{"id":"CVE-2026-120060","aliases":["DEBIAN-CVE-2026-120060","EUVD-2026-115373","GHSA-4mfx-cfxx-c877","GHSA-wgfh-hh9v-wmvg","SUSE-SU-2026:5191-1","SUSE-SU-2026:5192-1","UBUNTU-CVE-2026-120060","openSUSE-SU-2026:12472-1","openSUSE-SU-2026:22261-1"],"status":"published","title":"psqlODBC does not validate server-supplied counts and lengths","description":"psqlODBC trusts counts and lengths in server data in three places. SQLBulkOperations uses a server-supplied row count in a size subtraction that can underflow. SQLStatistics iterates index keys using a server-supplied key count without bounding it to the fixed storage. Bytea octal decoding reads up to two bytes past the end of a truncated escape sequence. A server not trusted under current SSL settings can crash the client or make it read out of bounds. Versions before psqlODBC 18.00.0006 are affected.","severity":{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00216,"percentile":0.12177,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-125","CWE-191"],"published":"2026-11-02T19:09:10Z","modified":"2026-11-12T12:27:18Z","fixes":[{"ecosystem":"Debian:14","package":"psqlodbc","fixed_in":["1:18.00.0006-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"psqlodbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:13.02.0000-2","1:15.00.0000-1","1:16.00.0000-1","1:16.00.0005-1","1:17.00.0004-1","1:17.00.0004-2","1:17.00.0005-1","1:17.00.0006-1","1:17.00.0006-2","1:17.00.0007-1","1:17.00.0008-1","1:18.00.0001-1","1:18.00.0002-1","1:18.00.0003-1","1:18.00.0003-2","1:18.00.0004-1","1:18.00.0005-1","1:18.00.0006-1"]},{"source":"osv","ecosystem":"Debian:13","package":"psqlodbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:17.00.0004-2","1:17.00.0005-1","1:17.00.0006-1","1:17.00.0006-2","1:17.00.0007-1","1:17.00.0008-1","1:18.00.0001-1","1:18.00.0002-1","1:18.00.0003-1","1:18.00.0003-2","1:18.00.0004-1","1:18.00.0005-1","1:18.00.0006-1"]},{"source":"osv","ecosystem":"Debian:14","package":"psqlodbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.00.0006-1"}]}],"versions":["1:17.00.0004-2","1:17.00.0005-1","1:17.00.0006-1","1:17.00.0006-2","1:17.00.0007-1","1:17.00.0008-1","1:18.00.0001-1","1:18.00.0002-1","1:18.00.0003-1","1:18.00.0003-2","1:18.00.0004-1","1:18.00.0005-1"]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"psqlODBC","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.00.0006-150600.3.5.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"psqlODBC","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.00.0006-150600.3.5.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"psqlODBC","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.00.0006-150600.3.5.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"psqlODBC","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.00.0006-1.8.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"psqlODBC","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.00.0006-1.8.1"}]}],"bundled":12},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"psqlodbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:09.03.0300-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"psqlodbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:09.06.0410-1","1:10.00.0000-1","1:10.01.0000-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"psqlodbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:11.00.0000-1","1:12.00.0000-1","1:12.01.0000-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"psqlodbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:13.00.0000-1","1:13.02.0000-1","1:13.02.0000-2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"psqlodbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:15.00.0000-1","1:16.00.0000-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"psqlodbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:17.00.0007-1","1:18.00.0001-1","1:18.00.0002-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"psqlodbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:17.00.0006-2","1:17.00.0007-1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"psqlODBC","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.00.0006-1.1"}]}],"bundled":11},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"psqlODBC","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.00.0006-bp160.1.1"}]}],"bundled":11}],"products":[{"vendor":"postgresql","product":"psqlodbc"}],"references":[{"url":"https://github.com/postgresql-interfaces/psqlodbc/security/advisories/GHSA-4mfx-cfxx-c877","tags":["vendor-advisory","advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120060","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-wgfh-hh9v-wmvg"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/120xxx/CVE-2026-120060.json","tags":["advisory"]},{"url":"https://github.com/postgresql-interfaces/psqlodbc","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-120060","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20265191-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1285073","tags":["report"]},{"url":"https://bugzilla.suse.com/1289252","tags":["report"]},{"url":"https://bugzilla.suse.com/1289253","tags":["report"]},{"url":"https://bugzilla.suse.com/1289254","tags":["report"]},{"url":"https://bugzilla.suse.com/1289255","tags":["report"]},{"url":"https://bugzilla.suse.com/1289256","tags":["report"]},{"url":"https://bugzilla.suse.com/1289257","tags":["report"]},{"url":"https://bugzilla.suse.com/1289258","tags":["report"]},{"url":"https://bugzilla.suse.com/1289259","tags":["report"]},{"url":"https://bugzilla.suse.com/1289260","tags":["report"]},{"url":"https://bugzilla.suse.com/1289261","tags":["report"]},{"url":"https://bugzilla.suse.com/1289262","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109448","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-120057","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-120058","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-120059","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-120060","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-120061","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-120062","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-120063","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-120064","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-120065","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-120066","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-120067","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20265192-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-120060","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-120060","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-120060","title":"psqlODBC does not validate server-supplied counts and lengths","description":"psqlODBC trusts counts and lengths in server data in three places. SQLBulkOperations uses a server-supplied row count in a size subtraction that can underflow. SQLStatistics iterates index keys using a server-supplied key count without bounding it to the fixed storage. Bytea octal decoding reads up to two bytes past the end of a truncated escape sequence. A server not trusted under current SSL settings can crash the client or make it read out of bounds. Versions before psqlODBC 18.00.0006 are affected.","status":"published","published":"2026-11-02T19:09:10.912Z","modified":"2026-11-02T19:43:04.278Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-125","CWE-191"],"updated_at":"2026-11-02T20:51:24.336573Z"}],"euvd":[{"id":"EUVD-2026-115373","description":"psqlODBC trusts counts and lengths in server data in three places. SQLBulkOperations uses a server-supplied row count in a size subtraction that can underflow. SQLStatistics iterates index keys using a server-supplied key count without bounding it to the fixed storage. Bytea octal decoding reads up to two bytes past the end of a truncated escape sequence. A server not trusted under current SSL settings can crash the client or make it read out of bounds. Versions before psqlODBC 18.00.0006 are affected.","status":"published","published":"2026-11-02T19:09:10Z","modified":"2026-11-02T19:43:04Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:H","level":"medium"}],"updated_at":"2026-11-03T05:08:38.228652Z"}],"ghsa":[{"id":"GHSA-wgfh-hh9v-wmvg","title":"psqlODBC trusts counts and lengths in server data in three places. SQLBulkOperations uses a...","description":"psqlODBC trusts counts and lengths in server data in three places. SQLBulkOperations uses a server-supplied row count in a size subtraction that can underflow. SQLStatistics iterates index keys using a server-supplied key count without bounding it to the fixed storage. Bytea octal decoding reads up to two bytes past the end of a truncated escape sequence. A server not trusted under current SSL settings can crash the client or make it read out of bounds. Versions before psqlODBC 18.00.0006 are affected.","status":"published","published":"2026-11-02T21:31:57Z","modified":"2026-11-02T21:32:01Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:H","level":"medium"}],"cwes":["CWE-125"],"updated_at":"2026-11-03T00:02:47.574481Z"}],"nvd":[{"id":"CVE-2026-120060","description":"psqlODBC trusts counts and lengths in server data in three places. SQLBulkOperations uses a server-supplied row count in a size subtraction that can underflow. SQLStatistics iterates index keys using a server-supplied key count without bounding it to the fixed storage. Bytea octal decoding reads up to two bytes past the end of a truncated escape sequence. A server not trusted under current SSL settings can crash the client or make it read out of bounds. Versions before psqlODBC 18.00.0006 are affected.","status":"published","published":"2026-11-02T19:18:03.137Z","modified":"2026-11-02T20:17:39.19Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-125","CWE-191"],"updated_at":"2026-11-03T00:02:42.67885Z"}],"osv":[{"id":"CVE-2026-120060","title":"psqlODBC does not validate server-supplied counts and lengths","description":"psqlODBC trusts counts and lengths in server data in three places. SQLBulkOperations uses a server-supplied row count in a size subtraction that can underflow. SQLStatistics iterates index keys using a server-supplied key count without bounding it to the fixed storage. Bytea octal decoding reads up to two bytes past the end of a truncated escape sequence. A server not trusted under current SSL settings can crash the client or make it read out of bounds. Versions before psqlODBC 18.00.0006 are affected.","status":"published","published":"2026-11-02T19:09:10.912Z","modified":"2026-11-12T12:27:18.864014519Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:H","level":"medium"}],"cwes":["CWE-125","CWE-191"],"updated_at":"2026-11-08T02:57:14.556074Z"},{"id":"DEBIAN-CVE-2026-120060","description":"psqlODBC trusts counts and lengths in server data in three places. SQLBulkOperations uses a server-supplied row count in a size subtraction that can underflow. SQLStatistics iterates index keys using a server-supplied key count without bounding it to the fixed storage. Bytea octal decoding reads up to two bytes past the end of a truncated escape sequence. A server not trusted under current SSL settings can crash the client or make it read out of bounds. Versions before psqlODBC 18.00.0006 are affected.","status":"published","published":"2026-11-02T19:18:03.137Z","modified":"2026-11-05T10:00:43.98607858Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:H","level":"medium"}],"updated_at":"2026-11-05T13:31:24.64316Z"},{"id":"UBUNTU-CVE-2026-120060","description":"psqlODBC trusts counts and lengths in server data in three places. SQLBulkOperations uses a server-supplied row count in a size subtraction that can underflow. SQLStatistics iterates index keys using a server-supplied key count without bounding it to the fixed storage. Bytea octal decoding reads up to two bytes past the end of a truncated escape sequence. A server not trusted under current SSL settings can crash the client or make it read out of bounds. Versions before psqlODBC 18.00.0006 are affected.","status":"published","published":"2026-11-02T19:18:00Z","modified":"2026-11-05T04:42:52Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:H","level":"medium"}],"updated_at":"2026-11-05T13:33:25.727744Z"},{"id":"openSUSE-SU-2026:12472-1","title":"psqlODBC-18.00.0006-1.1 on GA media","description":"These are all security issues fixed in the psqlODBC-18.00.0006-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-11-06T00:00:00Z","modified":"2026-11-07T17:23:16.02618632Z","updated_at":"2026-11-07T17:50:39.727056Z"},{"id":"openSUSE-SU-2026:22261-1","title":"Security update for psqlODBC","description":"This update for psqlODBC fixes the following issues:\n\nChanges in psqlODBC:\n\n- Update to 18.00.0006:\n  * Large-object read overflows the application buffer\n    (CVE-2026-120057, bsc#1289252).\n  * Row cache overflow when a later FETCH changes the column count\n    (CVE-2026-120058, bsc#1289253).\n  * Driver uses a server-supplied column name as a format string\n    (CVE-2026-120059, bsc#1289254).\n  * Driver does not validate server-supplied counts and lengths\n    (CVE-2026-120060, bsc#1289255).\n  * ODBC escape parser stack buffer overflow\n    (CVE-2026-120061, bsc#1289256).\n  * SQL injection through SQLSpecialColumns table and schema names\n    (CVE-2026-120062, bsc#1289257).\n  * Stack buffer overflow when quoting long schema and table names\n    (CVE-2026-120063, bsc#1289258).\n  * Driver does not validate column numbers and row indexes in\n    binding and descriptor functions\n    (CVE-2026-120064, bsc#1289259).\n  * Driver does not escape a server-supplied column name in its\n    updatable-cursor queries (CVE-2026-120065, bsc#1289260).\n  * Log files are created with default permissions at a predictable\n    path and follow symbolic links\n    (CVE-2026-120066, bsc#1289261).\n  * Stack buffer overflow when reading the keyset (ctid/oid)\n    columns of an updatable cursor\n    (CVE-2026-120067, bsc#1289262).\n  * Hardening: SQLSetDescRecW stored a freed buffer and the address\n    of a local variable as deferred bound data. It now stores the\n    application's pointers, as SQLSetDescRec does.\n  * Hardening: SQLColumns returned uninitialized relkind and table\n    OID values when the table query returned no rows.\n  * Hardening: convert_linefeeds could dereference a NULL pointer\n    in one build configuration.\n  * Hardening: secure_sscanf limits an over-wide %Ns width,\n    msgtowstr checks for a zero buffer length, and the MSDTC\n    connect-string append is bounded.\n","status":"published","published":"2026-11-06T16:51:52Z","modified":"2026-11-11T17:23:13.168183448Z","updated_at":"2026-11-11T17:47:15.466074Z"},{"id":"SUSE-SU-2026:5191-1","title":"Security update for psqlODBC","description":"This update for psqlODBC fixes the following issues:\n\n- CVE-2026-109448: denial of service via integer wraparound in SQLBindParameter (bsc#1285073).\n- CVE-2026-120057: large-object read overflows the application buffer (bsc#1289252).\n- CVE-2026-120058: row cache overflow when a later FETCH changes the column count (bsc#1289253).\n- CVE-2026-120059: driver uses a server-supplied column name as a format string (bsc#1289254).\n- CVE-2026-120060: driver does not validate server-supplied counts and lengths (bsc#1289255).\n- CVE-2026-120061: ODBC escape parser stack buffer overflow (bsc#1289256).\n- CVE-2026-120062: SQL injection through SQLSpecialColumns table and schema names (bsc#1289257).\n- CVE-2026-120063: stack buffer overflow when quoting long schema and table names (bsc#1289258).\n- CVE-2026-120064: driver does not validate column numbers and row indexes in binding and descriptor functions\n  (bsc#1289259).\n- CVE-2026-120065: driver does not escape a server-supplied column name in its updatable-cursor queries (bsc#1289260).\n- CVE-2026-120066: log files are created with default permissions at a predictable path and follow symbolic links\n  (bsc#1289261).\n- CVE-2026-120067: stack buffer overflow when reading the keyset (ctid/oid) columns of an updatable cursor\n  (bsc#1289262).\n\nChanges for psqlODBC:\n\n- Update to 18.00.0006:\n  * https://odbc.postgresql.org/docs/release.html\n  * Hardening: SQLSetDescRecW stored a freed buffer and the address\n    of a local variable as deferred bound data. It now stores the\n    application's pointers, as SQLSetDescRec does.\n  * Hardening: SQLColumns returned uninitialized relkind and table\n    OID values when the table query returned no rows.\n  * Hardening: convert_linefeeds could dereference a NULL pointer\n    in one build configuration.\n  * Hardening: secure_sscanf limits an over-wide %Ns width,\n    msgtowstr checks for a zero buffer length, and the MSDTC\n    connect-string append is bounded.\n- Update to 18.00.0005:\n  * https://odbc.postgresql.org/docs/release.html\n  * Fix the placeholder cast being truncated from parameter 1000\n    on, which failed with 'type 'timestam' does not exist'.\n  * Report the largest column size instead of SQL_NO_TOTAL (-4) as\n    COLUMN_SIZE for bytea in SQLGetTypeInfo, which broke bytea\n    parameters through MSDASQL.\n- Update to 18.00.0004:\n  * Fix the result-conversions regression test on big-endian\n    systems.\n- Update to 18.00.0003:\n  * Report SQLSTATE 22003 for out-of-range integer conversions\n    instead of silently returning the wrapped low bits.\n  * Fix statement level rollback (Protocol=7.4-2) discarding the\n    whole transaction on a syntax error.\n  * Do not wrap internal queries in a savepoint at\n    rollback-on-error level 0 (Protocol=7.4-0), which lost\n    transactions on servers without SAVEPOINT support.\n  * Redact the database password (ODBC PWD and libpq pqopt\n    password) in debug logs.\n  * Fix hang on COPY ... FROM STDIN / TO STDOUT: report it as\n    unsupported and keep the connection usable.\n  * Fix 'infinity'/'-infinity' dates being silently returned as\n    today's date.\n  * Document the connection string escaping rules.\n- Update to 18.00.0002:\n  * Use a signed type for the error status.\n  * Redact sensitive connection parameters in the driver logs.\n  * Fix double free / heap corruption during SQLDisconnect\n    cleanup.\n  * Clear PGresults from per-query rollback.\n  * Validate UTF-16 surrogate pairs before combining them.\n  * Pass SQLSetDescRec field values correctly.\n  * Avoid reading before leading string literals.\n  * Detach freed application descriptors from statements.\n  * Reject invalid SQLPutData lengths.\n  * Reject overlong cursor names.\n  * Fix version reporting.\n  * Handle ARD bookmark allocation failure.\n  * Validate percent escapes before decoding connection string\n    values.\n  * Avoid reading past the end of conn_settings.\n  * Fix stack buffer overflow in getPrecisionPart().\n  * Fix SQLPrimaryKeys to exclude INCLUDE columns from the result.\n- Update to 18.00.0000, 18.00.0001 and 17.00.0010:\n  * No code changes from 17.00.0009.\n- Update to 17.00.0009:\n  * Fix the test suite for PostgreSQL 19, where\n    standard_conforming_strings is always on.\n  * Upgrade the GitHub Actions workflow: use prebuilt PostgreSQL\n    binaries, parallel matrix builds and a separate release job.\n- Update to 17.00.0008:\n  * https://odbc.postgresql.org/docs/release.html\n- fix build for SLE-15 by forcing gcc 14\n","status":"published","published":"2026-11-11T12:27:47Z","modified":"2026-11-12T12:15:04.8798919Z","updated_at":"2026-11-12T12:48:34.460153Z"},{"id":"SUSE-SU-2026:5192-1","title":"Security update for psqlODBC","description":"This update for psqlODBC fixes the following issues:\n\n- CVE-2026-109448: denial of service via integer wraparound in SQLBindParameter (bsc#1285073).\n- CVE-2026-120057: large-object read overflows the application buffer (bsc#1289252).\n- CVE-2026-120058: row cache overflow when a later FETCH changes the column count (bsc#1289253).\n- CVE-2026-120059: driver uses a server-supplied column name as a format string (bsc#1289254).\n- CVE-2026-120060: driver does not validate server-supplied counts and lengths (bsc#1289255).\n- CVE-2026-120061: ODBC escape parser stack buffer overflow (bsc#1289256).\n- CVE-2026-120062: SQL injection through SQLSpecialColumns table and schema names (bsc#1289257).\n- CVE-2026-120063: stack buffer overflow when quoting long schema and table names (bsc#1289258).\n- CVE-2026-120064: driver does not validate column numbers and row indexes in binding and descriptor functions\n  (bsc#1289259).\n- CVE-2026-120065: driver does not escape a server-supplied column name in its updatable-cursor queries (bsc#1289260).\n- CVE-2026-120066: log files are created with default permissions at a predictable path and follow symbolic links\n  (bsc#1289261).\n- CVE-2026-120067: stack buffer overflow when reading the keyset (ctid/oid) columns of an updatable cursor\n  (bsc#1289262).\n\nChanges for psqlODBC:\n\n- Update to 18.00.0006:\n  * https://odbc.postgresql.org/docs/release.html\n  * Hardening: SQLSetDescRecW stored a freed buffer and the address\n    of a local variable as deferred bound data. It now stores the\n    application's pointers, as SQLSetDescRec does.\n  * Hardening: SQLColumns returned uninitialized relkind and table\n    OID values when the table query returned no rows.\n  * Hardening: convert_linefeeds could dereference a NULL pointer\n    in one build configuration.\n  * Hardening: secure_sscanf limits an over-wide %Ns width,\n    msgtowstr checks for a zero buffer length, and the MSDTC\n    connect-string append is bounded.\n- Update to 18.00.0005:\n  * https://odbc.postgresql.org/docs/release.html\n  * Fix the placeholder cast being truncated from parameter 1000\n    on, which failed with 'type 'timestam' does not exist'.\n  * Report the largest column size instead of SQL_NO_TOTAL (-4) as\n    COLUMN_SIZE for bytea in SQLGetTypeInfo, which broke bytea\n    parameters through MSDASQL.\n- Update to 18.00.0004:\n  * Fix the result-conversions regression test on big-endian\n    systems.\n- Update to 18.00.0003:\n  * Report SQLSTATE 22003 for out-of-range integer conversions\n    instead of silently returning the wrapped low bits.\n  * Fix statement level rollback (Protocol=7.4-2) discarding the\n    whole transaction on a syntax error.\n  * Do not wrap internal queries in a savepoint at\n    rollback-on-error level 0 (Protocol=7.4-0), which lost\n    transactions on servers without SAVEPOINT support.\n  * Redact the database password (ODBC PWD and libpq pqopt\n    password) in debug logs.\n  * Fix hang on COPY ... FROM STDIN / TO STDOUT: report it as\n    unsupported and keep the connection usable.\n  * Fix 'infinity'/'-infinity' dates being silently returned as\n    today's date.\n  * Document the connection string escaping rules.\n- Update to 18.00.0002:\n  * Use a signed type for the error status.\n  * Redact sensitive connection parameters in the driver logs.\n  * Fix double free / heap corruption during SQLDisconnect\n    cleanup.\n  * Clear PGresults from per-query rollback.\n  * Validate UTF-16 surrogate pairs before combining them.\n  * Pass SQLSetDescRec field values correctly.\n  * Avoid reading before leading string literals.\n  * Detach freed application descriptors from statements.\n  * Reject invalid SQLPutData lengths.\n  * Reject overlong cursor names.\n  * Fix version reporting.\n  * Handle ARD bookmark allocation failure.\n  * Validate percent escapes before decoding connection string\n    values.\n  * Avoid reading past the end of conn_settings.\n  * Fix stack buffer overflow in getPrecisionPart().\n  * Fix SQLPrimaryKeys to exclude INCLUDE columns from the result.\n- Update to 18.00.0000, 18.00.0001 and 17.00.0010:\n  * No code changes from 17.00.0009.\n- Update to 17.00.0009:\n  * Fix the test suite for PostgreSQL 19, where\n    standard_conforming_strings is always on.\n  * Upgrade the GitHub Actions workflow: use prebuilt PostgreSQL\n    binaries, parallel matrix builds and a separate release job.\n- Update to 17.00.0008:\n  * https://odbc.postgresql.org/docs/release.html\n- fix build for SLE-15 by forcing gcc 14\n- Update to 16.00.0000:\n  * Use autoconf to check for stdbool.h.\n- Update to 13.02.0000:\n  * Fix a bug of CC_send_query_append() when the\n    ignore_roundtrip_time flag is onRemove a mylog() call which is\n    a dupilicate of the preceding MYLOG() macro call.\n  * Remove REFCUR_SUPPORT, add FetchRefcursors setting.\n  * Support fetching results from multiple refcursors.\n  * Named parameter binding support\n  * Use ODBC 3 column names for the result set of catalog\n    functions.\n- Update to 13.01.0000:\n  * Fix a bug of CC_send_query_append() when the\n    ignore_roundtrip_time flag is on.\n  * Add a call for SQLDescribeCol() before SQLExecute() to prepare-test.\n  * The diff of the result was reported by Mangold Fabian and will be\n    fixed in the later commit.\n  * Add a *update returning* test case to insertreturning regression test.\n  * The diff of the result was reported by Patrick Cheung and will be\n    fixed in the later commit.\n  * Let SQLDescribeCol() use parsed result when the current executed\n    result is NULL.\n  * This change fixes the diff of prepare-test regression test reported\n    by Mangold Fabian.\n  * Let SQLExecute() destroy the old result first.\n  * This change fixes the diff of insertreturning-test regression test\n    reported by Patrick Cheung.\n  * Forget to apply disable_convert_func flag to VARCHAR and LONGVARCHAR.\n  * Prioritize DISABLE_KEEPALIVE checkbox over the disable_keepalive\n    bit of ExtraOptions.\n  * Format check for ExtraOptions of setup dialog.\n- Update to 13.00.0000:\n  * Add support for CONVERT scalar function.\n  * Cope with the case that openssl libraries link msvc runtimes\n    other than libraries which psqlodbc or libpq links.\n  * Call AC_CHECK_SIZEOF() or AC_CHECK_TYPES() macros at earlier\n    stage where LIBS variable isn't set yet.\n  * These macros compile and run some programs. On some platforms\n    (with some linker options like --no-as-needed in Lnux Gnu linker)\n    the programs try to link libraries specified by LIBS variable\n    at run time. There are some cases that the programs fail due\n    to missing library which is actually not needed and\n    AC_CHECK_SIZEOF() returns 0.\n  * Fix a compilation error with GCC 10 due to conflicting\n    variable names.\n  * Patch by Paul Wise.\n  * Remove curr_param_result property of StatementClass and\n    separate parsed result from the exec result.\n  * Add support for development with VC16(Visual Studio 2019).\n  * MSToolsVersion parameter of BuildAll.ps1 and of regress.ps1\n    are deprecated.\n  * Hold the first and last result for parametrized SQL statements\n    with array of parameters.\n  * This would improve the performance of bulk inserts/updates etc.\n  * Revise the handling of QResultClass list.\n  * Introduce macros QR_concat(), QR_detach() and QR_next().\n  * Correct the handling of SQL_ROW_ERROR and SQL_ROW_SUCCESS_WITH_INFO.\n  * Remove the single table restriction in SC_set_SS_columnkey.\n  * Improve error reporting about SC_pos_reload_needed().\n- Update to 12.02.0000:\n  * Add a new *Display Optional Error Message* option.\n    This option allows to display error messages other than primary\n    one. Also add documentaition about the option and\n    *Numeric as* option.\n  * Handle notice messages in libpq_bind_and_exec().\n    Sets and resets a notify receiver around PQexecParams() or\n    PQexecPrepared().\n  * Ignore PQtransactionStatus PQTRANS_ACTIVE in\n    LIBPQ_update_transaction_status(). PQTRANS_ACTIVE isn't a\n    transaction status.\n  * Improve execution of parameterized SQL statements with arrays\n    of parameters by sending chunks of SQL statements.\n    If SQL_ATTR_CURSOR_TYPE of an statement is\n    SQL_CURSOR_FORWARD_ONLY, SQL_ATTR_CONCURRENCY is\n    SQL_CONCUR_READ_ONLY and extended protocol isn't used, the\n    batch execution of the statement is possible. A new option\n    Batch Size was introduced for such cases.\n    Batch Size: Split an array (of parameters) into chunks of\n    Batch Size to execute statements. The last chunk may contain\n    less than Batch Size elements. Setting 1 to this option forces\n    the current one by one execution.\n    Also turn off use_server_side_prepare option temporarily when\n    batch executuion is possible.\n  * Change SC_execute() so that it returns a return code which is\n    not affetced by the preceding results. It's necessary for\n    batch execution with arrays of parameters.\n  * Add a new option IgnoreTimeout.\n  * Some tools issue issue SQLSetStmtAttr(.., SQL_ATTR_QUERY_TIMEOUT,,)\n    internally and sometimes it's difficult for users to change the\n    timeout value. You can disable the timeout by turning on this option.\n  * An improvement for psqlodbc developpers.\n    Make it possible to call some shell scripts from other directories. \n","status":"published","published":"2026-11-11T12:28:30Z","modified":"2026-11-12T12:15:05.362256307Z","updated_at":"2026-11-12T12:48:34.460153Z"}]}}