FreeBSD : PostgreSQL -- Multiple vulnerabilities (05d311bc-9991-11f1-bc50-6cc21735f730)

high Nessus Plugin ID 335950

Synopsis

The remote FreeBSD host is missing one or more security-related updates.

Description

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 05d311bc-9991-11f1-bc50-6cc21735f730 advisory.

The PostgreSQL project reports:

CVE-2026-6464: psql COPY FROM STDIN, if the copy fails before data rows begin, processes the following data lines as psql commands.

CVE-2026-6469: ALTER TABLE ALTER TYPE incorrectly reassigns ownership of dependent extended statistics objects to the current user.

CVE-2026-6470: Missing privilege check for type USAGE allows denial of service against ALTER and DROP of the type.

CVE-2026-6471: Logical decoding lets a REPLICATION- privileged user dlopen an arbitrary file via the decoding plugin choice, running arbitrary code as the server's OS user.

CVE-2026-14662: Integer wraparound in tsvector and tsquery functions can undersize an allocation, causing a buffer overflow and arbitrary code execution.

CVE-2026-14663: pgcrypto silently encrypts to and decrypts from cleartext for ciphers OpenSSL has disabled, letting an attacker recover cleartext.

CVE-2026-14664: Heap buffer overflow in the regexp engine allows arbitrary code execution via crafted input text.

CVE-2026-14666: Row-level security policy caching can retain a stale policy after role changes, letting a user complete now-forbidden reads or writes.

CVE-2026-14668: Type confusion in the ctid selectivity estimator discloses a derivative of an arbitrary 4-byte span of server memory.

CVE-2026-14669: Heap buffer overflow in to_char(timestamptz) via a long POSIX timezone abbreviation allows arbitrary code execution.

CVE-2026-14670: Heap buffer overflow in plperl, on return of a tied hash, allows the function owner to execute arbitrary code.

CVE-2026-14671: Type confusion in module refint allows an object creator to execute arbitrary code.

CVE-2026-14672: SCRAM authentication reveals whether a role exists via an observable difference in the reported iteration count.

CVE-2026-14673: amcheck fails to clear an untrusted search path, letting an EXECUTE grantee run arbitrary functions as an expression index's owner.

CVE-2026-14676: Heap buffer overflow in pg_stat_statements via crafted queries with array constants allows arbitrary code execution.

CVE-2026-14677: Integer wraparound in 32-bit pltcl/plperl builds can undersize an allocation, allowing arbitrary code execution.

CVE-2026-14678: pg_trgm's picksplit function reads past the end of a heap buffer, potentially disclosing limited memory.

CVE-2026-14679: Stack buffer overflow in argument-name matching lets an object creator write a few attacker- influenced bytes into server memory.

CVE-2026-14680: Type confusion via internal-typed function arguments allows any user to execute arbitrary code.

CVE-2026-14681: GSSAPI encryption is not properly enforced when coupled with an initial direct SSL connection.

CVE-2026-15741: Expression deparse of EXTRACT() allows SQL injection via a hostile object definition, affecting pg_dump and psql.

CVE-2026-15742: Integer wraparound in fuzzystrmatch's levenshtein() functions allows writes to arbitrary addresses and code execution.

CVE-2026-16238: Type confusion in pg_restore_attribute_stats() allows arbitrary code execution via conflated range/multirange values.

CVE-2026-16239: Type confusion via cursor DECLARE and CLOSE allows a user to execute arbitrary code.

CVE-2026-16241: Integer underflow in ECPG can crash the client via a bytea value lacking its mandatory prefix.

CVE-2026-18024: The ascii() function reads past the end of a buffer, disclosing a few bytes of server memory.

CVE-2026-18408: psql's \unrestrict lets a malicious pg_dump origin-server superuser execute arbitrary code in the restoring client.

CVE-2026-19385: Heap buffer overflow in pg_dump, when dumping long function transform lists, allows arbitrary code execution.

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected packages.

Plugin Details

Severity: High

ID: 335950

File Name: freebsd_pkg_05d311bc999111f1bc506cc21735f730.nasl

Version: 1.1

Type: Local

Family: FreeBSD Local Security Checks

Published: 8/17/2026

Updated: 8/17/2026

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 58.15

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 7.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2026-18408

CVSS v3

Risk Factor: High

Base Score: 8.8

Temporal Score: 7.7

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS Score Source: CVE-2026-19385

Vulnerability Information

CPE: cpe:/o:freebsd:freebsd, p-cpe:/a:freebsd:freebsd:postgresql14-server, p-cpe:/a:freebsd:freebsd:postgresql15-server, p-cpe:/a:freebsd:freebsd:postgresql16-server, p-cpe:/a:freebsd:freebsd:postgresql17-server, p-cpe:/a:freebsd:freebsd:postgresql18-server

Required KB Items: Host/local_checks_enabled, Host/FreeBSD/release, Host/FreeBSD/pkg_info

Exploit Ease: No known exploits are available

Patch Publication Date: 8/16/2026

Vulnerability Publication Date: 8/13/2026

Reference Information

CVE: CVE-2026-14662, CVE-2026-14663, CVE-2026-14664, CVE-2026-14666, CVE-2026-14668, CVE-2026-14669, CVE-2026-14670, CVE-2026-14671, CVE-2026-14672, CVE-2026-14673, CVE-2026-14676, CVE-2026-14677, CVE-2026-14678, CVE-2026-14679, CVE-2026-14680, CVE-2026-14681, CVE-2026-15741, CVE-2026-15742, CVE-2026-16238, CVE-2026-16239, CVE-2026-16241, CVE-2026-18024, CVE-2026-18408, CVE-2026-19385, CVE-2026-6464, CVE-2026-6469, CVE-2026-6470, CVE-2026-6471

Detections

Analytics