databases/postgresql??-*: Update to latest version The PostgreSQL Global Development Group has released an update to all supported versions of PostgreSQL, including 18.3, 17.9, 16.13, 15.17, and 14.22. This is an out-of-cycle release that fixes several regressions reported after the last update release. Release notes: https://www.postgresql.org/about/news/postgresql-183-179-1613-1517-and-1422-released-3246/ https://wiki.postgresql.org/wiki/2026-02_Regression_Fixesa6361f4a39
Port details
databases/postgresql16-pltcl 16.13
Module for using Tcl to write SQL functions
Port info
- Maintainer
- pgsql@FreeBSD.org
- Packages
- latest: 16.15, update to 16.13 not built yet
- Upstream
- up to date
- Last update
- to 16.13 · a6361f4a39
- Quarterly
- 2026Q4: 16.15
- WWW
- https://www.postgresql.org/
- Links
- cgit · VuXML · Report wrong data
Install
- Package
# pkg install postgresql16-pltclinstalls 16.15 fromlatest; fromquarterly(2026Q4) 16.15- Port
# cd /usr/ports/databases/postgresql16-pltcl && make install clean- Size
- 23 KiB download · 61 KiB installed
- Depends on
- databases/postgresql16-server 16.15, lang/tcl86 8.6.18_1
- License
- PostgreSQL
- pkg-message
Shown after installing
PL/Tcl has been installed. Check the createlang(l) manpage for more info. You can install pltcl as trusted or untrusted, by using either "createlang pltcl" or "createlang pltclu".
Packages by version and architecture
latest
| FreeBSD version | amd64 | aarch64 | i386 |
|---|---|---|---|
| FreeBSD 16 | 16.15 | 16.15 | – |
| FreeBSD 15 | 16.15 | 16.15 | – |
| FreeBSD 14 | 16.15 | 16.15 | 16.15 |
quarterly (2026Q4)
| FreeBSD version | amd64 | aarch64 | i386 |
|---|---|---|---|
| FreeBSD 15 | 16.15 | 16.15 | – |
| FreeBSD 14 | 16.15 | 16.15 | 16.15 |
version as in the ports tree (latest) or the most common one (quarterly) · different version · ✗ not built · – no packages for this platform. Package sets that have not been rebuilt for 60 days are left out.
Unaddressed and VuXML only (0)
No unaddressed CVE and nothing reported by
pkg audit for the packaged version 16.15.Fixed (26)
Show 26 fixed
VuXML entries whose affected range the packaged version has left, plus CVEs from the last 90 days that this version is already past (fixed by update).
| CVE | CVSS | Published | Description |
|---|---|---|---|
| CVE-2026-19385 | 8.8 | 2026-08-13 | Heap buffer overflow in PostgreSQL pg_dump of long function transform lists allows an object creator to execute arbitrary code as the operating system user running pg_du… |
| CVE-2026-18408 | 8.8 | 2026-08-13 | Untrusted data inclusion in pg_dump in PostgreSQL allows a malicious superuser of the origin server to inject arbitrary code for restore-time execution as the client ope… |
| CVE-2026-16239 | 8.8 | 2026-08-13 | Type confusion in PostgreSQL "portal"/cursor lifecycle allows a user to execute arbitrary code as the operating system user running the database, via re-creation of a cu… |
| CVE-2026-16238 | 8.8 | 2026-08-13 | Type confusion in PostgreSQL pg_restore_attribute_stats() allows an object creator to execute arbitrary code as the operating system user running the database, via confl… |
| CVE-2026-15742 | 8.8 | 2026-08-13 | Integer wraparound in PostgreSQL fuzzystrmatch allows a user to direct writes to a huge range of addresses, executing arbitrary code as the operating system user running… |
| CVE-2026-14680 | 8.8 | 2026-08-13 | Type confusion with PostgreSQL "internal" data type arguments allows any user to execute arbitrary code as the operating system user running the database, via calls to f… |
| CVE-2026-15741 | 8.8 | 2026-08-13 | SQL injection in PostgreSQL EXTRACT() deparse allows an object owner to execute arbitrary SQL as a superuser via a hostile object definition. Attacks affect expression … |
| CVE-2026-14677 | 8.8 | 2026-08-13 | Integer wraparound in PostgreSQL 32-bit builds of pltcl and plperl allows an object creator to cause the server to undersize an allocation and write out-of-bounds via cr… |
| CVE-2026-14669 | 8.8 | 2026-08-13 | Heap buffer overflow in PostgreSQL to_char(timestamptz) allows the party choosing the timezone to execute arbitrary code as the operating system user running the databas… |
| CVE-2026-14670 | 8.8 | 2026-08-13 | Heap buffer overflow in PostgreSQL plperl return of a tied hash allows the function owner to execute arbitrary code as the operating system user running the database, vi… |
| CVE-2026-14671 | 8.8 | 2026-08-13 | Type confusion in PostgreSQL module "refint" allows an object creator to execute arbitrary code as the operating system user running the database. The fix for this emer… |
| CVE-2026-14662 | 8.8 | 2026-08-13 | Integer wraparound in PostgreSQL tsvector and tsquery data type functions allows an unprivileged database user to cause the server to undersize an allocation and write o… |
| CVE-2026-14664 | 8.8 | 2026-08-13 | Heap buffer overflow in PostgreSQL regexp allows the query author to execute arbitrary code as the operating system user running the database, via text that would not pa… |
| CVE-2026-14679 | 8.2 | 2026-08-13 | Stack buffer overflow in PostgreSQL argument name matching allows an object creator to achieve unknown impacts via OUT parameter count. The attack can write only 0x0 an… |
| CVE-2026-6464 | 8.1 | 2026-08-13 | Untrusted data inclusion in PostgreSQL psql COPY may allow a server administrator to elicit execution of data lines as psql commands, via error injection. If the "COPY … |
| CVE-2026-14668 | 8.1 | 2026-08-13 | Type confusion regarding input of PostgreSQL ctid data type selectivity estimator allows an object creator to view a calculation derived from the value of an arbitrary 4… |
| CVE-2026-6471 | 7.2 | 2026-08-13 | Missing authorization in PostgreSQL logical decoding allows a non-superuser holding REPLICATION privilege to dlopen any file visible to the operating system account runn… |
| CVE-2026-14663 | 6.5 | 2026-08-13 | Cleartext storage in PostgreSQL pgcrypto disabled ciphers allows a user to recover cleartext, via direct observation of the faulty ciphertext. The OpenSSL version and O… |
| CVE-2026-14672 | 5.3 | 2026-08-13 | Observable response discrepancy in PostgreSQL SCRAM authentication allows an unauthenticated user to test the existence of a user via observing the SCRAM iteration count… |
| CVE-2026-6470 | 4.3 | 2026-08-13 | Missing authorization in PostgreSQL DDL commands allows an object creator to achieve denial of service against ALTER and DROP of the type, via creating a dependency on t… |
| CVE-2026-18024 | 4.3 | 2026-08-13 | Buffer over-read in PostgreSQL ascii() SQL function allows a user to disclose up to 3 bytes after the end of a specific allocation, via a crafted text value. This is th… |
| CVE-2026-14678 | 4.3 | 2026-08-13 | Buffer over-read in PostgreSQL pg_trgm index picksplit function reads past end of a heap buffer. This might allow a table maintainer to infer limited memory values, via… |
| CVE-2026-14666 | 4.2 | 2026-08-13 | Incomplete tracking in PostgreSQL of changes to role membership, role attributes, and database ownership allows a query to continue using cached row-level security polic… |
| CVE-2026-6469 | 3.8 | 2026-08-13 | Incorrect ownership assignment in PostgreSQL ALTER TABLE ALTER TYPE command reassigns ownership of dependent statistics objects to the current user. This wrongly allows… |
| CVE-2026-16241 | 3.8 | 2026-08-13 | Integer underflow in PostgreSQL ECPG allows a database server administrator to achieve temporary denial of service against the ECPG client via sending a bytea value lack… |
| CVE-2026-14673 | 3.8 | 2026-08-13 | Untrusted search path in PostgreSQL amcheck allows a grantee of amcheck function EXECUTE privilege to execute arbitrary functions as the owners of expression indexes tha… |
Problem reports (0) · open in Bugzilla, most recently changed first
None.
Commits (4)
databases/postgresql{13,14,15,16,17,18}-*: Multiple fixes
- Strip shared library and binary executable
- Fix stage-qa
- Bump PORTREVISION for package change
postgresql{13,14,15,16,17,18}-server:
- Clean up Makefile: Remove unnecessary ";\"
- Sort PLIST: share/locale comes before DATADIR (share/postgresql)
postgresql{17,18}-plperl:
- Remove duplicate USES=perl5
- Add missing USE_PERL5=run
from postgresql{17,18}-plperl build log:
====> Running Q/A tests (stage-qa)
Error: /usr/local/lib/postgresql/bool_plperl.so is linked to /usr/local/lib/perl5/5.40/mach/CORE/libperl.so.5.40 from lang/perl5.40 but it is not declared as a dependency
PR: 290587
Approved by: girgena626924cf2databases/postgresql??-*: Update to latest minor versions The PostgreSQL Global Development Group has released an update to all supported versions of PostgreSQL, including 16.4, 15.8, 14.13, 13.16, and 12.20. This release fixes 1 security vulnerability and over 55 bugs reported over the last several months. PR: 279671 - make the rc script service jails aware PR: 279536 - remove LLVM max version restriction PR: 278887 - SETENV -> SETENVI for -contrib ports Release notes: https://www.postgresql.org/docs/release/b4e71c8402
databases/postgresql16-*: Introduce postgresql16 beta 1 URL: https://www.postgresql.org/about/news/postgresql-16-beta-1-released-2643/ Release notes: https://www.postgresql.org/docs/16/release-16.html4ee225f90a