Buffer over-read in PostgreSQL parallel B-tree scans allows an object creator to read attacker-chosen server-memory addresses, via a function incorrectly marked PARALLEL SAFE or STABLE to make participating workers build different scan-key arrays. Within major versions 17-18, minor versions before PostgreSQL 18.7 and 17.12 are affected. Versions before PostgreSQL 17 are unaffected.

Buffer over-read in PostgreSQL parallel B-tree scans allows an object creator to read attacker-chosen server-memory addresses, via a function incorrectly marked PARALLEL SAFE or STABLE to make participating workers build different scan-key arrays. Within major versions 17-18, minor versions before PostgreSQL 18.7 and 17.12 are affected. Versions before PostgreSQL 17 are unaffected.

postgresql17-17.12-1.1 on GA media

postgresql: postgresql: Arbitrary code execution via type confusion in data definition commands postgresql: postgresql: Privilege escalation via uncontrolled search path in extension management postgresql: postgresql: Persistent Denial of Service via arbitrary file append in sslkeylogfile parameter postgresql: postgresql: Security restriction bypass via INSERT ON CONFLICT on auto-updatable views postgresql: postgresql: Information disclosure in pg_basebackup via crafted backup manifest postgresql: postgresql: Arbitrary code execution via type confusion in SQL-language functions postgresql: PostgreSQL: Unauthorized execution of restricted cast functions via type conversion operations postgresql: postgresql: Arbitrary code execution via use-after-free in parallel worker coordination postgresql: postgresql: Arbitrary code execution via composite-value field assignment type confusion postgresql: postgresql: Arbitrary code execution via use-after-free in plperl postgresql: postgresql: Information disclosure via zero-length token in dict_int postgresql: postgresql: Arbitrary code execution via type confusion in PL/Perl postgresql: postgresql: Information disclosure via use-after-free in COPY FROM error reporting postgresql: postgresql: row-level security bypass via DROP OWNED postgresql: postgresql: Incorrect trigger row processing via partitioned table MERGE postgresql: postgresql: Privilege escalation via untrusted search path in vacuumdb postgresql: postgresql: Arbitrary code e…

Affected: Ubuntu:Pro:14.04:LTS: postgresql-9.3, Ubuntu:Pro:16.04:LTS: postgresql-9.5, Ubuntu:Pro:18.04:LTS: postgresql-10, Ubuntu:20.04:LTS: postgresql-12, Ubuntu:22.04:LTS: postgresql-14, Ubuntu:24.04:LTS: postgresql-16, Ubuntu:26.10: postgresql-18, Ubuntu:26.04:LTS: postgresql-18

Buffer over-read in PostgreSQL parallel B-tree scans allows an object creator to read attacker-chosen server-memory addresses, via a function incorrectly marked PARALLEL SAFE or STABLE to make participating workers build different scan-key arrays. Within major versions 17-18, minor versions before PostgreSQL 18.7 and 17.12 are affected. Versions before PostgreSQL 17 are unaffected.

Ein Angreifer kann mehrere Schwachstellen in PostgreSQL ausnutzen, um beliebigen Code auszuführen, Berechtigungen zu erweitern, Sicherheitsmaßnahmen zu umgehen, SQL-Injection durchzuführen, Daten zu manipulieren und offenzulegen oder einen Denial-of-Service-Zustand zu verursachen.