Most recent entries from all

ALSA-2025:14826 — Important: postgresql16 security update

Affected: AlmaLinux:10: postgresql-test-rpm-macros

PostgreSQL is an advanced Object-Relational database management system (DBMS). The base postgresql package contains the client programs that you'll need to access a PostgreSQL DBMS server, as well as HTML documentation for the whole system. These client programs can be located on the same machine as the PostgreSQL server, or on a remote machine that accesses a PostgreSQL server over a network connection. The PostgreSQL server can be found in the postgresql-server sub-package.

Security Fix(es):

* postgresql: PostgreSQL executes arbitrary code in restore operation (CVE-2025-8715) * postgresql: PostgreSQL code execution in restore operation (CVE-2025-8714)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2025-09830

BELL-CVE-2025-8715

Affected: Alpaquita:23: postgresql15, Alpaquita:25: postgresql17, Alpaquita:stream: postgresql17

BIT-postgresql-2025-8715 — PostgreSQL pg_dump newline in object name executes arbitrary code in psql client and in restore target server

Affected: Bitnami: postgresql

Improper neutralization of newlines in pg_dump in PostgreSQL allows a user of the origin server to inject arbitrary code for restore-time execution as the client operating system account running psql to restore the dump, via psql meta-commands inside a purpose-crafted object name. The same attacks can achieve SQL injection as a superuser of the restore target server. pg_dumpall, pg_restore, and pg_upgrade are also affected. Versions before PostgreSQL 17.6, 16.10, 15.14, 14.19, and 13.22 are affected. Versions before 11.20 are unaffected. CVE-2012-0868 had fixed this class of problem, but version 11.20 reintroduced it.

certfr-2025-avi-0702 — De multiples vulnérabilités ont été découvertes dans PostgreSQL. Elles permettent à un attaquant de provoquer une exécu…

certfr-2025-avi-0702

Withdrawn: CLEANSTART-2026-AI42483 — PostgreSQL optimizer statistics allow a user to read sampled data within a view that the user cannot access

Withdrawn by the publisher.

Affected: CleanStart: postgresql

Multiple security vulnerabilities affect the postgresql package. PostgreSQL optimizer statistics allow a user to read sampled data within a view that the user cannot access. See references for individual vulnerability details.

EUVD-2026-272125

fkie_cve-2025-8715

GHSA-xh8r-9824-53cf

jvndb-2026-010299

Multiple vulnerabilities exist in Hitachi Ops Center Common Services. CVE-2024-4028, CVE-2025-8714, CVE-2025-8715, CVE-2025-10044, CVE-2025-12817, CVE-2025-12818, CVE-2025-41248, CVE-2025-41249 (*)CVE-2026-1190 is removed from the list.

msrc_CVE-2025-8715 — PostgreSQL pg_dump newline in object name executes arbitrary code in psql client and in restore target server

msrc_CVE-2025-8715

OESA-2025-2104 — postgresql-13 security update

Affected: openEuler:20.03-LTS-SP4: postgresql-13

PostgreSQL is an advanced Object-Relational database management system (DBMS). The base postgresql package contains the client programs that you&apos;ll need to access a PostgreSQL DBMS server, as well as HTML documentation for the whole system. These client programs can be located on the same machine as the PostgreSQL server, or on a remote machine that accesses a PostgreSQL server over a network connection. The PostgreSQL server can be found in the postgresql-server sub-package. Security Fix(es):

PostgreSQL optimizer statistics allow a user to read sampled data within a view that the user cannot access. Separately, statistics allow a user to read sampled data that a row security policy intended to hide. PostgreSQL maintains statistics for tables by sampling data available in columns; this data is consulted during the query planning process. Prior to this release, a user could craft a leaky operator that bypassed view access control lists (ACLs) and bypassed row security policies in partitioning or table inheritance hierarchies. Reachable statistics data notably included histograms and most-common-values lists. CVE-2017-7484 and CVE-2019-10130 intended to close this class of vulnerability, but this gap remained. Versions before PostgreSQL 17.6, 16.10, 15.14, 14.19, and 13.22 are affected.(CVE-2025-8713)

Untrusted data inclusion in pg_dump in PostgreSQL allows a malicious superuser of the origin server to inject arbitrary code for restore-time execution as t…

openSUSE-SU-2025:15450-1 — postgresql13-13.22-1.1 on GA media

postgresql13-13.22-1.1 on GA media

RHSA-2025:14869 — Red Hat Security Advisory: postgresql security update

postgresql: PostgreSQL optimizer statistics can expose sampled data within a view, partition, or child table postgresql: PostgreSQL code execution in restore operation postgresql: PostgreSQL executes arbitrary code in restore operation

SUSE-SU-2025:02842-1 — Security update for postgresql13

Security update for postgresql13

UBUNTU-CVE-2025-8715

Affected: Ubuntu:Pro:14.04:LTS: postgresql-9.3, Ubuntu:Pro:16.04:LTS: postgresql-9.5, Ubuntu:Pro:18.04:LTS: postgresql-10, Ubuntu:20.04:LTS: postgresql-12, Ubuntu:22.04:LTS: postgresql-14, Ubuntu:24.04:LTS: postgresql-16, Ubuntu:25.10: postgresql-17

WID-SEC-W-2025-1842 — PostgreSQL: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in PostgreSQL ausnutzen, um Informationen offenzulegen, und um beliebigen Programmcode auszuführen.