Debian 11 PostgreSQL 13 Multiple Issues Fixed DLA-4524-1 CVE-2026-2003

CVE-2026-2003

Fix CVE-2026-2003: Improper validation of type "oidvector" in PostgreSQL
allows a database user to disclose a few bytes of server memory. We have
not ruled out viability of attacks that arrange for presence of
confidential information in disclosed bytes, but they seem unlikely.

CVE-2026-2004

Fix CVE-2026-2004: Missing validation of type of input in PostgreSQL
intarray extension selectivity estimator function allows an object creator
to execute arbitrary code as the operating system user running the
database.

CVE-2026-2005

Fix CVE-2026-2005: Heap buffer overflow in PostgreSQL pgcrypto allows a
ciphertext provider to execute arbitrary code as the operating system user
running the database.

CVE-2026-2006

Fix CVE-2026-2006: Missing validation of multibyte character length in
PostgreSQL text manipulation allows a database user to issue crafted
queries that achieve a buffer overrun. That suffices to execute arbitrary