg_rewind allowing origin\n       superuser to overwrite local files.\n     - debian/patches/CVE-2026-6477.patch: mark PQfn() unsafe and fix\n       overrun in libpq lo_export/lo_read/lo_lseek64/lo_tell64 frontend\n       LO interface.\n     - debian/patches/CVE-2026-6478.patch: covert timing channel in MD5\n       password comparison; replace memcmp with timingsafe_bcmp in SCRAM\n       and MD5 password verification paths.\n     - debian/patches/CVE-2026-6479.patch: uncontrolled recursion in\n       ProcessStartupPacket() via alternating SSL/GSS negotiation requests.\n     - debian/patches/CVE-2026-6637.patch: stack buffer overflow in the\n       refint contrib module with attacker-controlled column names.\n     - CVE-2026-6473\n     - CVE-2026-6474\n     - CVE-2026-6475\n     - CVE-2026-6477\n     - CVE-2026-6478\n     - CVE-2026-6479\n     - CVE-2026-6637","modified":"2026-06-04T09:47:21.942770177Z","published":"2026-05-22T23:54:53Z","upstream":["CVE-2026-6473","CVE-2026-6474","CVE-2026-6475","CVE-2026-6477","CVE-2026-6478","CVE-2026-6479","CVE-2026-6637"],"references":[{"type":"ADVISORY","url":"https://errata.tuxcare.com/els_os/ubuntu20.04els/CLSA-2026-1779494089.html"}],"affected":[{"package":{"name":"libecpg-compat3","ecosystem":"TuxCare:Ubuntu:20.04","purl":"pkg:deb/tuxcare/libecpg-compat3?distro=ubuntu-20.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.22-0ubuntu0.20.04.4+tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1779494089.json"}},{"package":{"name":"libecpg-dev","ecosystem":"TuxCare:Ubuntu:20.04","purl":"pkg:deb/tuxcare/libecpg-dev?distro=ubuntu-20.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.22-0ubuntu0.20.04.4+tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1779494089.json"}},{"package":{"name":"libecpg6","ecosystem":"TuxCare:Ubuntu:20.04","purl":"pkg:deb/tuxcare/libecpg6?distro=ubuntu-20.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.22-0ubuntu0.20.04.4+tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1779494089.json"}},{"package":{"name":"libpgtypes3","ecosystem":"TuxCare:Ubuntu:20.04","purl":"pkg:deb/tuxcare/libpgtypes3?distro=ubuntu-20.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.22-0ubuntu0.20.04.4+tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1779494089.json"}},{"package":{"name":"libpq-dev","ecosystem":"TuxCare:Ubuntu:20.04","purl":"pkg:deb/tuxcare/libpq-dev?distro=ubuntu-20.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.22-0ubuntu0.20.04.4+tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1779494089.json"}},{"package":{"name":"libpq5","ecosystem":"TuxCare:Ubuntu:20.04","purl":"pkg:deb/tuxcare/libpq5?distro=ubuntu-20.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.22-0ubuntu0.20.04.4+tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1779494089.json"}},{"package":{"name":"postgresql-12","ecosystem":"TuxCare:Ubuntu:20.04","purl":"pkg:deb/tuxcare/postgresql-12?distro=ubuntu-20.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.22-0ubuntu0.20.04.4+tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1779494089.json"}},{"package":{"name":"postgresql-client-12","ecosystem":"TuxCare:Ubuntu:20.04","purl":"pkg:deb/tuxcare/postgresql-client-12?distro=ubuntu-20.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.22-0ubuntu0.20.04.4+tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1779494089.json"}},{"package":{"name":"postgresql-doc-12","ecosystem":"TuxCare:Ubuntu:20.04","purl":"pkg:deb/tuxcare/postgresql-doc-12?distro=ubuntu-20.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.22-0ubuntu0.20.04.4+tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1779494089.json"}},{"package":{"name":"postgresql-plperl-12","ecosystem":"TuxCare:Ubuntu:20.04","purl":"pkg:deb/tuxcare/postgresql-plperl-12?distro=ubuntu-20.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.22-0ubuntu0.20.04.4+tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1779494089.json"}},{"package":{"name":"postgresql-plpython3-12","ecosystem":"TuxCare:Ubuntu:20.04","purl":"pkg:deb/tuxcare/postgresql-plpython3-12?distro=ubuntu-20.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.22-0ubuntu0.20.04.4+tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1779494089.json"}},{"package":{"name":"postgresql-pltcl-12","ecosystem":"TuxCare:Ubuntu:20.04","purl":"pkg:deb/tuxcare/postgresql-pltcl-12?distro=ubuntu-20.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.22-0ubuntu0.20.04.4+tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1779494089.json"}},{"package":{"name":"postgresql-server-dev-12","ecosystem":"TuxCare:Ubuntu:20.04","purl":"pkg:deb/tuxcare/postgresql-server-dev-12?distro=ubuntu-20.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.22-0ubuntu0.20.04.4+tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1779494089.json"}}],"schema_version":"1.7.5"}