-------------------------------------------------------------------------
Debian LTS Advisory DLA-4646-1 debian-lts@lists.debian.org
https://www.debian.org/lts/security/ Emmanuel Arias
June 24, 2026 https://wiki.debian.org/LTS
-------------------------------------------------------------------------
Package : postgresql-13
Version : 13.23-0+deb11u4
CVE ID : CVE-2026-6473 CVE-2026-6474 CVE-2026-6475 CVE-2026-6477
CVE-2026-6478 CVE-2026-6479 CVE-2026-6637
Debian Bug :
Brief introduction
CVE-2026-6473
Integer wraparound in multiple PostgreSQL server features allows an
application input provider to cause the server to undersize an allocation
and write out-of-bounds.
CVE-2026-6474
Externally-controlled format string in PostgreSQL timeofday() function
allows an attacker to retrieve portions of server memory, via crafted
timezone zones
CVE-2026-6475
Symlink following in PostgreSQL pg_basebackup plain format and in pg_rewind
allows an origin superuser to overwrite local files, that hijack the
operating system account. It will remain the case that starting the server
after these commands implicitly trusts the origin superuser, due to features
like shared_preload_libraries.
CVE-2026-6477
Use of inherently dangerous function PQfn(..., result_is_int=0, ...) in
PostgreSQL libpq lo_export(), lo_read(), lo_lseek64(), and lo_tell64()
functions allows the server superuser to overwrite a client stack buffer
with an arbitrarily-large response.
CVE-2026-6478
Covert timing channel in comparison of MD5-hashed password in PostgreSQL
authentication allows an attacker to recover user credentials sufficient to
authenticate. This does not affect scram-sha-256 passwords, the default in
all supported releases. However, current databases may have MD5-hashed
passwords originating in upgrades from PostgreSQL 13 or earlier.
CVE-2026-6479
Uncontrolled recursion in PostgreSQL SSL and GSS negotiation allows an
attacker able to connect to a PostgreSQL AF_UNIX socket to achieve sustained
denial of service. If SSL and GSS are both disabled, an attacker can do the
same via access to a PostgreSQL TCP socket
CVE-2026-6637
Stack buffer overflow in PostgreSQL module refint allows an unprivileged
database user to execute arbitrary code as the operating system user running
the database. A distinct attack is possible if the application declares a
user-controlled column as a refint cascade primary key and facilitates
user-controlled updates to that column. In that case, a SQL injection allows
a primary key update value provider to execute arbitrary SQL as the database
user performing the primary key update.
For Debian 11 bullseye, these problems have been fixed in version
13.23-0+deb11u4.
We recommend that you upgrade your postgresql-13 packages.
For the detailed security status of postgresql-13 please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/postgresql-13
Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
Attachment:
signature.asc
Description: PGP signature