Description
PostGIS 2.x before 2.3.3, as used with PostgreSQL, allows remote attackers to cause a denial of service via crafted ST_AsX3D function input, as demonstrated by an abnormal server termination for "SELECT ST_AsX3D('LINESTRING EMPTY');" because empty geometries are mishandled.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | postgis | 2.3.3+dfsg-1 | — |
| Debian 13 | postgis | 2.3.3+dfsg-1 | — |
| Debian 12 | postgis | 2.3.3+dfsg-1 | — |
| Debian 9 | postgis | 2.3.1+dfsg-2+deb9u1 | DLA-2857-1 |
| Debian 8 | postgis | 2.1.4+dfsg-3+deb8u1 | DLA-1653-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | postgis | 2.2.1+dfsg-2ubuntu0.1 | — |
| Ubuntu 14.04 LTS | postgis | 2.1.2+dfsg-2ubuntu0.2 | — |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE Package Hub 15 SP4 | librttopo | 1.1.0-bp154.2.3.1 | openSUSE-SU-2022:10042-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 15.4 | librttopo | 1.1.0-bp154.2.3.1 | openSUSE-SU-2022:10042-1 |
Advisories 3
- DLA-2857-1 postgis - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-1653-1 postgis - security update Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2022:10042-1 Security update for librttopo SUSE / openSUSE Security Updates · Feb 4, 2026
References
- https://trac.osgeo.org/postgis/changeset/15444
- https://trac.osgeo.org/postgis/changeset/15445
- [debian-lts-announce] 20190131 [SECURITY] [DLA 1653-1] postgis security update mailing-list
- https://trac.osgeo.org/postgis/ticket/3704
- [debian-lts-announce] 20211227 [SECURITY] [DLA 2857-1] postgis security update mailing-list