Use after free in PostgreSQL pltcl allows an object creator to execute arbitrary code as the operating system user running the database, via a domain CHECK that re-enters the Tcl interpreter and frees or changes a string still used by the outer result conversion. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.

Use after free in PostgreSQL pltcl allows an object creator to execute arbitrary code as the operating system user running the database, via a domain CHECK that re-enters the Tcl interpreter and frees or changes a string still used by the outer result conversion. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.

postgresql14-14.25-1.1 on GA media

postgresql: postgresql: Arbitrary code execution via type confusion in data definition commands postgresql: postgresql: Privilege escalation via uncontrolled search path in extension management postgresql: postgresql: Persistent Denial of Service via arbitrary file append in sslkeylogfile parameter postgresql: postgresql: Security restriction bypass via INSERT ON CONFLICT on auto-updatable views postgresql: postgresql: Information disclosure in pg_basebackup via crafted backup manifest postgresql: postgresql: Arbitrary code execution via type confusion in SQL-language functions postgresql: PostgreSQL: Unauthorized execution of restricted cast functions via type conversion operations postgresql: postgresql: Arbitrary code execution via use-after-free in parallel worker coordination postgresql: postgresql: Arbitrary code execution via composite-value field assignment type confusion postgresql: postgresql: Arbitrary code execution via use-after-free in plperl postgresql: postgresql: Information disclosure via zero-length token in dict_int postgresql: postgresql: Arbitrary code execution via type confusion in PL/Perl postgresql: postgresql: Information disclosure via use-after-free in COPY FROM error reporting postgresql: postgresql: row-level security bypass via DROP OWNED postgresql: postgresql: Incorrect trigger row processing via partitioned table MERGE postgresql: postgresql: Privilege escalation via untrusted search path in vacuumdb postgresql: postgresql: Arbitrary code e…

Affected: Ubuntu:Pro:14.04:LTS: postgresql-9.3, Ubuntu:Pro:16.04:LTS: postgresql-9.5, Ubuntu:Pro:18.04:LTS: postgresql-10, Ubuntu:20.04:LTS: postgresql-12, Ubuntu:22.04:LTS: postgresql-14, Ubuntu:24.04:LTS: postgresql-16, Ubuntu:26.10: postgresql-18, Ubuntu:26.04:LTS: postgresql-18

Use after free in PostgreSQL pltcl allows an object creator to execute arbitrary code as the operating system user running the database, via a domain CHECK that re-enters the Tcl interpreter and frees or changes a string still used by the outer result conversion. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.

Ein Angreifer kann mehrere Schwachstellen in PostgreSQL ausnutzen, um beliebigen Code auszuführen, Berechtigungen zu erweitern, Sicherheitsmaßnahmen zu umgehen, SQL-Injection durchzuführen, Daten zu manipulieren und offenzulegen oder einen Denial-of-Service-Zustand zu verursachen.