{"schema_version":"1.7.2","id":"OESA-2025-2728","modified":"2026-08-06T11:09:51Z","published":"2025-11-22T11:09:51Z","upstream":["CVE-2025-12817","CVE-2025-12818"],"summary":"libpq security update","details":"PostgreSQL is a powerful, open source object-relational database system that uses and extends the SQL language combined with many features that safely store and scale the most complicated data workloads. This package provides the essential shared library for any PostgreSQL client program or interface.\r\n\r\nSecurity Fix(es):\n\nMissing authorization in PostgreSQL CREATE STATISTICS command allows a table owner to achieve denial of service against other CREATE STATISTICS users by creating in any schema.  A later CREATE STATISTICS for the same name, from a user having the CREATE privilege, would then fail.  Versions before PostgreSQL 18.1, 17.7, 16.11, 15.15, 14.20, and 13.23 are affected.(CVE-2025-12817)\n\nInteger wraparound in multiple PostgreSQL libpq client library functions allows an application input provider or network peer to cause libpq to undersize an allocation and write out-of-bounds by hundreds of megabytes.  This results in a segmentation fault for the application using libpq.  Versions before PostgreSQL 18.1, 17.7, 16.11, 15.15, 14.20, and 13.23 are affected.(CVE-2025-12818)","affected":[{"package":{"ecosystem":"openEuler:22.03-LTS-SP4","name":"libpq","purl":"pkg:rpm/openEuler/libpq&distro=openEuler-22.03-LTS-SP4"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"13.23-1.oe2203sp4"}]}],"ecosystem_specific":{"aarch64":["libpq-13.23-1.oe2203sp4.aarch64.rpm","libpq-debuginfo-13.23-1.oe2203sp4.aarch64.rpm","libpq-debugsource-13.23-1.oe2203sp4.aarch64.rpm","libpq-devel-13.23-1.oe2203sp4.aarch64.rpm"],"src":["libpq-13.23-1.oe2203sp4.src.rpm"],"x86_64":["libpq-13.23-1.oe2203sp4.x86_64.rpm","libpq-debuginfo-13.23-1.oe2203sp4.x86_64.rpm","libpq-debugsource-13.23-1.oe2203sp4.x86_64.rpm","libpq-devel-13.23-1.oe2203sp4.x86_64.rpm"]}}],"references":[{"type":"ADVISORY","url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2728"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-12817"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-12818"}],"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"database_specific":{"severity":"Medium"}}