Threats Tagged 'cve-2026-63383'

PostgreSQL is an advanced object-relational database management system (DBMS). Security Fix(es): * postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions (CVE-2026-14662) * postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN (CVE-2026-6464) * postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin (CVE-2026-6471) * postgresql: PostgreSQL: Arbitrary code execution via type confusion with "internal" arguments (CVE-2026-14680) * postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp (CVE-2026-14664) * postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl (CVE-2026-14677) * postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound (CVE-2026-15742) * postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle (CVE-2026-16239) * postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation (CVE-2026-14669) * postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation (CVE-2026-14679) * postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module (CVE-2026-14671) * postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow (CVE-2026-14670) * postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator (CVE-2026-14668) * postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists (CVE-2026-19385) * postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse (CVE-2026-15741) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Multiple security vulnerabilities have been identified in the libevent library used in Red Hat Hardened Images. These include denial of service, memory corruption, buffer overflow, request smuggling, arbitrary code execution, and access control bypass issues. The vulnerabilities affect specific stable versions of libevent and have been addressed in updated packages.

Multiple security vulnerabilities were identified in libevent, an asynchronous event notification library, affecting various versions used in Red Hat and Ubuntu distributions. These include denial of service, HTTP request smuggling, buffer overflows, access control bypass, and arbitrary code execution issues. The vulnerabilities impact HTTP parsing, RPC data handling, and AF_UNIX socket processing. Fixes are available through official updates from Red Hat and Ubuntu, including Ubuntu Pro for extended support. Users are advised to apply the provided patches to mitigate these risks.

CVE-2026-63383 is a vulnerability in the libevent library where malformed tagged RPC data is incorrectly handled. This flaw can lead to an out-of-bounds read, potentially causing a denial of service. The issue affects multiple Ubuntu LTS releases including 14.04 through 26.04. Official patches are available for all affected versions, and Ubuntu Pro provides extended support for older releases. The vulnerability is rated medium severity based on its impact and attack vector.