Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package postgresql16 for openSUSE:Factory checked in at 2026-08-19 17:58:06 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/postgresql16 (Old) and /work/SRC/openSUSE:Factory/.postgresql16.new.1258 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "postgresql16" Wed Aug 19 17:58:06 2026 rev:26 rq:1371816 version:16.15 Changes: -------- --- /work/SRC/openSUSE:Factory/postgresql16/postgresql16.changes 2026-06-16 13:59:54.357468810 +0200 +++ /work/SRC/openSUSE:Factory/.postgresql16.new.1258/postgresql16.changes 2026-08-19 17:58:49.116068744 +0200 @@ -1,0 +2,64 @@ +Sat Aug 15 14:51:45 UTC 2026 - Marcus Rueckert <[email protected]> + +- Update to version 16.15: + https://www.postgresql.org/docs/16/release-16-15.html + https://www.postgresql.org/about/news/postgresql-186-1711-1615-1519-1424-and-19-beta-3-released-3365/ + + Security Fixes: + - bsc#1275046, CVE-2026-6464: psql COPY FROM STDIN early failure + processes data lines as psql commands (CVSS v3.1: 8.1) + - bsc#1275044, CVE-2026-6469: ALTER TABLE ALTER TYPE resets + extended statistics ownership (CVSS v3.1: 3.8) + - bsc#1275043, CVE-2026-6470: Fails to check type USAGE privilege + (CVSS v3.1: 4.3) + - bsc#1275042, CVE-2026-6471: Logical decoding can dlopen + arbitrary file (CVSS v3.1: 7.2) + - bsc#1275001, CVE-2026-14662: tsvector and tsquery undersize + allocations, via integer wraparound (CVSS v3.1: 8.8) + - bsc#1275002, CVE-2026-14663: pgcrypto, for OpenSSL-disabled + ciphers, silently encrypts to and decrypts from cleartext (CVSS + v3.1: 6.5) + - bsc#1275068, CVE-2026-14664: Regexp heap buffer overflow + executes arbitrary code (CVSS v3.1: 8.8) + - bsc#1275067, CVE-2026-14666: Row security caching disregards + role modifications (CVSS v3.1: 4.2) + - bsc#1275066, CVE-2026-14668: ctid type confusion in selectivity + estimator discloses derivative of arbitrary read (CVSS v3.1: + 8.1) + - bsc#1275065, CVE-2026-14669: to_char heap buffer overflow + executes arbitrary code (CVSS v3.1: 8.8) + - bsc#1275064, CVE-2026-14670: plperl tied object heap buffer + overflow executes arbitrary code (CVSS v3.1: 8.8) + - bsc#1275063, CVE-2026-14671: refint plan cache type confusion + executes arbitrary code (CVSS v3.1: 8.8) + - bsc#1275062, CVE-2026-14672: Observable response discrepancy + with non-default scram_iterations provides user existence + oracle (CVSS v3.1: 5.3) + - bsc#1275061, CVE-2026-14673: amcheck does not clear untrusted + search path (CVSS v3.1: 3.8) + - bsc#1275059, CVE-2026-14677: 32-bit pltcl and plperl undersize + allocations, via integer wraparound (CVSS v3.1: 8.8) + - bsc#1275058, CVE-2026-14678: pg_trgm picksplit reads past end + of buffer (CVSS v3.1: 4.3) + - bsc#1275057, CVE-2026-14679: Stack buffer overflow in argument + match writes 0x0 and 0x1 to server memory (CVSS v3.1: 8.2) + - bsc#1275056, CVE-2026-14680: Type confusion via "internal" + arguments (CVSS v3.1: 8.8) + - bsc#1275054, CVE-2026-15741: Expression deparse allows SQL + injection via EXTRACT argument (CVSS v3.1: 8.8) + - bsc#1275053, CVE-2026-15742: fuzzystrmatch writes + effectively-arbitrary addresses, via integer wraparound (CVSS + v3.1: 8.8) + - bsc#1275051, CVE-2026-16239: Type confusion in cursor CLOSE + + DECLARE executes arbitrary code (CVSS v3.1: 8.8) + - bsc#1275050, CVE-2026-16241: ECPG integer underflow can crash + the client (CVSS v3.1: 3.8) + - bsc#1275049, CVE-2026-18024: ascii() function reads past end of + buffer (CVSS v3.1: 4.3) + - bsc#1275048, CVE-2026-18408: psql \unrestrict lets superuser of + pg_dump origin server execute arbitrary code in psql client + (CVSS v3.1: 8.8) + - bsc#1275047, CVE-2026-19385: pg_dump heap buffer overflow + executes arbitrary code (CVSS v3.1: 8.8) + +------------------------------------------------------------------- @@ -9,0 +74,5 @@ + +------------------------------------------------------------------- +Fri Jun 12 20:10:15 UTC 2026 - Marcus Rueckert <[email protected]> + +- bump packaging level to 19 Old: ---- postgresql-16.14.tar.bz2 postgresql-16.14.tar.bz2.sha256 New: ---- postgresql-16.15.tar.bz2 postgresql-16.15.tar.bz2.sha256 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ postgresql16.spec ++++++ --- /var/tmp/diff_new_pack.7IILS8/_old 2026-08-19 17:58:50.195107406 +0200 +++ /var/tmp/diff_new_pack.7IILS8/_new 2026-08-19 17:58:50.198107514 +0200 @@ -17,7 +17,7 @@ %define pgmajor 16 -%define pgminor 14 +%define pgminor 15 ### CUT HERE ### %define pgname postgresql%pgmajor @@ -73,7 +73,7 @@ %bcond_without alts Requires: pg_alts %else -%define packaging_level 18 +%define packaging_level 19 %bcond_with alts %define install_alternatives /usr/share/postgresql/install-alternatives %pgmajor %endif ++++++ postgresql-16.14.tar.bz2 -> postgresql-16.15.tar.bz2 ++++++ /work/SRC/openSUSE:Factory/postgresql16/postgresql-16.14.tar.bz2 /work/SRC/openSUSE:Factory/.postgresql16.new.1258/postgresql-16.15.tar.bz2 differ: char 11, line 1 ++++++ postgresql-16.14.tar.bz2.sha256 -> postgresql-16.15.tar.bz2.sha256 ++++++ --- /work/SRC/openSUSE:Factory/postgresql16/postgresql-16.14.tar.bz2.sha256 2026-05-18 17:50:23.822204438 +0200 +++ /work/SRC/openSUSE:Factory/.postgresql16.new.1258/postgresql-16.15.tar.bz2.sha256 2026-08-19 17:58:49.087067705 +0200 @@ -1 +1 @@ -f6d077142737920858ce958ccdb75c6ee137a63b5b0853c70693d401ac7e3471 postgresql-16.14.tar.bz2 +c1575341fa7bd40f5274ea465b34390f4dc64cdd0770af327005caaeb9f6b7ed postgresql-16.15.tar.bz2
