{"id":"CLSA-2026-1779880647","summary":"Fix of 6 CVEs","details":"   * SECURITY UPDATE: postgresql May-2026 CVE batch\n     - debian/patches/CVE-2026-6473.patch: integer overflow fixes across multiple\n       vulnerable sites: hstore_plperl/hstore_plpython palloc sizing (mul_size),\n       array_agg() nitems overflow, intarray/ltxtquery findoprnd() left-offset\n       overflow, ltree lquery numvar/totallen overflow, and ts_headline option\n       length overflow.\n     - debian/patches/CVE-2026-6474.patch: guard pg_strftime() callers and ensure\n       null-terminated output on overflow, plus split timeofday() pg_strftime so\n       the %Z timezone string is never embedded as a format string in subsequent\n       snprintf().\n     - debian/patches/CVE-2026-6475.patch: prevent path traversal in pg_rewind\n       file operations via path_is_safe_for_extraction() helper.\n     - debian/patches/CVE-2026-6477.patch: harden PQfn()/pqFunctionCall3() against\n       server-controlled buffer overruns in libpq large-object interface.\n     - debian/patches/CVE-2026-6478.patch: add timingsafe_bcmp() helper and apply\n       to MD5/SCRAM/RADIUS/plain auth-paths to prevent timing-channel leaks.\n     - debian/patches/CVE-2026-6637.patch: switch refint contrib check_foreign_key\n       to StringInfo and quote_literal_cstr() to prevent SQL injection and stack\n       buffer overruns.\n     - CVE-2026-6473\n     - CVE-2026-6474\n     - CVE-2026-6475\n     - CVE-2026-6477\n     - CVE-2026-6478\n     - CVE-2026-6637\n   * debian/patches/fix-regress-tzdata-LMT.patch: refresh src/test/regress\n     expected output for date, timestamptz and horology tests so that they\n     match the LMT abbreviation emitted by current tzdata for pre-1883\n     America/Los_Angeles dates.","modified":"2026-06-04T09:47:29.714155530Z","published":"2026-05-27T11:18:48Z","upstream":["CVE-2026-6473","CVE-2026-6474","CVE-2026-6475","CVE-2026-6477","CVE-2026-6478","CVE-2026-6637"],"references":[{"type":"ADVISORY","url":"https://errata.tuxcare.com/els_os/ubuntu18.04els/CLSA-2026-1779880647.html"}],"affected":[{"package":{"name":"libecpg-compat3","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/libecpg-compat3?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.23-0ubuntu0.18.04.2+tuxcare.els6"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1779880647.json"}},{"package":{"name":"libecpg-dev","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/libecpg-dev?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.23-0ubuntu0.18.04.2+tuxcare.els6"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1779880647.json"}},{"package":{"name":"libecpg6","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/libecpg6?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.23-0ubuntu0.18.04.2+tuxcare.els6"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1779880647.json"}},{"package":{"name":"libpgtypes3","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/libpgtypes3?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.23-0ubuntu0.18.04.2+tuxcare.els6"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1779880647.json"}},{"package":{"name":"libpq-dev","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/libpq-dev?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.23-0ubuntu0.18.04.2+tuxcare.els6"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1779880647.json"}},{"package":{"name":"libpq5","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/libpq5?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.23-0ubuntu0.18.04.2+tuxcare.els6"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1779880647.json"}},{"package":{"name":"postgresql-10","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/postgresql-10?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.23-0ubuntu0.18.04.2+tuxcare.els6"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1779880647.json"}},{"package":{"name":"postgresql-client-10","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/postgresql-client-10?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.23-0ubuntu0.18.04.2+tuxcare.els6"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1779880647.json"}},{"package":{"name":"postgresql-doc-10","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/postgresql-doc-10?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.23-0ubuntu0.18.04.2+tuxcare.els6"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1779880647.json"}},{"package":{"name":"postgresql-plperl-10","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/postgresql-plperl-10?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.23-0ubuntu0.18.04.2+tuxcare.els6"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1779880647.json"}},{"package":{"name":"postgresql-plpython-10","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/postgresql-plpython-10?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.23-0ubuntu0.18.04.2+tuxcare.els6"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1779880647.json"}},{"package":{"name":"postgresql-plpython3-10","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/postgresql-plpython3-10?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.23-0ubuntu0.18.04.2+tuxcare.els6"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1779880647.json"}},{"package":{"name":"postgresql-pltcl-10","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/postgresql-pltcl-10?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.23-0ubuntu0.18.04.2+tuxcare.els6"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1779880647.json"}},{"package":{"name":"postgresql-server-dev-10","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/postgresql-server-dev-10?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.23-0ubuntu0.18.04.2+tuxcare.els6"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1779880647.json"}}],"schema_version":"1.7.5"}