Debian dla-4905 : libecpg-compat3 - security update

high Nessus Plugin ID 381297

Synopsis

The remote Debian host is missing one or more security-related updates.

Description

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4905 advisory.

------------------------------------------------------------------------- Debian LTS Advisory DLA-4905-1 [email protected] https://www.debian.org/lts/security/ Santiago Ruano Rincn November 14, 2026 https://wiki.debian.org/LTS
-------------------------------------------------------------------------

Package : postgresql-15 Version : 15.20-0+deb12u1 CVE ID : CVE-2026-6460 CVE-2026-6467 CVE-2026-14661 CVE-2026-16237 CVE-2026-16240 CVE-2026-18447 CVE-2026-116303 CVE-2026-116304 CVE-2026-116306 CVE-2026-116307 CVE-2026-116308 CVE-2026-116309 CVE-2026-116311 CVE-2026-116312 CVE-2026-116314 CVE-2026-116315 CVE-2026-116316 CVE-2026-116317 CVE-2026-116319 CVE-2026-116320 CVE-2026-116321 CVE-2026-116323 CVE-2026-116326 CVE-2026-116327 CVE-2026-116328 CVE-2026-116330 CVE-2026-116331 CVE-2026-116332 CVE-2026-116335 CVE-2026-116336 CVE-2026-120139 CVE-2026-120141 CVE-2026-120143 CVE-2026-120145 CVE-2026-120146 CVE-2026-120147 CVE-2026-120148 CVE-2026-120149 CVE-2026-120150 CVE-2026-120151 CVE-2026-120153 CVE-2026-120154

Multiple security issues were discovered in PostgreSQL, which may result in execution of arbitrary code, incorrect authentication, information disclosure, denial of service or privilege escalation.

To completely fix CVE-2026-6460 some extensions will require re-compilation against this released version.

For Debian 12 bookworm, these problems have been fixed in version 15.20-0+deb12u1.

We recommend that you upgrade your postgresql-15 packages.

For the detailed security status of postgresql-15 please refer to its security tracker page at:
https://security-tracker.debian.org/tracker/postgresql-15

Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS Attachment:
signature.asc Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Upgrade the libecpg-compat3 packages.

Plugin Details

Severity: High

ID: 381297

File Name: debian_DLA-4905.nasl

Version: 1.1

Type: Local

Agent: unix

Family: Debian Local Security Checks

Published: 11/14/2026

Updated: 11/14/2026

Supported Sensors: Continuous Assessment, Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: High

Score: 7.6

Percentile: 98.12

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 7.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2026-120145

CVSS v3

Risk Factor: High

Base Score: 8.8

Temporal Score: 7.7

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS Score Source: CVE-2026-6460

Vulnerability Information

CPE: cpe:/o:debian:debian_linux:12.0, p-cpe:/a:debian:debian_linux:libecpg-compat3, p-cpe:/a:debian:debian_linux:libecpg-dev, p-cpe:/a:debian:debian_linux:libecpg6, p-cpe:/a:debian:debian_linux:libpgtypes3, p-cpe:/a:debian:debian_linux:libpq-dev, p-cpe:/a:debian:debian_linux:libpq5, p-cpe:/a:debian:debian_linux:postgresql-15, p-cpe:/a:debian:debian_linux:postgresql-client-15, p-cpe:/a:debian:debian_linux:postgresql-doc-15, p-cpe:/a:debian:debian_linux:postgresql-plperl-15, p-cpe:/a:debian:debian_linux:postgresql-plpython3-15, p-cpe:/a:debian:debian_linux:postgresql-pltcl-15, p-cpe:/a:debian:debian_linux:postgresql-server-dev-15

Required KB Items: Host/local_checks_enabled, Host/Debian/release, Host/Debian/dpkg-l

Exploit Ease: No known exploits are available

Patch Publication Date: 11/14/2026

Vulnerability Publication Date: 11/12/2026

Reference Information

CVE: CVE-2026-116303, CVE-2026-116304, CVE-2026-116306, CVE-2026-116307, CVE-2026-116308, CVE-2026-116309, CVE-2026-116311, CVE-2026-116312, CVE-2026-116314, CVE-2026-116315, CVE-2026-116316, CVE-2026-116317, CVE-2026-116319, CVE-2026-116320, CVE-2026-116321, CVE-2026-116323, CVE-2026-116326, CVE-2026-116327, CVE-2026-116328, CVE-2026-116330, CVE-2026-116331, CVE-2026-116332, CVE-2026-116335, CVE-2026-116336, CVE-2026-120139, CVE-2026-120141, CVE-2026-120143, CVE-2026-120145, CVE-2026-120146, CVE-2026-120147, CVE-2026-120148, CVE-2026-120149, CVE-2026-120150, CVE-2026-120151, CVE-2026-120153, CVE-2026-120154, CVE-2026-14661, CVE-2026-16237, CVE-2026-16240, CVE-2026-18447, CVE-2026-6460, CVE-2026-6467

Detections

Analytics