Most recent entries from all

ALSA-2026:65899 — Important: postgresql16-postgis security update

Affected: AlmaLinux:10: postgis, AlmaLinux:10: postgis-client, AlmaLinux:10: postgis-docs, AlmaLinux:10: postgis-upgrade, AlmaLinux:10: postgis-utils

PostGIS adds support for geographic objects to the PostgreSQL object-relational database. In effect, PostGIS "spatially enables" the PostgreSQL server, allowing it to be used as a backend spatial database for geographic information systems (GIS), much like ESRI's SDE or Oracle's Spatial extension. PostGIS follows the OpenGIS "Simple Features Specification for SQL" and has been certified as compliant with the "Types and Functions" profile.

Security Fix(es):

* postgis: PostGIS: Memory Disclosure and Denial of Service via Malformed FlatGeobuf Buffer (CVE-2026-73515)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

BIT-postgis-2026-73515 — PostGIS < 3.7.0 Out-of-Bounds Read via FlatGeobuf Buffer

Affected: Bitnami: postgis

PostGIS before 3.7.0 contains an out-of-bounds read vulnerability that allows attackers to cause memory disclosure or a server crash by supplying a malformed FlatGeobuf buffer. The FlatGeobuf property metadata decoder verifies that a string length field is present but fails to verify that the subsequent string body is contained within the supplied buffer before materializing it into a SQL-visible value, enabling memory disclosure or denial of service.

EUVD-2026-352773

fkie_cve-2026-73515

PostGIS before 3.7.0beta2 contains an out-of-bounds read vulnerability that allows attackers to cause memory disclosure or a server crash by supplying a malformed FlatGeobuf buffer. The FlatGeobuf property metadata decoder verifies that a string length field is present but fails to verify that the subsequent string body is contained within the supplied buffer before materializing it into a SQL-visible value, enabling memory disclosure or denial of service.

GHSA-qv7r-wgc7-6mc6

RHSA-2026:65899 — Red Hat Security Advisory: postgresql16-postgis security update

postgis: PostGIS: Memory Disclosure and Denial of Service via Malformed FlatGeobuf Buffer

RLSA-2026:65899 — Important: postgresql16-postgis security update

Affected: Rocky Linux:10: postgresql16-postgis

Security Fix(es):

* postgis: PostGIS: Memory Disclosure and Denial of Service via Malformed FlatGeobuf Buffer (CVE-2026-73515)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

UBUNTU-CVE-2026-73515

Affected: Ubuntu:16.04:LTS: postgis, Ubuntu:18.04:LTS: postgis, Ubuntu:20.04:LTS: postgis, Ubuntu:22.04:LTS: postgis, Ubuntu:24.04:LTS: postgis, Ubuntu:26.04:LTS: postgis

WID-SEC-W-2026-3306 — Red Hat Enterprise Linux (postgis, virtuoso-opensource): Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in Red Hat Enterprise Linux ausnutzen, um einen Denial of Service Angriff durchzuführen oder vertrauliche Informationen offenzulegen.