Thomas Perale
4e294ae910
For more information about the release, see:
- https://www.postgresql.org/docs/17/release-17-8.html
Fixes the following vulnerabilities:
- CVE-2026-2003:
Improper validation of type "oidvector" in PostgreSQL allows a
database user to disclose a few bytes of server memory. We have not
ruled out viability of attacks that arrange for presence of
confidential information in disclosed bytes, but they seem unlikely.
Versions before PostgreSQL 18.2, 17.8, 16.12, 15.16, and 14.21 are
affected.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2026-2003
- CVE-2026-2004:
Missing validation of type of input in PostgreSQL intarray extension
selectivity estimator function allows an object creator to execute
arbitrary code as the operating system user running the database.
Versions before PostgreSQL 18.2, 17.8, 16.12, 15.16, and 14.21 are
affected.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2026-2004
- CVE-2026-2005:
Heap buffer overflow in PostgreSQL pgcrypto allows a ciphertext
provider to execute arbitrary code as the operating system user
running the database. Versions before PostgreSQL 18.2, 17.8, 16.12,
15.16, and 14.21 are affected.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2026-2005
- CVE-2026-2006:
Missing validation of multibyte character length in PostgreSQL text
manipulation allows a database user to issue crafted queries that
achieve a buffer overrun. That suffices to execute arbitrary code as
the operating system user running the database. Versions before
PostgreSQL 18.2, 17.8, 16.12, 15.16, and 14.21 are affected.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2026-2006
COPYRIGHT year updated in [1].
[1] https://github.com/postgres/postgres/commit/625e4495bf58733f1dac24e363b12e6f95d7e92d
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Reviewed-by: Maxim Kochetkov <fido_max@inbox.ru>
(cherry picked from commit a5a1171ca3)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Buildroot is a simple, efficient and easy-to-use tool to generate embedded Linux systems through cross-compilation. The documentation can be found in docs/manual. You can generate a text document with 'make manual-text' and read output/docs/manual/manual.text. Online documentation can be found at https://buildroot.org/docs.html To build and use the buildroot stuff, do the following: 1) run 'make menuconfig' 2) select the target architecture and the packages you wish to compile 3) run 'make' 4) wait while it compiles 5) find the kernel, bootloader, root filesystem, etc. in output/images You do not need to be root to build or run buildroot. Have fun! Buildroot comes with a basic configuration for a number of boards. Run 'make list-defconfigs' to view the list of provided configurations. Please feed suggestions, bug reports, insults, and bribes back to the buildroot mailing list: buildroot@buildroot.org You can also find us on #buildroot on OFTC IRC. If you would like to contribute patches, please read https://buildroot.org/manual.html#submitting-patches