BSD PortsPostgreSQL -- Multiple vulnerabilities
· CVE-2026-2003, CVE-2026-2004, CVE-2026-2005, CVE-2026-2006, CVE-2026-2007 · VuXML entry
The PostgreSQL project reports: Improper validation of type oidvector in PostgreSQL allows a database user to disclose a few bytes of server memory. We have not ruled out viability of attacks that arrange for presence of confidential information in disclosed bytes, but they seem unlikely. Missing validation of type of input in PostgreSQL intarray extension selectivity estimator function allows an object creator to …
Affected versions
- postgresql14-server < 14.21
- postgresql15-server < 15.16
- postgresql16-server < 16.12
- postgresql17-server < 17.8
- postgresql18-server < 18.2
- postgresql14-server < 14.21
By system
3 still vulnerable, 5 fixed. Where VuXML applies (FreeBSD, DragonFly, FreeBSD's derivatives) a port is vulnerable while its version is in a range; pkgsrc says itself whether it lists a CVE of this advisory; OpenBSD and MidnightBSD keep no list this site reads, so their row is only an estimate: FreeBSD's ranges applied to upstream's version.
| System | Port | Version | State | Fixed |
|---|---|---|---|---|
| FreeBSD | databases/postgresql14-server | 14.24 | fixed | (185 days after) |
| NetBSD | databases/postgresql14-server | 14.24 | not listed | |
| MidnightBSD | databases/postgresql14-server | 14.24 | out of range, by version | |
| DragonFly | databases/postgresql14-server | 14.18 | vulnerable since 2026-02-12 | |
| FreeBSD | databases/postgresql15-server | 15.19 | fixed | (185 days after) |
| NetBSD | databases/postgresql15-server | 15.19 | not listed | |
| MidnightBSD | databases/postgresql15-server | 15.19 | out of range, by version | |
| DragonFly | databases/postgresql15-server | 15.13 | vulnerable since 2026-02-12 | |
| FreeBSD | databases/postgresql16-server | 16.15 | fixed | (185 days after) |
| NetBSD | databases/postgresql16-server | 16.15 | not listed | |
| MidnightBSD | databases/postgresql16-server | 16.15 | out of range, by version | |
| DragonFly | databases/postgresql16-server | 16.9 | vulnerable since 2026-02-12 | |
| FreeBSD | databases/postgresql17-server | 17.11 | fixed | (185 days after) |
| NetBSD | databases/postgresql17-server | 17.11 | not listed | |
| MidnightBSD | databases/postgresql17-server | 17.11 | out of range, by version | |
| FreeBSD | databases/postgresql18-server | 18.6 | fixed | (185 days after) |
| NetBSD | databases/postgresql18-server | 18.6 | not listed | |
| MidnightBSD | databases/postgresql18-server | 18.6 | out of range, by version |