Ce mail provient de l'extérieur, restons vigilants

=====================================================================


                            CERT-Renater

                Note d'Information No. 2026/VULN1118
_____________________________________________________________________

DATE                : 03/11/2026

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running psqlODBC versions prior
                                       to 18.00.0006.

====================================================================
https://github.com/postgresql-interfaces/psqlodbc/blob/main/Changelog.md
_____________________________________________________________________

Changelog

Release notes for psqlODBC, converted from docs/release.html and
docs/release-7.3.html.


18.00.0006

This release fixes the following vulnerabilities. All releases before
18.00.0006 are affected.

    Large-object read overflows the application buffer (CVE-2026-120057,
GHSA-qhmr-5339-q33r, CVSS 3.1 7.5 High)

    Row cache overflow when a later FETCH changes the column count
(CVE-2026-120058, GHSA-6rmx-9q62-4w6m, CVSS 3.1 7.5 High)

    Driver uses a server-supplied column name as a format string
(CVE-2026-120059, GHSA-44rq-72jh-x2h8, CVSS 3.1 6.8 Medium)

    Driver does not validate server-supplied counts and lengths
(CVE-2026-120060, GHSA-4mfx-cfxx-c877, CVSS 3.1 5.9 Medium)

    ODBC escape parser stack buffer overflow (CVE-2026-120061,
GHSA-hfm6-qfx8-v4xq, CVSS 3.1 7.5 High)

    SQL injection through SQLSpecialColumns table and schema names
(CVE-2026-120062, GHSA-gg8f-fx3w-rj33, CVSS 3.1 7.5 High)

    Stack buffer overflow when quoting long schema and table names
(CVE-2026-120063, GHSA-285r-84w3-xcxv, CVSS 3.1 5.9 Medium)

    Driver does not validate column numbers and row indexes in
binding and descriptor functions (CVE-2026-120064,
GHSA-7pq2-q7mj-ph8c, CVSS 3.1 7.5 High)

    Driver does not escape a server-supplied column name in its
updatable-cursor queries (CVE-2026-120065, GHSA-9cg8-r57h-h6jj,
CVSS 3.1 7.1 High)

    Log files are created with default permissions at a predictable
path and follow symbolic links (CVE-2026-120066,
GHSA-wj7r-6pj3-62g8, CVSS 3.1 5.3 Medium)

    Stack buffer overflow when reading the keyset (ctid/oid)
columns of an updatable cursor (CVE-2026-120067,
GHSA-3r96-h2q4-6pxh, CVSS 3.1 5.9 Medium)

The release also contains these hardening changes. They have no
demonstrated attack path and no CVE.

    SQLSetDescRecW stored a freed buffer and the address of a local
variable as deferred bound data. ODBC defines no Unicode form of
SQLSetDescRec, and driver managers call only SQLSetDescRec, so only
an application that calls the driver's SQLSetDescRecW export directly
reaches it. It now stores the application's pointers, as SQLSetDescRec
does.

    SQLColumns returned uninitialized relkind and table OID values
when the table query returned no rows.

    convert_linefeeds could dereference a NULL pointer in one
build configuration.

    secure_sscanf limits an over-wide %Ns width, msgtowstr checks
for a zero buffer length, and the MSDTC connect-string append is 

=========================================================
+ CERT-RENATER        |    tel : 01-53-94-20-44         +
+ 23/25 Rue Daviel    |    fax : 01-53-94-20-41         +
+ 75013 Paris         |   email:cert@support.renater.fr +
=========================================================