CVE and update status of the FreeBSD ports tree3,864 unaddressed CVEs in 671 portsAll times are CET
Port details

databases/postgresql15-plpython 15.17

Module for using Python to write SQL functions

Maintainer
pgsql@FreeBSD.org
Packages
latest: 15.19, update to 15.17 not built yet
Upstream
up to date
Last update
to 15.17 · a6361f4a39
Quarterly
2026Q4: 15.19
WWW
https://www.postgresql.org/
Links
cgit · VuXML

Unaddressed and VuXML only (0)

No unaddressed CVE and nothing reported by pkg audit for the packaged version 15.19.

Fixed (26)

Show 26 fixed
VuXML entries whose affected range the packaged version has left, plus CVEs from the last 90 days that this version is already past (fixed by update).
CVECVSSPublishedDescription
CVE-2026-193858.82026-08-13Heap buffer overflow in PostgreSQL pg_dump of long function transform lists allows an object creator to execute arbitrary code as the operating system user running pg_du…
CVE-2026-184088.82026-08-13Untrusted data inclusion in pg_dump in PostgreSQL allows a malicious superuser of the origin server to inject arbitrary code for restore-time execution as the client ope…
CVE-2026-162398.82026-08-13Type confusion in PostgreSQL "portal"/cursor lifecycle allows a user to execute arbitrary code as the operating system user running the database, via re-creation of a cu…
CVE-2026-162388.82026-08-13Type confusion in PostgreSQL pg_restore_attribute_stats() allows an object creator to execute arbitrary code as the operating system user running the database, via confl…
CVE-2026-157428.82026-08-13Integer wraparound in PostgreSQL fuzzystrmatch allows a user to direct writes to a huge range of addresses, executing arbitrary code as the operating system user running…
CVE-2026-146808.82026-08-13Type confusion with PostgreSQL "internal" data type arguments allows any user to execute arbitrary code as the operating system user running the database, via calls to f…
CVE-2026-157418.82026-08-13SQL injection in PostgreSQL EXTRACT() deparse allows an object owner to execute arbitrary SQL as a superuser via a hostile object definition. Attacks affect expression …
CVE-2026-146778.82026-08-13Integer wraparound in PostgreSQL 32-bit builds of pltcl and plperl allows an object creator to cause the server to undersize an allocation and write out-of-bounds via cr…
CVE-2026-146698.82026-08-13Heap buffer overflow in PostgreSQL to_char(timestamptz) allows the party choosing the timezone to execute arbitrary code as the operating system user running the databas…
CVE-2026-146708.82026-08-13Heap buffer overflow in PostgreSQL plperl return of a tied hash allows the function owner to execute arbitrary code as the operating system user running the database, vi…
CVE-2026-146718.82026-08-13Type confusion in PostgreSQL module "refint" allows an object creator to execute arbitrary code as the operating system user running the database. The fix for this emer…
CVE-2026-146628.82026-08-13Integer wraparound in PostgreSQL tsvector and tsquery data type functions allows an unprivileged database user to cause the server to undersize an allocation and write o…
CVE-2026-146648.82026-08-13Heap buffer overflow in PostgreSQL regexp allows the query author to execute arbitrary code as the operating system user running the database, via text that would not pa…
CVE-2026-146798.22026-08-13Stack buffer overflow in PostgreSQL argument name matching allows an object creator to achieve unknown impacts via OUT parameter count. The attack can write only 0x0 an…
CVE-2026-64648.12026-08-13Untrusted data inclusion in PostgreSQL psql COPY may allow a server administrator to elicit execution of data lines as psql commands, via error injection. If the "COPY …
CVE-2026-146688.12026-08-13Type confusion regarding input of PostgreSQL ctid data type selectivity estimator allows an object creator to view a calculation derived from the value of an arbitrary 4…
CVE-2026-64717.22026-08-13Missing authorization in PostgreSQL logical decoding allows a non-superuser holding REPLICATION privilege to dlopen any file visible to the operating system account runn…
CVE-2026-146636.52026-08-13Cleartext storage in PostgreSQL pgcrypto disabled ciphers allows a user to recover cleartext, via direct observation of the faulty ciphertext. The OpenSSL version and O…
CVE-2026-146725.32026-08-13Observable response discrepancy in PostgreSQL SCRAM authentication allows an unauthenticated user to test the existence of a user via observing the SCRAM iteration count…
CVE-2026-64704.32026-08-13Missing authorization in PostgreSQL DDL commands allows an object creator to achieve denial of service against ALTER and DROP of the type, via creating a dependency on t…
CVE-2026-180244.32026-08-13Buffer over-read in PostgreSQL ascii() SQL function allows a user to disclose up to 3 bytes after the end of a specific allocation, via a crafted text value. This is th…
CVE-2026-146784.32026-08-13Buffer over-read in PostgreSQL pg_trgm index picksplit function reads past end of a heap buffer. This might allow a table maintainer to infer limited memory values, via…
CVE-2026-146664.22026-08-13Incomplete tracking in PostgreSQL of changes to role membership, role attributes, and database ownership allows a query to continue using cached row-level security polic…
CVE-2026-64693.82026-08-13Incorrect ownership assignment in PostgreSQL ALTER TABLE ALTER TYPE command reassigns ownership of dependent statistics objects to the current user. This wrongly allows…
CVE-2026-162413.82026-08-13Integer underflow in PostgreSQL ECPG allows a database server administrator to achieve temporary denial of service against the ECPG client via sending a bytea value lack…
CVE-2026-146733.82026-08-13Untrusted search path in PostgreSQL amcheck allows a grantee of amcheck function EXECUTE privilege to execute arbitrary functions as the owners of expression indexes tha…

Problem reports (0) · open in Bugzilla, most recently changed first

None.

Commits (6)

Palle Girgensohn (girgen) · 15.17
databases/postgresql??-*: Update to latest version

The PostgreSQL Global Development Group has released an update to all
supported versions of PostgreSQL, including 18.3, 17.9, 16.13, 15.17,
and 14.22. This is an out-of-cycle release that fixes several
regressions reported after the last update release.

Release notes:	https://www.postgresql.org/about/news/postgresql-183-179-1613-1517-and-1422-released-3246/
		https://wiki.postgresql.org/wiki/2026-02_Regression_Fixes
a6361f4a39
Po-Chuan Hsieh (sunpoet) · 15.14_1
databases/postgresql{13,14,15,16,17,18}-*: Multiple fixes

- Strip shared library and binary executable
- Fix stage-qa
- Bump PORTREVISION for package change

postgresql{13,14,15,16,17,18}-server:
- Clean up Makefile: Remove unnecessary ";\"
- Sort PLIST: share/locale comes before DATADIR (share/postgresql)

postgresql{17,18}-plperl:
- Remove duplicate USES=perl5
- Add missing USE_PERL5=run

from postgresql{17,18}-plperl build log:
====> Running Q/A tests (stage-qa)
Error: /usr/local/lib/postgresql/bool_plperl.so is linked to /usr/local/lib/perl5/5.40/mach/CORE/libperl.so.5.40 from lang/perl5.40 but it is not declared as a dependency

PR:		290587
Approved by:	girgen
a626924cf2
Palle Girgensohn (girgen)
databases/postgresql??-*: Update to latest minor versions

The PostgreSQL Global Development Group has released an update to all
supported versions of PostgreSQL, including 16.4, 15.8, 14.13, 13.16,
and 12.20. This release fixes 1 security vulnerability and over 55 bugs
reported over the last several months.

PR:	279671 - make the rc script service jails aware
PR:	279536 - remove LLVM max version restriction
PR:	278887 - SETENV -> SETENVI for -contrib ports

Release notes:	https://www.postgresql.org/docs/release/
b4e71c8402
Stefan Eßer (se)
Remove WWW entries moved into port Makefiles

Commit b7f05445c00f has added WWW entries to port Makefiles based on
WWW: lines in pkg-descr files.

This commit removes the WWW: lines of moved-over URLs from these
pkg-descr files.

Approved by:		portmgr (tcberner)
fb16dfecae
Stefan Eßer (se)
Add WWW entries to port Makefiles

It has been common practice to have one or more URLs at the end of the
ports' pkg-descr files, one per line and prefixed with "WWW:". These
URLs should point at a project website or other relevant resources.

Access to these URLs required processing of the pkg-descr files, and
they have often become stale over time. If more than one such URL was
present in a pkg-descr file, only the first one was tarnsfered into
the port INDEX, but for many ports only the last line did contain the
port specific URL to further information.

There have been several proposals to make a project URL available as
a macro in the ports' Makefiles, over time.

This commit implements such a proposal and moves one of the WWW: entries
of each pkg-descr file into the respective port's Makefile. A heuristic
attempts to identify the most relevant URL in case there is more than
one WWW: entry in some pkg-descr file. URLs that are not moved into the
Makefile are prefixed with "See also:" instead of "WWW:" in the pkg-descr
files in order to preserve them.

There are 1256 ports that had no WWW: entries in pkg-descr files. These
ports will not be touched in this commit.

The portlint port has been adjusted to expect a WWW entry in each port
Makefile, and to flag any remaining "WWW:" lines in pkg-descr files as
deprecated.

Approved by:		portmgr (tcberner)
b7f05445c0
Palle Girgensohn (girgen)
databases/postgresql??-*: add postgresql-15 to the ports tree

Introduce PostgreSQL-15 to the ports tree.

Make version 15 the master port, and add plist parameter for the
postgresql version.

Release notes:	https://www.postgresql.org/docs/devel/release.html
5b11f47f0d