Threats Tagged 'cve-2026-19385'

Red Hat Update Infrastructure (RHUI) container images are based on the latest RHUI RPM packages and the ubi9 or ubi9-init base images. This release updates to the latest version.

Multiple arbitrary code execution vulnerabilities have been identified in PostgreSQL, affecting various functions and plugins including tsvector, tsquery, logical decoding plugin, regexp, pltcl, plperl, fuzzystrmatch, cursor lifecycle, POSIX timezone abbreviation, and pg_dump transform lists. These vulnerabilities are addressed in a security update released by Red Hat for PostgreSQL 15 and related versions. The update is rated as important by Red Hat Product Security and fixes several critical issues that could allow attackers to execute arbitrary code.

This security update for PostgreSQL 18 addresses multiple vulnerabilities affecting various components such as psql, logical decoding, pgcrypto, regexp, and others. The issues include heap buffer overflows that can lead to arbitrary code execution, type confusion, integer wraparound causing undersize allocations, privilege enforcement failures, and SQL injection risks. The update fixes these vulnerabilities to improve the security and stability of PostgreSQL 18 and related versions.

Red Hat has issued a security advisory for Red Hat Hardened Images RPMs, including multiple PostgreSQL 17 packages. The update addresses several vulnerabilities identified by CVE-2026-14663 and others. This advisory provides updated RPM packages for various PostgreSQL components across aarch64 and x86_64 architectures. The update is classified as a high severity security advisory and includes bug fixes and enhancements. A patch is available and should be applied to affected systems to mitigate the vulnerabilities.

A heap buffer overflow vulnerability exists in PostgreSQL's pg_dump utility when processing long function transform lists. This flaw allows an object creator to execute arbitrary code with the privileges of the operating system user running pg_dump. The issue affects multiple PostgreSQL versions prior to 18.6, 17.11, 16.15, 15.19, and 14.24. A patch is available to address this vulnerability.

CVE-2026-19385 is a heap-based buffer overflow vulnerability in PostgreSQL's pg_dump utility related to handling long function transform lists. This flaw allows an object creator to execute arbitrary code with the privileges of the operating system user running pg_dump by supplying a crafted transform list. Versions prior to PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.