Login | Register For Free | Help
Search for: (Advanced)

Mailing List Archive: Full Disclosure: Full-Disclosure

[ MDVSA-2012:027 ] postgresql8.3

 

 

Full Disclosure full-disclosure RSS feed   Index | Next | Previous | View Threaded


security at mandriva

Feb 29, 2012, 8:00 AM

Post #1 of 1 (236 views)
Permalink
[ MDVSA-2012:027 ] postgresql8.3

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

_______________________________________________________________________

Mandriva Linux Security Advisory MDVSA-2012:027
http://www.mandriva.com/security/
_______________________________________________________________________

Package : postgresql8.3
Date : February 29, 2012
Affected: Enterprise Server 5.0
_______________________________________________________________________

Problem Description:

Multiple vulnerabilities has been discovered and corrected in
postgresql:

Permissions on a function called by a trigger are not properly checked
(CVE-2012-0866).

Line breaks in object names can be exploited to execute arbitrary
SQL when reloading a pg_dump file (CVE-2012-0868).

This advisory provides the latest version of PostgreSQL that is not
vulnerable to these issues.
_______________________________________________________________________

References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0866
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0868
http://www.postgresql.org/docs/8.3/static/release-8-3-18.html
_______________________________________________________________________

Updated Packages:

Mandriva Enterprise Server 5:
70516f4a8393dc8e20def2f1a2462221 mes5/i586/libecpg8.3_6-8.3.18-0.1mdvmes5.2.i586.rpm
1348530066e2c20f69fb20597016cd59 mes5/i586/libpq8.3_5-8.3.18-0.1mdvmes5.2.i586.rpm
2913c5253b14ee9693a56de326aef908 mes5/i586/postgresql8.3-8.3.18-0.1mdvmes5.2.i586.rpm
def833bca0e5b4f5ecfefb9b8ac7c70e mes5/i586/postgresql8.3-contrib-8.3.18-0.1mdvmes5.2.i586.rpm
b43a09ab67757ba151aa00070c48657f mes5/i586/postgresql8.3-devel-8.3.18-0.1mdvmes5.2.i586.rpm
5ca9f707e5949501f4e83244d191312a mes5/i586/postgresql8.3-docs-8.3.18-0.1mdvmes5.2.i586.rpm
b6eaded77ff8cafb2908b28ce16cd53f mes5/i586/postgresql8.3-pl-8.3.18-0.1mdvmes5.2.i586.rpm
4aac998ffd953e60e670c9bf5655919e mes5/i586/postgresql8.3-plperl-8.3.18-0.1mdvmes5.2.i586.rpm
f72237aa1bc703a5ac388d6a868994ce mes5/i586/postgresql8.3-plpgsql-8.3.18-0.1mdvmes5.2.i586.rpm
b574999678236b55ff63c9d1bd187fd1 mes5/i586/postgresql8.3-plpython-8.3.18-0.1mdvmes5.2.i586.rpm
61cca3e61d15c51c81d10018145d87e4 mes5/i586/postgresql8.3-pltcl-8.3.18-0.1mdvmes5.2.i586.rpm
841d4c560acd2f3124506a2dda11f61a mes5/i586/postgresql8.3-server-8.3.18-0.1mdvmes5.2.i586.rpm
e2eb79399056d7bd7fe4cac74dd39b5b mes5/SRPMS/postgresql8.3-8.3.18-0.1mdvmes5.2.src.rpm

Mandriva Enterprise Server 5/X86_64:
b9218c66711faa5fe9d0f2a75a56f641 mes5/x86_64/lib64ecpg8.3_6-8.3.18-0.1mdvmes5.2.x86_64.rpm
ea479cdd2007427c84e83e8b7c76edac mes5/x86_64/lib64pq8.3_5-8.3.18-0.1mdvmes5.2.x86_64.rpm
609ef28cc049852b270a47b0c28b5b4e mes5/x86_64/postgresql8.3-8.3.18-0.1mdvmes5.2.x86_64.rpm
82a498d8e4d685aede175f6adde68dd8 mes5/x86_64/postgresql8.3-contrib-8.3.18-0.1mdvmes5.2.x86_64.rpm
c5c9e0960552b750973d7ed6b8d66c80 mes5/x86_64/postgresql8.3-devel-8.3.18-0.1mdvmes5.2.x86_64.rpm
20fd300c66cca64191b8565b97341c3e mes5/x86_64/postgresql8.3-docs-8.3.18-0.1mdvmes5.2.x86_64.rpm
a267c66e17c77f7ae0f970cd6675116b mes5/x86_64/postgresql8.3-pl-8.3.18-0.1mdvmes5.2.x86_64.rpm
11eb9ebb0342cf0106b90c6e0320ce16 mes5/x86_64/postgresql8.3-plperl-8.3.18-0.1mdvmes5.2.x86_64.rpm
d4cbc6c7bb58c11accbfc2f0c62119d3 mes5/x86_64/postgresql8.3-plpgsql-8.3.18-0.1mdvmes5.2.x86_64.rpm
06b523e852e2b9938d39ead100f85aa9 mes5/x86_64/postgresql8.3-plpython-8.3.18-0.1mdvmes5.2.x86_64.rpm
412ae74a1291b6a4684115c0bf351557 mes5/x86_64/postgresql8.3-pltcl-8.3.18-0.1mdvmes5.2.x86_64.rpm
ec6945403a50732a1823d1fa6974735c mes5/x86_64/postgresql8.3-server-8.3.18-0.1mdvmes5.2.x86_64.rpm
e2eb79399056d7bd7fe4cac74dd39b5b mes5/SRPMS/postgresql8.3-8.3.18-0.1mdvmes5.2.src.rpm
_______________________________________________________________________

To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.

All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:

gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

You can view other update advisories for Mandriva Linux at:

http://www.mandriva.com/security/advisories

If you want to report vulnerabilities, please contact

security_(at)_mandriva.com
_______________________________________________________________________

Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)

iD8DBQFPTh//mqjQ0CJFipgRAkt4AJ9SwW7Gd5Nyo1Te18e4WgLuQTNpIwCfQ48u
XyLPCKk0rQ5LHeqlZSRbHuA=
=9MPa
-----END PGP SIGNATURE-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Full Disclosure full-disclosure RSS feed   Index | Next | Previous | View Threaded
 
 


Interested in having your list archived? Contact Gossamer Threads
 
  Web Applications & Managed Hosting Powered by Gossamer Threads Inc.