{"id":"openSUSE-SU-2026:22122-1","summary":"Security update for psqlODBC","details":"This update for psqlODBC fixes the following issues:\n\nChanges in psqlODBC:\n\nUpdate to 18.00.0005:\n\n  * https://odbc.postgresql.org/docs/release.html\n  * Fix heap memory corruption when an application binds more than\n    32767 parameters on a single statement. SQLBindParameter now\n    rejects parameter numbers outside 1..32767 with SQLSTATE 07009\n    (CVE-2026-109448, bsc#1285073).\n  * Fix the placeholder cast being truncated from parameter 1000\n    on, which failed with 'type \"timestam\" does not exist'.\n  * Report the largest column size instead of SQL_NO_TOTAL (-4) as\n    COLUMN_SIZE for bytea in SQLGetTypeInfo, which broke bytea\n    parameters through MSDASQL.\n\n- Changes in 18.00.0004:\n\n  * Fix the result-conversions regression test on big-endian\n    systems.\n\n- Changes in 18.00.0003:\n\n  * Report SQLSTATE 22003 for out-of-range integer conversions\n    instead of silently returning the wrapped low bits.\n  * Fix statement level rollback (Protocol=7.4-2) discarding the\n    whole transaction on a syntax error.\n  * Do not wrap internal queries in a savepoint at\n    rollback-on-error level 0 (Protocol=7.4-0), which lost\n    transactions on servers without SAVEPOINT support.\n  * Redact the database password (ODBC PWD and libpq pqopt\n    password) in debug logs.\n  * Fix hang on COPY ... FROM STDIN / TO STDOUT: report it as\n    unsupported and keep the connection usable.\n  * Fix 'infinity'/'-infinity' dates being silently returned as\n    today's date.\n  * Document the connection string escaping rules.\n\n- Changes in 18.00.0002:\n\n  * Use a signed type for the error status.\n  * Redact sensitive connection parameters in the driver logs.\n  * Fix double free / heap corruption during SQLDisconnect\n    cleanup.\n  * Clear PGresults from per-query rollback.\n  * Validate UTF-16 surrogate pairs before combining them.\n  * Pass SQLSetDescRec field values correctly.\n  * Avoid reading before leading string literals.\n  * Detach freed application descriptors from statements.\n  * Reject invalid SQLPutData lengths.\n  * Reject overlong cursor names.\n  * Fix version reporting.\n  * Handle ARD bookmark allocation failure.\n  * Validate percent escapes before decoding connection string\n    values.\n  * Avoid reading past the end of conn_settings.\n  * Fix stack buffer overflow in getPrecisionPart().\n  * Fix SQLPrimaryKeys to exclude INCLUDE columns from the result.\n\n- Changes in 18.00.0000, 18.00.0001 and 17.00.0010:\n\n  * No code changes from 17.00.0009.\n\n- Changes in 17.00.0009:\n\n  * Fix the test suite for PostgreSQL 19, where\n    standard_conforming_strings is always on.\n  * Upgrade the GitHub Actions workflow: use prebuilt PostgreSQL\n    binaries, parallel matrix builds and a separate release job.\n\n- Update to 17.00.0008:\n  * https://odbc.postgresql.org/docs/release.html\n","modified":"2026-10-19T17:23:15.394889609Z","published":"2026-10-16T20:40:51Z","related":["CVE-2026-109448"],"upstream":["CVE-2026-109448"],"references":[{"type":"ADVISORY"},{"type":"REPORT","url":"https://bugzilla.suse.com/1285073"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-109448"}],"affected":[{"package":{"name":"psqlODBC","ecosystem":"openSUSE:Leap 16.0","purl":"pkg:rpm/opensuse/psqlODBC&distro=openSUSE%20Leap%2016.0"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.00.0005-bp160.1.1"}]}],"ecosystem_specific":{"binaries":[{"psqlODBC":"18.00.0005-bp160.1.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2026:22122-1.json"}}],"schema_version":"1.9.0"}