-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Tue, 10 Feb 2026 11:26:19 +0100 Source: postgresql-17 Binary: libecpg-compat3 libecpg-compat3-dbgsym libecpg-dev libecpg-dev-dbgsym libecpg6 libecpg6-dbgsym libpgtypes3 libpgtypes3-dbgsym libpq-dev libpq5 libpq5-dbgsym postgresql-17 postgresql-17-dbgsym postgresql-client-17 postgresql-client-17-dbgsym postgresql-plperl-17 postgresql-plperl-17-dbgsym postgresql-plpython3-17 postgresql-plpython3-17-dbgsym postgresql-pltcl-17 postgresql-pltcl-17-dbgsym postgresql-server-dev-17 postgresql-server-dev-17-dbgsym Architecture: s390x Version: 17.8-0+deb13u1 Distribution: trixie-security Urgency: medium Maintainer: s390x Build Daemon (zani) Changed-By: Christoph Berg Description: libecpg-compat3 - older version of run-time library for ECPG programs libecpg-dev - development files for ECPG (Embedded PostgreSQL for C) libecpg6 - run-time library for ECPG programs libpgtypes3 - shared library libpgtypes for PostgreSQL 17 libpq-dev - header files for libpq5 (PostgreSQL library) libpq5 - PostgreSQL C client library postgresql-17 - The World's Most Advanced Open Source Relational Database postgresql-client-17 - front-end programs for PostgreSQL 17 postgresql-plperl-17 - PL/Perl procedural language for PostgreSQL 17 postgresql-plpython3-17 - PL/Python 3 procedural language for PostgreSQL 17 postgresql-pltcl-17 - PL/Tcl procedural language for PostgreSQL 17 postgresql-server-dev-17 - development files for PostgreSQL 17 server-side programming Changes: postgresql-17 (17.8-0+deb13u1) trixie-security; urgency=medium . * New upstream version 17.8. . + Guard against unexpected dimensions of oidvector/int2vector (Tom Lane) . These data types are expected to be 1-dimensional arrays containing no nulls, but there are cast pathways that permit violating those expectations. Add checks to some functions that were depending on those expectations without verifying them, and could misbehave in consequence. . The PostgreSQL Project thanks Altan Birler for reporting this problem. (CVE-2026-2003) . + Harden selectivity estimators against being attached to operators that accept unexpected data types (Tom Lane) . contrib/intarray contained a selectivity estimation function that could be abused for arbitrary code execution, because it did not check that its input was of the expected data type. Third-party extensions should check for similar hazards and add defenses using the technique intarray now uses. Since such extension fixes will take time, we now require superuser privilege to attach a non-built-in selectivity estimator to an operator. . The PostgreSQL Project thanks Daniel Firer, as part of zeroday.cloud, for reporting this problem. (CVE-2026-2004) . + Fix buffer overrun in contrib/pgcrypto's PGP decryption functions (Michael Paquier) . Decrypting a crafted message with an overlength session key caused a buffer overrun, with consequences as bad as arbitrary code execution. . The PostgreSQL Project thanks Team Xint Code, as part of zeroday.cloud, for reporting this problem. (CVE-2026-2005) . + Fix inadequate validation of multibyte character lengths (Thomas Munro, Noah Misch) . Assorted bugs allowed an attacker able to issue crafted SQL to overrun string buffers, with consequences as bad as arbitrary code execution. After these fixes, applications may observe invalid byte sequence for encoding errors when string functions process invalid text that has been stored in the database. . The PostgreSQL Project thanks Paul Gerste and Moritz Sanft, as part of zeroday.cloud, for reporting this problem. (CVE-2026-2006) Checksums-Sha1: 7e1d3a8ebb7412550fef07d9d21b70335fd0b85a 16972 libecpg-compat3-dbgsym_17.8-0+deb13u1_s390x.deb dc181cde71e35eb158536c1e80094fce98472bbf 17784 libecpg-compat3_17.8-0+deb13u1_s390x.deb 1c3d27a0830aa31ec19595382903fe2c71711d49 231304 libecpg-dev-dbgsym_17.8-0+deb13u1_s390x.deb 33cfe4c2d8af4c7411fcad6fa2a8e35ed74109ae 300304 libecpg-dev_17.8-0+deb13u1_s390x.deb 2c4ccc73ab1c9df5803e29d92d6852d0e4428f1b 115652 libecpg6-dbgsym_17.8-0+deb13u1_s390x.deb cb93e65895be3776c4afea854952ea61832f5e84 63100 libecpg6_17.8-0+deb13u1_s390x.deb 3e3f2a1d6790721b59d7b25b31b85ccbe44bace4 92616 libpgtypes3-dbgsym_17.8-0+deb13u1_s390x.deb 745722a9a81234b79c0b948f6eb4126c7362e8f8 48192 libpgtypes3_17.8-0+deb13u1_s390x.deb a0cc0248b612488e98f471e5d9a2a83214a31d3c 148120 libpq-dev_17.8-0+deb13u1_s390x.deb c287dd7e5396c4b744a6b12f46df3ca95f70b928 298436 libpq5-dbgsym_17.8-0+deb13u1_s390x.deb 077a866cf658a6d81da5d3b4ac1e58dbfdfa098e 222028 libpq5_17.8-0+deb13u1_s390x.deb a46ad6a9fac5317056dda043b1594d0add94df4b 19351564 postgresql-17-dbgsym_17.8-0+deb13u1_s390x.deb 4f57df73d1893a89c8b29a68d34a71be1e3d3007 17037 postgresql-17_17.8-0+deb13u1_s390x-buildd.buildinfo a9a9d975d552de591f3cf2dfc895dea9a75721f5 17226460 postgresql-17_17.8-0+deb13u1_s390x.deb 9826c0ec66baa68106b470bdb7336fa9a60d438d 2813880 postgresql-client-17-dbgsym_17.8-0+deb13u1_s390x.deb 353e3905f3b51512d42562eda6a9af15e36491dc 2008604 postgresql-client-17_17.8-0+deb13u1_s390x.deb 4d34ad09b9c3564c3cb89706c9cc55640ae52f0d 197660 postgresql-plperl-17-dbgsym_17.8-0+deb13u1_s390x.deb 66156181adb1fc6f5efd59f575e2a1ada6839e93 85804 postgresql-plperl-17_17.8-0+deb13u1_s390x.deb 97241fe1f2eef79bbf77f31b9ab7360428c4059e 196548 postgresql-plpython3-17-dbgsym_17.8-0+deb13u1_s390x.deb a80079723faa1749e1fd3b3eaf32a4828e199792 109296 postgresql-plpython3-17_17.8-0+deb13u1_s390x.deb 010724f40acfc74513d55284816058bfd23cf758 84060 postgresql-pltcl-17-dbgsym_17.8-0+deb13u1_s390x.deb c1146dd9fbce08541ad1677d06819bb5e20a114d 42976 postgresql-pltcl-17_17.8-0+deb13u1_s390x.deb d9c430373c6fe1b0281c038f7fae3342e9c2079b 55536 postgresql-server-dev-17-dbgsym_17.8-0+deb13u1_s390x.deb 60e97b9129ad21fdbea0b13742bf243e34e37200 1322540 postgresql-server-dev-17_17.8-0+deb13u1_s390x.deb Checksums-Sha256: 0ec305bc9b1243804c6ad2f67bf4b2925656220abecb8a494b74cc383a72fbed 16972 libecpg-compat3-dbgsym_17.8-0+deb13u1_s390x.deb b56b1779a1aa9e1967c947fb1c624899db256a62e1a77d6c7a9852edd0e91ce9 17784 libecpg-compat3_17.8-0+deb13u1_s390x.deb 4a6d9c2b46c12aa699bc076415c4e0eb6880a1b94402a8326cc6db46da311a2b 231304 libecpg-dev-dbgsym_17.8-0+deb13u1_s390x.deb 316ae63d30dbb9baf0dfc979d9cb1b20151401abf357061e0c10bc2ad9a5f09a 300304 libecpg-dev_17.8-0+deb13u1_s390x.deb cdc0563aecb8b059802b0a4c372cd6fea77b3f5d065ed76f3d7a59d8280b47d6 115652 libecpg6-dbgsym_17.8-0+deb13u1_s390x.deb be932843301a430c26fc6947513eb0a8b733148f40296e7ba5cab845b53ad967 63100 libecpg6_17.8-0+deb13u1_s390x.deb 60ac35e966c5be5b4e148df121f90ff249bce99957b675d0bc6b3180e509ae0b 92616 libpgtypes3-dbgsym_17.8-0+deb13u1_s390x.deb 8391a862a55463e91e53201886f18806a57ac44884d5682a4c790656713e4f62 48192 libpgtypes3_17.8-0+deb13u1_s390x.deb d84f75764a555f7e36a37512e17106790c90c4414a3c8ff17f7912cd2c56f64a 148120 libpq-dev_17.8-0+deb13u1_s390x.deb cd102b5c89b20d1258cbbcf257506ee3c2f3a7c45648e68bc444cbc53e7381b9 298436 libpq5-dbgsym_17.8-0+deb13u1_s390x.deb 0e4dfefd9b1eaa56d797c2e171a1fb93e7e2b1f4a1a7af1d8384c52700d80241 222028 libpq5_17.8-0+deb13u1_s390x.deb 35e4ab17faa123d7e0d69e44aa6bcc4f807c8376d2606eb2ddcdb4b13878802c 19351564 postgresql-17-dbgsym_17.8-0+deb13u1_s390x.deb add310b6448697d8b7c004f48e855fd89d9c9c4c683e8582c35a0905de3e6290 17037 postgresql-17_17.8-0+deb13u1_s390x-buildd.buildinfo 3e65059f90e94d499fedc2d0291a36e30527f91abfcb2d3d543a6c20fea49100 17226460 postgresql-17_17.8-0+deb13u1_s390x.deb f7722bacaf722398c75448698890f85a8ac448ca20ba304447e749ce766af9c1 2813880 postgresql-client-17-dbgsym_17.8-0+deb13u1_s390x.deb ee6b39ad26af5f399d46d11c61abed3816cd490dfba42de32912e911c1208283 2008604 postgresql-client-17_17.8-0+deb13u1_s390x.deb 4d08104cd3c62238662c79eb2a70d7a8e4fd5780c09888bb8bb4cb1be8e9ab04 197660 postgresql-plperl-17-dbgsym_17.8-0+deb13u1_s390x.deb 56f10d000eae5802a1038d57b6924e0476af9e81aa16c0df39c15f208dac3be0 85804 postgresql-plperl-17_17.8-0+deb13u1_s390x.deb 92c8c2f8f6849a5caecae0e96e42c808100b672af23335396a7cd6e9c9e15ac7 196548 postgresql-plpython3-17-dbgsym_17.8-0+deb13u1_s390x.deb 8ff8de34aa29a9368ece1b633c2f5a455e425ee5649dcd7d704c4307db7d7c85 109296 postgresql-plpython3-17_17.8-0+deb13u1_s390x.deb a977452428f477b07d88b3e2c675638b94ab3e4dea900126b21b1c69e01e4578 84060 postgresql-pltcl-17-dbgsym_17.8-0+deb13u1_s390x.deb 718350ed241002098da040a81a5640d1beb1ddac5217cab7698736caf7fcea2f 42976 postgresql-pltcl-17_17.8-0+deb13u1_s390x.deb 0fda95be97a6c4b952bc38aecf92b66a98d5b6aab003edd5b01c5d9385f7098f 55536 postgresql-server-dev-17-dbgsym_17.8-0+deb13u1_s390x.deb e315c66c0eb6914cf8c0d6391da581be77f469b1d85c46e185e89c1cce3fce61 1322540 postgresql-server-dev-17_17.8-0+deb13u1_s390x.deb Files: 7693dc0c55b9875d19cf76fb7dec3d93 16972 debug optional libecpg-compat3-dbgsym_17.8-0+deb13u1_s390x.deb b67aea19cd8629fd4f5af2ecebecc7ae 17784 libs optional libecpg-compat3_17.8-0+deb13u1_s390x.deb 2f910884eca7d2f5a64e7f75ae2f9268 231304 debug optional libecpg-dev-dbgsym_17.8-0+deb13u1_s390x.deb 8e63128f9f3f5592700dd31f07c1d7b6 300304 libdevel optional libecpg-dev_17.8-0+deb13u1_s390x.deb df4015b89f02ca48d509e21d60aa6426 115652 debug optional libecpg6-dbgsym_17.8-0+deb13u1_s390x.deb ca7956cdd47f58e7364734b546a91446 63100 libs optional libecpg6_17.8-0+deb13u1_s390x.deb 8df1769434344fc5684cc2e35b63d4a3 92616 debug optional libpgtypes3-dbgsym_17.8-0+deb13u1_s390x.deb b952eac40d8ea4b1d2e48711ead70068 48192 libs optional libpgtypes3_17.8-0+deb13u1_s390x.deb a1f81ceecf8e1c31465067b772444c0f 148120 libdevel optional libpq-dev_17.8-0+deb13u1_s390x.deb 12c1e919e5d3dc20dbed550cfb988a9e 298436 debug optional libpq5-dbgsym_17.8-0+deb13u1_s390x.deb 748227f729ba0964ff8ef98f97474898 222028 libs optional libpq5_17.8-0+deb13u1_s390x.deb b7b6c42eaa094699d7cc0fba650f6920 19351564 debug optional postgresql-17-dbgsym_17.8-0+deb13u1_s390x.deb 665cb067aa51f068a9c88403330c2617 17037 database optional postgresql-17_17.8-0+deb13u1_s390x-buildd.buildinfo aa52998e0a34b79ca36af863447b73a8 17226460 database optional postgresql-17_17.8-0+deb13u1_s390x.deb 231e3465a7c9a427133a3f66d53c22ba 2813880 debug optional postgresql-client-17-dbgsym_17.8-0+deb13u1_s390x.deb 733b88e05c035f3d1a1c8553349e3a69 2008604 database optional postgresql-client-17_17.8-0+deb13u1_s390x.deb d1b4a6b05f0533a15d0820e8f186637a 197660 debug optional postgresql-plperl-17-dbgsym_17.8-0+deb13u1_s390x.deb daf5124f99dc3e32a1aae748d55cdd20 85804 database optional postgresql-plperl-17_17.8-0+deb13u1_s390x.deb 1cecdc681fd51edd862bcf4d02d13bc3 196548 debug optional postgresql-plpython3-17-dbgsym_17.8-0+deb13u1_s390x.deb ae3e4293635f2ece58791833e6ff5010 109296 database optional postgresql-plpython3-17_17.8-0+deb13u1_s390x.deb eac01187a1f7a5dacac90264f9ce6eb1 84060 debug optional postgresql-pltcl-17-dbgsym_17.8-0+deb13u1_s390x.deb 8c3bbccb11e3768fd944e2811746383a 42976 database optional postgresql-pltcl-17_17.8-0+deb13u1_s390x.deb 4ccd61faf56718e66c78ea57f4f559d0 55536 debug optional postgresql-server-dev-17-dbgsym_17.8-0+deb13u1_s390x.deb fb218722a9224e3a58f33cfbdefaaec2 1322540 libdevel optional postgresql-server-dev-17_17.8-0+deb13u1_s390x.deb -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEgh4msZ+e2PZfd5KckaCrxAR3BY0FAmmLaZEACgkQkaCrxAR3 BY0Fiw/7B2paK5nSthTs7PEbYSzNs2qpXbghJ75qo/5YxkbOeJJNQ36LYqypTxy3 1KTJgU50rRhiEdHn9K3E6RR3P9ffBlFFZjEWxJLwzr4m6FeH98TqWC1OcStBOk2q GBlb53Pwxq3t/HU6Sg/KMYyOFChKu23sIcPxrXcsiZkVO5270JBQykqQ92FXDT5m QofXGTTjZayQkT6pRjAsm9F27S/kAVK7bGrWxesbo6WRxi2N6BhVzF50E/rfXRwe Rr8FdKSZs+ZVgaDGlwUA9Jo7p3F8taKKco5VuQitY83dSh40cB4uvVnh2OCnsA4w sKp8h+ABBP/kD4zVEgEEMYQTbe4BKylcy5aUEE12eyh+wIsGozk9udR8pv29Wk4E vGxtUQkNVAkiu/RNoEyx1ywt9oK0RvNyFV+eX5KTm8r23AGif/W2G+y7DdZoMD6J PBACg5fgfdY876GRAOyncqIqPpDeMXWFoc6Hb6kEmr14AAmGMJmMdYD9OHNduNMo chpMBq0jk+X6HgMPCBpJVc5GzWQ+mktXbNlCKptQyusj7qOOyo92lazeUayIwndw ecMflVF6bIRdcj0XGXQ/tKOvA+peKqehPoy5Iw75a0c5gSYHzzM/iv8D+N8VqqhD bpG+RSjx+fgHcecXEz98zTFLdEaL8ASOCriFA+T1pD3b2m8E6MI= =x+Qt -----END PGP SIGNATURE-----