-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Tue, 10 Feb 2026 11:26:19 +0100 Source: postgresql-17 Binary: libecpg-compat3 libecpg-compat3-dbgsym libecpg-dev libecpg-dev-dbgsym libecpg6 libecpg6-dbgsym libpgtypes3 libpgtypes3-dbgsym libpq-dev libpq5 libpq5-dbgsym postgresql-17 postgresql-17-dbgsym postgresql-client-17 postgresql-client-17-dbgsym postgresql-plperl-17 postgresql-plperl-17-dbgsym postgresql-plpython3-17 postgresql-plpython3-17-dbgsym postgresql-pltcl-17 postgresql-pltcl-17-dbgsym postgresql-server-dev-17 postgresql-server-dev-17-dbgsym Architecture: armhf Version: 17.8-0+deb13u1 Distribution: trixie-security Urgency: medium Maintainer: arm Build Daemon (arm-conova-04) Changed-By: Christoph Berg Description: libecpg-compat3 - older version of run-time library for ECPG programs libecpg-dev - development files for ECPG (Embedded PostgreSQL for C) libecpg6 - run-time library for ECPG programs libpgtypes3 - shared library libpgtypes for PostgreSQL 17 libpq-dev - header files for libpq5 (PostgreSQL library) libpq5 - PostgreSQL C client library postgresql-17 - The World's Most Advanced Open Source Relational Database postgresql-client-17 - front-end programs for PostgreSQL 17 postgresql-plperl-17 - PL/Perl procedural language for PostgreSQL 17 postgresql-plpython3-17 - PL/Python 3 procedural language for PostgreSQL 17 postgresql-pltcl-17 - PL/Tcl procedural language for PostgreSQL 17 postgresql-server-dev-17 - development files for PostgreSQL 17 server-side programming Changes: postgresql-17 (17.8-0+deb13u1) trixie-security; urgency=medium . * New upstream version 17.8. . + Guard against unexpected dimensions of oidvector/int2vector (Tom Lane) . These data types are expected to be 1-dimensional arrays containing no nulls, but there are cast pathways that permit violating those expectations. Add checks to some functions that were depending on those expectations without verifying them, and could misbehave in consequence. . The PostgreSQL Project thanks Altan Birler for reporting this problem. (CVE-2026-2003) . + Harden selectivity estimators against being attached to operators that accept unexpected data types (Tom Lane) . contrib/intarray contained a selectivity estimation function that could be abused for arbitrary code execution, because it did not check that its input was of the expected data type. Third-party extensions should check for similar hazards and add defenses using the technique intarray now uses. Since such extension fixes will take time, we now require superuser privilege to attach a non-built-in selectivity estimator to an operator. . The PostgreSQL Project thanks Daniel Firer, as part of zeroday.cloud, for reporting this problem. (CVE-2026-2004) . + Fix buffer overrun in contrib/pgcrypto's PGP decryption functions (Michael Paquier) . Decrypting a crafted message with an overlength session key caused a buffer overrun, with consequences as bad as arbitrary code execution. . The PostgreSQL Project thanks Team Xint Code, as part of zeroday.cloud, for reporting this problem. (CVE-2026-2005) . + Fix inadequate validation of multibyte character lengths (Thomas Munro, Noah Misch) . Assorted bugs allowed an attacker able to issue crafted SQL to overrun string buffers, with consequences as bad as arbitrary code execution. After these fixes, applications may observe invalid byte sequence for encoding errors when string functions process invalid text that has been stored in the database. . The PostgreSQL Project thanks Paul Gerste and Moritz Sanft, as part of zeroday.cloud, for reporting this problem. (CVE-2026-2006) Checksums-Sha1: 28429c710b4b0afe2347812602958d8ef8a4af30 16908 libecpg-compat3-dbgsym_17.8-0+deb13u1_armhf.deb 302f15deed2ce407a59d60d68dbf134d5ee9b89c 16552 libecpg-compat3_17.8-0+deb13u1_armhf.deb 87ae87e5979e6f6cfe58e6555cfe8e5ba2f53be9 247868 libecpg-dev-dbgsym_17.8-0+deb13u1_armhf.deb ffeb39a35c4d01641e9d5e9d2c8415e5c93e3490 282688 libecpg-dev_17.8-0+deb13u1_armhf.deb 6d4cda1ff7fd849c81550fb8bdd5041dd39c0bfc 113868 libecpg6-dbgsym_17.8-0+deb13u1_armhf.deb d4b7d58fe4e0b42f72a1c81c1b5b0aea53f6cc0d 55044 libecpg6_17.8-0+deb13u1_armhf.deb 53f73d8bb04c4b32d0dc55d1b4e197eec36917fd 91364 libpgtypes3-dbgsym_17.8-0+deb13u1_armhf.deb d4405577bb3f78b76ae84be269826258e967c12b 41620 libpgtypes3_17.8-0+deb13u1_armhf.deb 4616006df18f703e036f18116626c64d7c22ed34 139628 libpq-dev_17.8-0+deb13u1_armhf.deb 8f3dadc88b393e1f4d28721974b6ade903f40b84 297188 libpq5-dbgsym_17.8-0+deb13u1_armhf.deb 71fb70c6a9627a6053deaad1bfd3147f588dc340 210520 libpq5_17.8-0+deb13u1_armhf.deb c9f0ac87e9d8fa5469c1676016d730b966c0fa57 18866364 postgresql-17-dbgsym_17.8-0+deb13u1_armhf.deb 8b0ac0d9da9a89c666065c1db4d5dbc88eb432f8 17041 postgresql-17_17.8-0+deb13u1_armhf-buildd.buildinfo 4122d520582c0c5c6fca1027dd1f4213573fd190 15874100 postgresql-17_17.8-0+deb13u1_armhf.deb 3263873635094f3df6ea99a47b1ed141b981082e 2786348 postgresql-client-17-dbgsym_17.8-0+deb13u1_armhf.deb 8cf8f38b4638b8cca1b10feef5f96a900e1f2101 1940152 postgresql-client-17_17.8-0+deb13u1_armhf.deb 73a8d9284d04edd363d9d8d658f9583a15e17f9f 196896 postgresql-plperl-17-dbgsym_17.8-0+deb13u1_armhf.deb 9d3bf43f3092791280d22424cf9e6b4fd04cfef3 82308 postgresql-plperl-17_17.8-0+deb13u1_armhf.deb 1d168fd109bfa8d2f0199466bb61e1c05d31cf64 198312 postgresql-plpython3-17-dbgsym_17.8-0+deb13u1_armhf.deb 32e73087e6582985b2b24fcef27bc975e691e712 104572 postgresql-plpython3-17_17.8-0+deb13u1_armhf.deb 8191232113cb33c30c1b98668d6de837588afa97 82920 postgresql-pltcl-17-dbgsym_17.8-0+deb13u1_armhf.deb 3763d8d4a811b56ad1bcaa21702781d9cd773286 40924 postgresql-pltcl-17_17.8-0+deb13u1_armhf.deb 3eacc9f498620469a6303c069523da5d1a1ddff7 56248 postgresql-server-dev-17-dbgsym_17.8-0+deb13u1_armhf.deb 2369720cfc9bf72b6eaaacbf288c6db6139b0ce8 1298928 postgresql-server-dev-17_17.8-0+deb13u1_armhf.deb Checksums-Sha256: fa2c164cce39839f28cc1bf23aa3c365420a87519a27bc12014f48511290bb17 16908 libecpg-compat3-dbgsym_17.8-0+deb13u1_armhf.deb 7e1f787b6568fcf26df13cbac9329ba1ce7e80e83b4696f1b37cbcea6d6f6136 16552 libecpg-compat3_17.8-0+deb13u1_armhf.deb e892157caa90f88de1d6b770c6e31dd02beb261720c12b4082f5db0bf35ecf6b 247868 libecpg-dev-dbgsym_17.8-0+deb13u1_armhf.deb ae454dc7d85ea72abcba5e459785060d9d02cf4ef6caf244126040abb6c19454 282688 libecpg-dev_17.8-0+deb13u1_armhf.deb 9aceebefb056ba051ce657e326a8e0534b6dc01b8889444e725cef29f0fa667b 113868 libecpg6-dbgsym_17.8-0+deb13u1_armhf.deb 2af541d01b458ff5de1a43ba522a590814264ab60941694ffed9928cc2498543 55044 libecpg6_17.8-0+deb13u1_armhf.deb 874bbfed96e7f956938073e1b79e555956ca51bb5255e1aac69663bb9b9e11a5 91364 libpgtypes3-dbgsym_17.8-0+deb13u1_armhf.deb 7675db907fba220df64b240086d3605a9a3214bd49d062bf3d16e9bf2eb7cdac 41620 libpgtypes3_17.8-0+deb13u1_armhf.deb 9c2784a0f4490aad6cf7f40663ab46b521e90877d0378948cd6680b58089e5a3 139628 libpq-dev_17.8-0+deb13u1_armhf.deb 3406ced2e292a57b959b9f1155a0220c04dd0ba948635fb7d8f7642842cc68eb 297188 libpq5-dbgsym_17.8-0+deb13u1_armhf.deb 7ea310f56ecaedd2b6afe378985a1f656b02389f2ad2b9755a5a9edada395394 210520 libpq5_17.8-0+deb13u1_armhf.deb cb5701bfa2b9e8b315f839cfacc4432154277b4aa0917541c11d571d65fb35c7 18866364 postgresql-17-dbgsym_17.8-0+deb13u1_armhf.deb f0cb3136507419634d14021a2217571e05c35a9e13e3653d1a8e113419333894 17041 postgresql-17_17.8-0+deb13u1_armhf-buildd.buildinfo b2e760750a20eff2967b553227d10e2d4e07ddf11d4066a539d423f8906dcadd 15874100 postgresql-17_17.8-0+deb13u1_armhf.deb 5d272bfcc6e8928320d12783c86769fa4688945322103f4771765875f82589a2 2786348 postgresql-client-17-dbgsym_17.8-0+deb13u1_armhf.deb 257bcfc5ab01d443dc5845525c6d73c3c6ee2f4e2e579da2545de306b484594c 1940152 postgresql-client-17_17.8-0+deb13u1_armhf.deb ad0a751b251f9520198706414e1f2f954050e2a723179ac4558282ef2e260729 196896 postgresql-plperl-17-dbgsym_17.8-0+deb13u1_armhf.deb 45f26c8ca0025342bccc7e2fca97af51e20454469e53941e3eb56fec0f57cb11 82308 postgresql-plperl-17_17.8-0+deb13u1_armhf.deb 673e35cb3269b40b2f5c896c7e52cc7d549cec4ad0db976a78ad3eea0d7ee8e8 198312 postgresql-plpython3-17-dbgsym_17.8-0+deb13u1_armhf.deb 4a25e4405bf7dd10227b920f5b8b2e26a5b3eacb6769d661a82832364cf1f3b4 104572 postgresql-plpython3-17_17.8-0+deb13u1_armhf.deb 5af9d7adcc0236555599118350e534200d9404309e0053f4b8823ab202349b8b 82920 postgresql-pltcl-17-dbgsym_17.8-0+deb13u1_armhf.deb 7f371a7880fc84c940eafb9bb7e30fbd8dff16fe1bfe9fb1b85582d008f01fb4 40924 postgresql-pltcl-17_17.8-0+deb13u1_armhf.deb 6c853f3232fbeec9aa0ff631c80c04832aae9ad023021599a16b96fe01d1ee12 56248 postgresql-server-dev-17-dbgsym_17.8-0+deb13u1_armhf.deb af0b8475c1c08493ef3ae3fe9428477a19373ef16271be2b59cb0aa924451fc1 1298928 postgresql-server-dev-17_17.8-0+deb13u1_armhf.deb Files: 6d887d22f345ecca8f99a25cbfc75620 16908 debug optional libecpg-compat3-dbgsym_17.8-0+deb13u1_armhf.deb 97f78818ee5d280530a70bc671395204 16552 libs optional libecpg-compat3_17.8-0+deb13u1_armhf.deb 970956335022739c9cafba2b33150d37 247868 debug optional libecpg-dev-dbgsym_17.8-0+deb13u1_armhf.deb b5007758ae7f315786f0213ab32541ee 282688 libdevel optional libecpg-dev_17.8-0+deb13u1_armhf.deb 67afc535503765dcccb632809aa73da5 113868 debug optional libecpg6-dbgsym_17.8-0+deb13u1_armhf.deb fcb577d48e4fdaca3c55f575e8995474 55044 libs optional libecpg6_17.8-0+deb13u1_armhf.deb 8d51cb1c4656787703b8dce7fe0e18c4 91364 debug optional libpgtypes3-dbgsym_17.8-0+deb13u1_armhf.deb 923f25acf093590f88d264cc7e76c4b6 41620 libs optional libpgtypes3_17.8-0+deb13u1_armhf.deb c4e1dba08249096af5fe804b9889f4ce 139628 libdevel optional libpq-dev_17.8-0+deb13u1_armhf.deb f4947e1099cb8398e4f1de8d5a19f5cb 297188 debug optional libpq5-dbgsym_17.8-0+deb13u1_armhf.deb 010b78b06b1b84a89c89cc2e2309f33a 210520 libs optional libpq5_17.8-0+deb13u1_armhf.deb 9e10d590184b339f55cc5f21d9fddb68 18866364 debug optional postgresql-17-dbgsym_17.8-0+deb13u1_armhf.deb 98b174ca6b233ce89b39e64e55296a55 17041 database optional postgresql-17_17.8-0+deb13u1_armhf-buildd.buildinfo e0206c014e43a7310904f468a545bc53 15874100 database optional postgresql-17_17.8-0+deb13u1_armhf.deb 4ddaf06109823c7153feedc755a5f01a 2786348 debug optional postgresql-client-17-dbgsym_17.8-0+deb13u1_armhf.deb 2c1474c7bcc343c69805655f820d0622 1940152 database optional postgresql-client-17_17.8-0+deb13u1_armhf.deb e3bdaa5af91bef583169a3f74debb560 196896 debug optional postgresql-plperl-17-dbgsym_17.8-0+deb13u1_armhf.deb e2c4edb063ac172cd556858d6c1062f1 82308 database optional postgresql-plperl-17_17.8-0+deb13u1_armhf.deb 8ef560385ccbb7a1e6a7305845322f4d 198312 debug optional postgresql-plpython3-17-dbgsym_17.8-0+deb13u1_armhf.deb 943b6fc18d328107342a4ae0917c8e8c 104572 database optional postgresql-plpython3-17_17.8-0+deb13u1_armhf.deb f936a6ca0a32f63225e47aabf1f9a046 82920 debug optional postgresql-pltcl-17-dbgsym_17.8-0+deb13u1_armhf.deb b7adfb7a66e6920f8b39ce7d9d1f5803 40924 database optional postgresql-pltcl-17_17.8-0+deb13u1_armhf.deb 1b26dc7fcb1fae3a588d75819d077948 56248 debug optional postgresql-server-dev-17-dbgsym_17.8-0+deb13u1_armhf.deb 4609855b5ebf73d275e460ae5d081272 1298928 libdevel optional postgresql-server-dev-17_17.8-0+deb13u1_armhf.deb -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEYxmcRLDHP0tCCM0oScpU3dYulLgFAmmLaGoACgkQScpU3dYu lLiTSw/9GnN5qnJKXH33k32tlea57tWdIR7JSrSjK7hW9Uy9xmlm20SQsprr03tm VcP3xf1mtRl1vP0j4CtwWPe4JYpEZePI8OUOGub5OmDgtgmxxhz0vaBwLhoKAuvd CYgmgYMAkebVJGEcNN1sSnMbF5It1CAXvWeMUUxM/+FN8EAsyoGtdIJuTIZ/EW0X LBot5q6gzimL2AjvzdnMKqBlyuwRHYEq6+pArNlJ9RcWo0BfqAmBvhVyrVrAY+zE KegCwvDTT9DiFazVTpwbJ5FxIpklcxeq0wvr/ly0ltUy3A7IwE6bAdj4vwCENZC0 IQuh5ArXCT3q9ecBQn7gwmYBuMQfTwiChPqm7bZV+m5lywKC0Jo54O/ahei6dkhx nZNEbx8a0kyaFNv6untcRmXA/Py2yrIyyuyS+5Y5fpj/OkIHeTvgxmfRfjXU5xtN iab7d5i09HYp0uIugpjd0BsTDuuBCaGzeISJw8yB4lnvbbNWb958R3njJncfx+09 +9gnPk0++hvltuHezu7hO/SsGdD/UfI/6QbRHgMZ2cIJglNE94QABAgxuWlEVHz4 teeih0/SrpRrBAB6GWDAdtLvNjSsE9ob5sGndzjvaU+pGTvSm1KZVXnJR7Jdswgy 9+SoWx6gN2g4IvR0RyxRG6rz4Cy1TojAH/RnK/M66bZLXCJQYEM= =tzmZ -----END PGP SIGNATURE-----