Threats Tagged 'cve-2026-16816'

CVE-2026-16816 is a critical OS command injection vulnerability in IBM AIX versions 7.2 and 7.3, and IBM PowerVM VIOS 4.1. It allows a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements in OS commands. The vulnerability has a high CVSS score of 9.9, indicating severe impact on confidentiality, integrity, and availability.

This update for postgresql13 fixes the following issues: Security fixes: - CVE-2025-12817: Fixed missing check for CREATE privileges on the schema in CREATE STATISTICS allowed table owners to create statistics in any schema, potentially leading to unexpected naming conflicts (bsc#1253332) - CVE-2025-12818: Fixed several places in libpq were not sufficiently careful about computing the required size of a memory allocation. Sufficiently large inputs could cause integer overflow, resulting in an undersized buffer, which would then lead to writing past the end of the buffer (bsc#1253333) Other fixes: - Update to 13.23 * https://www.postgresql.org/about/news/p-3171/ * https://www.postgresql.org/docs/release/13.23