Fixed packages 5
| Release | Package | Fixed in |
|---|---|---|
| Red Hat · RHEL 9.6 EUS rhel_eus:9.6::appstream | libpq | 0:13.23-1.el9_6.1 |
| Red Hat · RHEL 9.6 EUS rhel_eus:9.6::appstream | libpq-debuginfo | 0:13.23-1.el9_6.1 |
| Red Hat · RHEL 9.6 EUS rhel_eus:9.6::appstream | libpq-debugsource | 0:13.23-1.el9_6.1 |
| Red Hat · RHEL 9.6 EUS rhel_eus:9.6::appstream | libpq-devel | 0:13.23-1.el9_6.1 |
| Red Hat · RHEL 9.6 EUS rhel_eus:9.6::appstream | libpq-devel-debuginfo | 0:13.23-1.el9_6.1 |
Vulnerabilities 1
-
High 8.8
PostgreSQL libpq lo_* functions let server superuser overwrite client stack memory
Use of inherently dangerous function PQfn(..., result_is_int=0, ...) in PostgreSQL libpq lo_export(), lo_read(), lo_lseek64(), and lo_tell64() functions allows the server superuser to overwrite a client stack buffer with an arbitrarily-large response. Like ge…
References
-
article
https://access.redhat.com/security/updates/classification/#important
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2477442
-
advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_50779.json
-
report
https://access.redhat.com/security/cve/CVE-2026-6477
-
advisory
https://www.cve.org/CVERecord?id=CVE-2026-6477
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-6477
-
article
https://www.postgresql.org/support/security/CVE-2026-6477/