full-disclosure - [ MDVSA-2012:027 ] postgresql8.3

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Message-Id: <E1S2lwf-0005Az-FX@titan.mandriva.com>
Date: Wed, 29 Feb 2012 17:00:01 +0100
From: security@...driva.com
To: full-disclosure@...ts.grok.org.uk
Subject: [ MDVSA-2012:027 ] postgresql8.3

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 _______________________________________________________________________

 Mandriva Linux Security Advisory                         MDVSA-2012:027
 http://www.mandriva.com/security/
 _______________________________________________________________________

 Package : postgresql8.3
 Date    : February 29, 2012
 Affected: Enterprise Server 5.0
 _______________________________________________________________________

 Problem Description:

 Multiple vulnerabilities has been discovered and corrected in
 postgresql:
 
 Permissions on a function called by a trigger are not properly checked
 (CVE-2012-0866).
 
 Line breaks in object names can be exploited to execute arbitrary
 SQL when reloading a pg_dump file (CVE-2012-0868).
 
 This advisory provides the latest version of PostgreSQL that is not
 vulnerable to these issues.
 _______________________________________________________________________

 References:

 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0866
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0868
 http://www.postgresql.org/docs/8.3/static/release-8-3-18.html
 _______________________________________________________________________

 Updated Packages:

 Mandriva Enterprise Server 5:
 70516f4a8393dc8e20def2f1a2462221  mes5/i586/libecpg8.3_6-8.3.18-0.1mdvmes5.2.i586.rpm
 1348530066e2c20f69fb20597016cd59  mes5/i586/libpq8.3_5-8.3.18-0.1mdvmes5.2.i586.rpm
 2913c5253b14ee9693a56de326aef908  mes5/i586/postgresql8.3-8.3.18-0.1mdvmes5.2.i586.rpm
 def833bca0e5b4f5ecfefb9b8ac7c70e  mes5/i586/postgresql8.3-contrib-8.3.18-0.1mdvmes5.2.i586.rpm
 b43a09ab67757ba151aa00070c48657f  mes5/i586/postgresql8.3-devel-8.3.18-0.1mdvmes5.2.i586.rpm
 5ca9f707e5949501f4e83244d191312a  mes5/i586/postgresql8.3-docs-8.3.18-0.1mdvmes5.2.i586.rpm
 b6eaded77ff8cafb2908b28ce16cd53f  mes5/i586/postgresql8.3-pl-8.3.18-0.1mdvmes5.2.i586.rpm
 4aac998ffd953e60e670c9bf5655919e  mes5/i586/postgresql8.3-plperl-8.3.18-0.1mdvmes5.2.i586.rpm
 f72237aa1bc703a5ac388d6a868994ce  mes5/i586/postgresql8.3-plpgsql-8.3.18-0.1mdvmes5.2.i586.rpm
 b574999678236b55ff63c9d1bd187fd1  mes5/i586/postgresql8.3-plpython-8.3.18-0.1mdvmes5.2.i586.rpm
 61cca3e61d15c51c81d10018145d87e4  mes5/i586/postgresql8.3-pltcl-8.3.18-0.1mdvmes5.2.i586.rpm
 841d4c560acd2f3124506a2dda11f61a  mes5/i586/postgresql8.3-server-8.3.18-0.1mdvmes5.2.i586.rpm 
 e2eb79399056d7bd7fe4cac74dd39b5b  mes5/SRPMS/postgresql8.3-8.3.18-0.1mdvmes5.2.src.rpm

 Mandriva Enterprise Server 5/X86_64:
 b9218c66711faa5fe9d0f2a75a56f641  mes5/x86_64/lib64ecpg8.3_6-8.3.18-0.1mdvmes5.2.x86_64.rpm
 ea479cdd2007427c84e83e8b7c76edac  mes5/x86_64/lib64pq8.3_5-8.3.18-0.1mdvmes5.2.x86_64.rpm
 609ef28cc049852b270a47b0c28b5b4e  mes5/x86_64/postgresql8.3-8.3.18-0.1mdvmes5.2.x86_64.rpm
 82a498d8e4d685aede175f6adde68dd8  mes5/x86_64/postgresql8.3-contrib-8.3.18-0.1mdvmes5.2.x86_64.rpm
 c5c9e0960552b750973d7ed6b8d66c80  mes5/x86_64/postgresql8.3-devel-8.3.18-0.1mdvmes5.2.x86_64.rpm
 20fd300c66cca64191b8565b97341c3e  mes5/x86_64/postgresql8.3-docs-8.3.18-0.1mdvmes5.2.x86_64.rpm
 a267c66e17c77f7ae0f970cd6675116b  mes5/x86_64/postgresql8.3-pl-8.3.18-0.1mdvmes5.2.x86_64.rpm
 11eb9ebb0342cf0106b90c6e0320ce16  mes5/x86_64/postgresql8.3-plperl-8.3.18-0.1mdvmes5.2.x86_64.rpm
 d4cbc6c7bb58c11accbfc2f0c62119d3  mes5/x86_64/postgresql8.3-plpgsql-8.3.18-0.1mdvmes5.2.x86_64.rpm
 06b523e852e2b9938d39ead100f85aa9  mes5/x86_64/postgresql8.3-plpython-8.3.18-0.1mdvmes5.2.x86_64.rpm
 412ae74a1291b6a4684115c0bf351557  mes5/x86_64/postgresql8.3-pltcl-8.3.18-0.1mdvmes5.2.x86_64.rpm
 ec6945403a50732a1823d1fa6974735c  mes5/x86_64/postgresql8.3-server-8.3.18-0.1mdvmes5.2.x86_64.rpm 
 e2eb79399056d7bd7fe4cac74dd39b5b  mes5/SRPMS/postgresql8.3-8.3.18-0.1mdvmes5.2.src.rpm
 _______________________________________________________________________

 To upgrade automatically use MandrivaUpdate or urpmi.  The verification
 of md5 checksums and GPG signatures is performed automatically for you.

 All packages are signed by Mandriva for security.  You can obtain the
 GPG public key of the Mandriva Security Team by executing:

  gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

 You can view other update advisories for Mandriva Linux at:

  http://www.mandriva.com/security/advisories

 If you want to report vulnerabilities, please contact

  security_(at)_mandriva.com
 _______________________________________________________________________

 Type Bits/KeyID     Date       User ID
 pub  1024D/22458A98 2000-07-10 Mandriva Security Team
  <security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)

iD8DBQFPTh//mqjQ0CJFipgRAkt4AJ9SwW7Gd5Nyo1Te18e4WgLuQTNpIwCfQ48u
XyLPCKk0rQ5LHeqlZSRbHuA=
=9MPa
-----END PGP SIGNATURE-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/