BSD PortsPostgreSQL -- PostgreSQL GB18030 encoding validation can read one byte past end of allocation for text that fails validation
PostgreSQL project reports: A buffer over-read in PostgreSQL GB18030 encoding validation allows a database input provider to achieve temporary denial of service on platforms where a 1-byte over-read can elicit process termination. This affects the database server and also libpq. Versions before PostgreSQL 17.5, 16.9, 15.13, 14.18, and 13.21 are affected.
Affected versions
- postgresql17-client < 17.5
- postgresql16-client < 16.9
- postgresql15-client < 15.13
- postgresql14-client < 14.18
- postgresql13-client < 13.21
- postgresql17-server < 17.5
- postgresql16-server < 16.9
- postgresql15-server < 15.13
- postgresql14-server < 14.18
- postgresql13-server < 13.21
By system
0 still vulnerable, 17 fixed. Where VuXML applies (FreeBSD, DragonFly, FreeBSD's derivatives) a port is vulnerable while its version is in a range; pkgsrc says itself whether it lists a CVE of this advisory; OpenBSD and MidnightBSD keep no list this site reads, so their row is only an estimate: FreeBSD's ranges applied to upstream's version.