Aller au contenu
en Se connecter
5.9 Moyenne

CVE-2026-120067 For updatable cursors, which are enabled by default, psqlODBC adds hidden ctid and, for tables with OIDs, oid columns to…

Description

For updatable cursors, which are enabled by default, psqlODBC adds hidden ctid and, for tables with OIDs, oid columns to the query. It copies each value into a 32-byte stack buffer using the length the server sent, without checking it against the buffer size, so a value of 32 bytes or more writes past the buffer. A server not trusted under current SSL settings can send such a value. So can any database user who can create a view with its own column named ctid that the application reads with an updatable cursor. Builds with _FORTIFY_SOURCE abort; other builds overwrite adjacent stack memory. Versions before psqlODBC 18.00.0006 are affected.

Produits et versions touchés

Produit Versions touchées Corrigé en
psqlODBC 18.00 premières → < 18.00.0006 18.00.0006

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de psqlODBC

Les 12 CVE de psqlODBC →
CVE-2026-120065 For an updatable cursor over a table without OIDs that has an auto-increment int4 column, psqlODBC uses that column to… 7.1 Élevée CVE-2026-120066 On Unix-like systems, when logging is enabled, psqlODBC creates its log files in /tmp by default, named from the program… 5.3 Moyenne CVE-2026-120064 Several psqlODBC entry points use an application-supplied column number or row index as an array index without… 7.5 Élevée CVE-2026-120063 When psqlODBC quotes a schema or table name into a 128-byte stack buffer, its length check lets it write up to two bytes… 5.9 Moyenne
Suivre cette CVE