PostgreSQL -- Multiple vulnerabilities

2025-11-14 · CVE-2025-12818, CVE-2025-12817 · VuXML entry

https://www.postgresql.org/support/security/CVE-2025-12818/ reports: Integer wraparound in multiple PostgreSQL libpq client library functions allows an application input provider or network peer to cause libpq to undersize an allocation and write out-of-bounds by hundreds of megabytes. This results in a segmentation fault for the application using libpq. Missing authorization in PostgreSQL CREATE STATISTICS command …

Affected versions

• postgresql13-client < 13.23
• postgresql14-client < 14.20
• postgresql15-client < 15.15
• postgresql16-client < 16.11
• postgresql17-client < 17.7
• postgresql18-client < 18.1

By system

6 still vulnerable, 5 fixed. Where VuXML applies (FreeBSD, DragonFly, FreeBSD's derivatives) a port is vulnerable while its version is in a range; pkgsrc says itself whether it lists a CVE of this advisory; OpenBSD and MidnightBSD keep no list this site reads, so their row is only an estimate: FreeBSD's ranges applied to upstream's version.