SUSE-SU-2026:5192-1: important: Security update for psqlODBC
SLE-SECURITY-UPDATES
null at suse.de
Wed Nov 11 21:40:52 UTC 2026
# Security update for psqlODBC
Announcement ID: SUSE-SU-2026:5192-1
Release Date: 2026-11-11T12:28:36Z
Rating: important
References:
* bsc#1285073
* bsc#1289252
* bsc#1289253
* bsc#1289254
* bsc#1289255
* bsc#1289256
* bsc#1289257
* bsc#1289258
* bsc#1289259
* bsc#1289260
* bsc#1289261
* bsc#1289262
Cross-References:
* CVE-2026-109448
* CVE-2026-120057
* CVE-2026-120058
* CVE-2026-120059
* CVE-2026-120060
* CVE-2026-120061
* CVE-2026-120062
* CVE-2026-120063
* CVE-2026-120064
* CVE-2026-120065
* CVE-2026-120066
* CVE-2026-120067
CVSS scores:
* CVE-2026-109448 ( SUSE ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-109448 ( NVD ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-120057 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-120057 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-120058 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-120058 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-120059 ( SUSE ): 6.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:H
* CVE-2026-120059 ( NVD ): 6.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:H
* CVE-2026-120060 ( SUSE ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:H
* CVE-2026-120060 ( NVD ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:H
* CVE-2026-120061 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-120061 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-120062 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-120062 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-120063 ( SUSE ): 5.9 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H
* CVE-2026-120063 ( NVD ): 5.9 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H
* CVE-2026-120064 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-120064 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-120065 ( SUSE ): 7.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-120065 ( NVD ): 7.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-120066 ( SUSE ): 5.3 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N
* CVE-2026-120066 ( NVD ): 5.3 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N
* CVE-2026-120067 ( SUSE ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-120067 ( NVD ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products:
* SUSE Linux Enterprise High Performance Computing 12 SP5
* SUSE Linux Enterprise Server 12 SP5
* SUSE Linux Enterprise Server 12 SP5 LTSS
* SUSE Linux Enterprise Server 12 SP5 LTSS Extended Security
* SUSE Linux Enterprise Server for SAP Applications 12 SP5
An update that solves 12 vulnerabilities can now be installed.
## Description:
This update for psqlODBC fixes the following issues:
* CVE-2026-109448: denial of service via integer wraparound in
SQLBindParameter (bsc#1285073).
* CVE-2026-120057: large-object read overflows the application buffer
(bsc#1289252).
* CVE-2026-120058: row cache overflow when a later FETCH changes the column
count (bsc#1289253).
* CVE-2026-120059: driver uses a server-supplied column name as a format
string (bsc#1289254).
* CVE-2026-120060: driver does not validate server-supplied counts and lengths
(bsc#1289255).
* CVE-2026-120061: ODBC escape parser stack buffer overflow (bsc#1289256).
* CVE-2026-120062: SQL injection through SQLSpecialColumns table and schema
names (bsc#1289257).
* CVE-2026-120063: stack buffer overflow when quoting long schema and table
names (bsc#1289258).
* CVE-2026-120064: driver does not validate column numbers and row indexes in
binding and descriptor functions (bsc#1289259).
* CVE-2026-120065: driver does not escape a server-supplied column name in its
updatable-cursor queries (bsc#1289260).
* CVE-2026-120066: log files are created with default permissions at a
predictable path and follow symbolic links (bsc#1289261).
* CVE-2026-120067: stack buffer overflow when reading the keyset (ctid/oid)
columns of an updatable cursor (bsc#1289262).
Changes for psqlODBC:
* Update to 18.00.0006:
* https://odbc.postgresql.org/docs/release.html
* Hardening: SQLSetDescRecW stored a freed buffer and the address of a local
variable as deferred bound data. It now stores the application's pointers,
as SQLSetDescRec does.
* Hardening: SQLColumns returned uninitialized relkind and table OID values
when the table query returned no rows.
* Hardening: convert_linefeeds could dereference a NULL pointer in one build
configuration.
* Hardening: secure_sscanf limits an over-wide %Ns width, msgtowstr checks for
a zero buffer length, and the MSDTC connect-string append is bounded.
* Update to 18.00.0005:
* https://odbc.postgresql.org/docs/release.html
* Fix the placeholder cast being truncated from parameter 1000 on, which
failed with 'type "timestam" does not exist'.
* Report the largest column size instead of SQL_NO_TOTAL (-4) as COLUMN_SIZE
for bytea in SQLGetTypeInfo, which broke bytea parameters through MSDASQL.
* Update to 18.00.0004:
* Fix the result-conversions regression test on big-endian systems.
* Update to 18.00.0003:
* Report SQLSTATE 22003 for out-of-range integer conversions instead of
silently returning the wrapped low bits.
* Fix statement level rollback (Protocol=7.4-2) discarding the whole
transaction on a syntax error.
* Do not wrap internal queries in a savepoint at rollback-on-error level 0
(Protocol=7.4-0), which lost transactions on servers without SAVEPOINT
support.
* Redact the database password (ODBC PWD and libpq pqopt password) in debug
logs.
* Fix hang on COPY ... FROM STDIN / TO STDOUT: report it as unsupported and
keep the connection usable.
* Fix 'infinity'/'-infinity' dates being silently returned as today's date.
* Document the connection string escaping rules.
* Update to 18.00.0002:
* Use a signed type for the error status.
* Redact sensitive connection parameters in the driver logs.
* Fix double free / heap corruption during SQLDisconnect cleanup.
* Clear PGresults from per-query rollback.
* Validate UTF-16 surrogate pairs before combining them.
* Pass SQLSetDescRec field values correctly.
* Avoid reading before leading string literals.
* Detach freed application descriptors from statements.
* Reject invalid SQLPutData lengths.
* Reject overlong cursor names.
* Fix version reporting.
* Handle ARD bookmark allocation failure.
* Validate percent escapes before decoding connection string values.
* Avoid reading past the end of conn_settings.
* Fix stack buffer overflow in getPrecisionPart().
* Fix SQLPrimaryKeys to exclude INCLUDE columns from the result.
* Update to 18.00.0000, 18.00.0001 and 17.00.0010:
* No code changes from 17.00.0009.
* Update to 17.00.0009:
* Fix the test suite for PostgreSQL 19, where standard_conforming_strings is
always on.
* Upgrade the GitHub Actions workflow: use prebuilt PostgreSQL binaries,
parallel matrix builds and a separate release job.
* Update to 17.00.0008:
* https://odbc.postgresql.org/docs/release.html
* fix build for SLE-15 by forcing gcc 14
* Update to 16.00.0000:
* Use autoconf to check for stdbool.h.
* Update to 13.02.0000:
* Fix a bug of CC_send_query_append() when the ignore_roundtrip_time flag is
onRemove a mylog() call which is a dupilicate of the preceding MYLOG() macro
call.
* Remove REFCUR_SUPPORT, add FetchRefcursors setting.
* Support fetching results from multiple refcursors.
* Named parameter binding support
* Use ODBC 3 column names for the result set of catalog functions.
* Update to 13.01.0000:
* Fix a bug of CC_send_query_append() when the ignore_roundtrip_time flag is
on.
* Add a call for SQLDescribeCol() before SQLExecute() to prepare-test.
* The diff of the result was reported by Mangold Fabian and will be fixed in
the later commit.
* Add a _update returning_ test case to insertreturning regression test.
* The diff of the result was reported by Patrick Cheung and will be fixed in
the later commit.
* Let SQLDescribeCol() use parsed result when the current executed result is
NULL.
* This change fixes the diff of prepare-test regression test reported by
Mangold Fabian.
* Let SQLExecute() destroy the old result first.
* This change fixes the diff of insertreturning-test regression test reported
by Patrick Cheung.
* Forget to apply disable_convert_func flag to VARCHAR and LONGVARCHAR.
* Prioritize DISABLE_KEEPALIVE checkbox over the disable_keepalive bit of
ExtraOptions.
* Format check for ExtraOptions of setup dialog.
* Update to 13.00.0000:
* Add support for CONVERT scalar function.
* Cope with the case that openssl libraries link msvc runtimes other than
libraries which psqlodbc or libpq links.
* Call AC_CHECK_SIZEOF() or AC_CHECK_TYPES() macros at earlier stage where
LIBS variable isn't set yet.
* These macros compile and run some programs. On some platforms (with some
linker options like --no-as-needed in Lnux Gnu linker) the programs try to
link libraries specified by LIBS variable at run time. There are some cases
that the programs fail due to missing library which is actually not needed
and AC_CHECK_SIZEOF() returns 0.
* Fix a compilation error with GCC 10 due to conflicting variable names.
* Patch by Paul Wise.
* Remove curr_param_result property of StatementClass and separate parsed
result from the exec result.
* Add support for development with VC16(Visual Studio 2019).
* MSToolsVersion parameter of BuildAll.ps1 and of regress.ps1 are deprecated.
* Hold the first and last result for parametrized SQL statements with array of
parameters.
* This would improve the performance of bulk inserts/updates etc.
* Revise the handling of QResultClass list.
* Introduce macros QR_concat(), QR_detach() and QR_next().
* Correct the handling of SQL_ROW_ERROR and SQL_ROW_SUCCESS_WITH_INFO.
* Remove the single table restriction in SC_set_SS_columnkey.
* Improve error reporting about SC_pos_reload_needed().
* Update to 12.02.0000:
* Add a new _Display Optional Error Message_ option. This option allows to
display error messages other than primary one. Also add documentaition about
the option and _Numeric as_ option.
* Handle notice messages in libpq_bind_and_exec(). Sets and resets a notify
receiver around PQexecParams() or PQexecPrepared().
* Ignore PQtransactionStatus PQTRANS_ACTIVE in
LIBPQ_update_transaction_status(). PQTRANS_ACTIVE isn't a transaction
status.
* Improve execution of parameterized SQL statements with arrays of parameters
by sending chunks of SQL statements. If SQL_ATTR_CURSOR_TYPE of an statement
is SQL_CURSOR_FORWARD_ONLY, SQL_ATTR_CONCURRENCY is SQL_CONCUR_READ_ONLY and
extended protocol isn't used, the batch execution of the statement is
possible. A new option Batch Size was introduced for such cases. Batch Size:
Split an array (of parameters) into chunks of Batch Size to execute
statements. The last chunk may contain less than Batch Size elements.
Setting 1 to this option forces the current one by one execution. Also turn
off use_server_side_prepare option temporarily when batch executuion is
possible.
* Change SC_execute() so that it returns a return code which is not affetced
by the preceding results. It's necessary for batch execution with arrays of
parameters.
* Add a new option IgnoreTimeout.
* Some tools issue issue SQLSetStmtAttr(.., SQL_ATTR_QUERY_TIMEOUT,,)
internally and sometimes it's difficult for users to change the timeout
value. You can disable the timeout by turning on this option.
* An improvement for psqlodbc developpers. Make it possible to call some shell
scripts from other directories.
## Patch Instructions:
To install this SUSE update use the SUSE recommended installation methods like
YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
* SUSE Linux Enterprise Server 12 SP5 LTSS
zypper in -t patch SUSE-SLE-SERVER-12-SP5-LTSS-2026-5192
* SUSE Linux Enterprise Server 12 SP5 LTSS Extended Security
zypper in -t patch SUSE-SLE-SERVER-12-SP5-LTSS-EXTENDED-SECURITY-2026-5192
## Package List:
* SUSE Linux Enterprise Server 12 SP5 LTSS (aarch64 ppc64le s390x x86_64)
* psqlODBC-debugsource-18.00.0006-1.8.1
* psqlODBC-debuginfo-18.00.0006-1.8.1
* psqlODBC-18.00.0006-1.8.1
* SUSE Linux Enterprise Server 12 SP5 LTSS Extended Security (x86_64)
* psqlODBC-debugsource-18.00.0006-1.8.1
* psqlODBC-debuginfo-18.00.0006-1.8.1
* psqlODBC-18.00.0006-1.8.1
## References:
* https://www.suse.com/security/cve/CVE-2026-109448.html
* https://www.suse.com/security/cve/CVE-2026-120057.html
* https://www.suse.com/security/cve/CVE-2026-120058.html
* https://www.suse.com/security/cve/CVE-2026-120059.html
* https://www.suse.com/security/cve/CVE-2026-120060.html
* https://www.suse.com/security/cve/CVE-2026-120061.html
* https://www.suse.com/security/cve/CVE-2026-120062.html
* https://www.suse.com/security/cve/CVE-2026-120063.html
* https://www.suse.com/security/cve/CVE-2026-120064.html
* https://www.suse.com/security/cve/CVE-2026-120065.html
* https://www.suse.com/security/cve/CVE-2026-120066.html
* https://www.suse.com/security/cve/CVE-2026-120067.html
* https://bugzilla.suse.com/show_bug.cgi?id=1285073
* https://bugzilla.suse.com/show_bug.cgi?id=1289252
* https://bugzilla.suse.com/show_bug.cgi?id=1289253
* https://bugzilla.suse.com/show_bug.cgi?id=1289254
* https://bugzilla.suse.com/show_bug.cgi?id=1289255
* https://bugzilla.suse.com/show_bug.cgi?id=1289256
* https://bugzilla.suse.com/show_bug.cgi?id=1289257
* https://bugzilla.suse.com/show_bug.cgi?id=1289258
* https://bugzilla.suse.com/show_bug.cgi?id=1289259
* https://bugzilla.suse.com/show_bug.cgi?id=1289260
* https://bugzilla.suse.com/show_bug.cgi?id=1289261
* https://bugzilla.suse.com/show_bug.cgi?id=1289262
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.suse.com/pipermail/sle-security-updates/attachments/20261111/9a18fe27/attachment.htm>
More information about the sle-security-updates
mailing list