Back Linuxsecurity

openSUSE: postgresql13 Important Fix for CVE-2025-12817 and CVE-2025

Linuxsecurity •LinuxSecurity Advisories • December 9, 2025

This update for postgresql13 fixes the following issues: Upgraded to 13.23: * CVE-2025-12817: Fixed missing check for CREATE privileges on the schema in CREATE STATISTICS (bsc#1253332) * CVE-2025-12818: Fixed integer overflow in allocation-size calculations within libpq (bsc#1253333) Other fixes: * Use %product_libs_llvm_ver to determine the LLVM version. * Remove conditionals for obsolete PostgreSQL releases. * Sync spec file from version 18.

## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.6 zypper in -t patch openSUSE-SLE-15.6-2025-4325=1 SUSE-2025-4325=1

## Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like

YaST online_update or "zypper patch".

Alternatively you can run the command listed for your product:

zypper in -t patch openSUSE-SLE-15.6-2025-4325=1 SUSE-2025-4325=1

* openSUSE Leap 15.6 (aarch64 ppc64le s390x x86_64 i586) * postgresql13-server-13.23-150600.14.14.1 * postgresql13-plperl-13.23-150600.14.14.1 * postgresql13-devel-debuginfo-13.23-150600.14.14.1 * postgresql13-debuginfo-13.23-150600.14.14.1 * postgresql13-server-debuginfo-13.23-150600.14.14.1 * postgresql13-contrib-debuginfo-13.23-150600.14.14.1 * postgresql13-llvmjit-13.23-150600.14.14.1 * postgresql13-llvmjit-devel-13.23-150600.14.14.1 * postgresql13-pltcl-debuginfo-13.23-150600.14.14.1 * postgresql13-plpython-13.23-150600.14.14.1 * postgresql13-server-devel-debuginfo-13.23-150600.14.14.1 * postgresql13-plpython-debuginfo-13.23-150600.14.14.1 * postgresql13-llvmjit-debuginfo-13.23-150600.14.14.1 * postgresql13-devel-13.23-150600.14.14.1 * postgresql13-13.23-150600.14.14.1 * postgresql13-test-13.23-150600.14.14.1 * postgresql13-contrib-13.23-150600.14.14.1 * postgresql13-pltcl-13.23-150600.14.14.1 * Read the Full Advisory

* openSUSE Leap 15.6 (aarch64 ppc64le s390x x86_64 i586)

* postgresql13-server-13.23-150600.14.14.1

* postgresql13-plperl-13.23-150600.14.14.1

* postgresql13-devel-debuginfo-13.23-150600.14.14.1

* postgresql13-debuginfo-13.23-150600.14.14.1

* postgresql13-server-debuginfo-13.23-150600.14.14.1

* postgresql13-contrib-debuginfo-13.23-150600.14.14.1

* postgresql13-llvmjit-13.23-150600.14.14.1

* postgresql13-llvmjit-devel-13.23-150600.14.14.1

* postgresql13-pltcl-debuginfo-13.23-150600.14.14.1

* postgresql13-plpython-13.23-150600.14.14.1

* postgresql13-server-devel-debuginfo-13.23-150600.14.14.1

* postgresql13-plpython-debuginfo-13.23-150600.14.14.1

* postgresql13-llvmjit-debuginfo-13.23-150600.14.14.1

* postgresql13-devel-13.23-150600.14.14.1

* postgresql13-13.23-150600.14.14.1

* postgresql13-test-13.23-150600.14.14.1

* postgresql13-contrib-13.23-150600.14.14.1

* postgresql13-pltcl-13.23-150600.14.14.1

* bsc#1253332 * bsc#1253333 ## References: * * * *

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

openSUSE Leap 15.6 Addresses PostgreSQL 13 Critical Vulnerabilities openSUSE Leap 15.6 has released an update for PostgreSQL 13 to address critical vulnerabilities, specifically CVE-2025-12817 and CVE-2025-12818. These vulnerabilities include a missing privilege check in CREATE STATISTICS and an integer overflow in libpq, affecting users of PostgreSQL 13.23. 7 sources 49

Extracted Entities

CVEs (2)

CVE-2025-12817 CVE-2025-12818