{"id":"CLSA-2026-1779870008","summary":"Fix of 7 CVEs","details":"   * SECURITY UPDATE: postgresql May-2026 CVE batch\n     - debian/patches/CVE-2026-6473.patch: integer overflow fixes across\n       multiple vulnerable sites: formatting.c size calculations (mul_size),\n       intarray/ltxtquery findoprnd() left-offset overflow with int16\n       check, ltree lquery numvar/totallen overflow with PG_UINT16_MAX\n       check, ts_headline option length overflow with per-option\n       ERRCODE_INVALID_PARAMETER_VALUE checks, array_agg\n       accumArrayResultArr() nitems overflow with MaxArraySize check, and\n       hstore_plperl/hstore_plpython palloc overflow via mul_size().\n     - debian/patches/CVE-2026-6474.patch: guard pg_strftime() callers and\n       ensure null-terminated output on overflow; split timeofday()\n       pg_strftime so the %Z timezone string is never embedded as a format\n       string in subsequent snprintf().\n     - debian/patches/CVE-2026-6475.patch: prevent path traversal in\n       pg_rewind via path_is_safe_for_extraction() helper.\n     - debian/patches/CVE-2026-6477.patch: harden PQfn()/pqFunctionCall3\n       against server-controlled buffer overruns in libpq large-object\n       interface (lo_read, lo_lseek64 and lo_tell64 callers).\n     - debian/patches/CVE-2026-6478.patch: add timingsafe_bcmp() helper and\n       apply it in MD5/RADIUS/plain auth paths to prevent timing-channel\n       leaks (SCRAM not in 9.5).\n     - debian/patches/CVE-2026-6479.patch: fix unbounded recursive handling\n       of SSL negotiation in ProcessStartupPacket() (convert recursive call\n       to goto-retry loop).\n     - debian/patches/CVE-2026-6637.patch: switch refint contrib\n       check_foreign_key to StringInfo and quote_literal_cstr() to prevent\n       SQL injection and stack buffer overruns.\n     - CVE-2026-6473\n     - CVE-2026-6474\n     - CVE-2026-6475\n     - CVE-2026-6477\n     - CVE-2026-6478\n     - CVE-2026-6479\n     - CVE-2026-6637\n   * debian/patches/fix-regress-tzdata-LMT.patch: refresh src/test/regress\n     expected output for date, timestamptz and horology tests so they match\n     the LMT abbreviation emitted by current tzdata for pre-1883 dates.","modified":"2026-06-04T09:46:50.272317529Z","published":"2026-05-27T08:20:12Z","upstream":["CVE-2026-6473","CVE-2026-6474","CVE-2026-6475","CVE-2026-6477","CVE-2026-6478","CVE-2026-6479","CVE-2026-6637"],"references":[{"type":"ADVISORY","url":"https://errata.tuxcare.com/els_os/ubuntu16.04els/CLSA-2026-1779870008.html"}],"affected":[{"package":{"name":"libecpg-compat3","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/libecpg-compat3?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.25-0ubuntu0.16.04.1+tuxcare.els13"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1779870008.json"}},{"package":{"name":"libecpg-dev","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/libecpg-dev?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.25-0ubuntu0.16.04.1+tuxcare.els13"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1779870008.json"}},{"package":{"name":"libecpg6","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/libecpg6?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.25-0ubuntu0.16.04.1+tuxcare.els13"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1779870008.json"}},{"package":{"name":"libpgtypes3","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/libpgtypes3?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.25-0ubuntu0.16.04.1+tuxcare.els13"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1779870008.json"}},{"package":{"name":"libpq-dev","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/libpq-dev?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.25-0ubuntu0.16.04.1+tuxcare.els13"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1779870008.json"}},{"package":{"name":"libpq5","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/libpq5?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.25-0ubuntu0.16.04.1+tuxcare.els13"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1779870008.json"}},{"package":{"name":"postgresql-9.5","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/postgresql-9.5?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.25-0ubuntu0.16.04.1+tuxcare.els13"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1779870008.json"}},{"package":{"name":"postgresql-client-9.5","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/postgresql-client-9.5?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.25-0ubuntu0.16.04.1+tuxcare.els13"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1779870008.json"}},{"package":{"name":"postgresql-contrib-9.5","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/postgresql-contrib-9.5?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.25-0ubuntu0.16.04.1+tuxcare.els13"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1779870008.json"}},{"package":{"name":"postgresql-doc-9.5","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/postgresql-doc-9.5?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.25-0ubuntu0.16.04.1+tuxcare.els13"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1779870008.json"}},{"package":{"name":"postgresql-plperl-9.5","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/postgresql-plperl-9.5?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.25-0ubuntu0.16.04.1+tuxcare.els13"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1779870008.json"}},{"package":{"name":"postgresql-plpython-9.5","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/postgresql-plpython-9.5?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.25-0ubuntu0.16.04.1+tuxcare.els13"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1779870008.json"}},{"package":{"name":"postgresql-plpython3-9.5","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/postgresql-plpython3-9.5?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.25-0ubuntu0.16.04.1+tuxcare.els13"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1779870008.json"}},{"package":{"name":"postgresql-pltcl-9.5","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/postgresql-pltcl-9.5?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.25-0ubuntu0.16.04.1+tuxcare.els13"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1779870008.json"}},{"package":{"name":"postgresql-server-dev-9.5","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/postgresql-server-dev-9.5?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.25-0ubuntu0.16.04.1+tuxcare.els13"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1779870008.json"}}],"schema_version":"1.7.5"}