[Pkg-postgresql-public] postgresql-9.1_9.1.12-0wheezy1~bpo60+1_amd64.changes ACCEPTED into squeeze-backports->backports-policy

Debian FTP Masters ftpmaster at ftp-master.debian.org
Mon Feb 24 15:40:54 UTC 2014


Hash: SHA256

Format: 1.8
Date: Mon, 24 Feb 2014 14:32:57 +0100
Source: postgresql-9.1
Binary: libpq-dev libpq5 libecpg6 libecpg-dev libecpg-compat3 libpgtypes3 postgresql-9.1 postgresql-9.1-dbg postgresql-client-9.1 postgresql-server-dev-9.1 postgresql-doc-9.1 postgresql-contrib-9.1 postgresql-plperl-9.1 postgresql-plpython-9.1 postgresql-plpython3-9.1 postgresql-pltcl-9.1
Architecture: source amd64 all
Version: 9.1.12-0wheezy1~bpo60+1
Distribution: squeeze-backports
Urgency: high
Maintainer: Debian PostgreSQL Maintainers <pkg-postgresql-public at lists.alioth.debian.org>
Changed-By: Christoph Berg <christoph.berg at credativ.de>
 libecpg-compat3 - older version of run-time library for ECPG programs
 libecpg-dev - development files for ECPG (Embedded PostgreSQL for C)
 libecpg6   - run-time library for ECPG programs
 libpgtypes3 - shared library libpgtypes for PostgreSQL 9.1
 libpq-dev  - header files for libpq5 (PostgreSQL library)
 libpq5     - PostgreSQL C client library
 postgresql-9.1 - object-relational SQL database, version 9.1 server
 postgresql-9.1-dbg - debug symbols for postgresql-9.1
 postgresql-client-9.1 - front-end programs for PostgreSQL 9.1
 postgresql-contrib-9.1 - additional facilities for PostgreSQL
 postgresql-doc-9.1 - documentation for the PostgreSQL database management system
 postgresql-plperl-9.1 - PL/Perl procedural language for PostgreSQL 9.1
 postgresql-plpython-9.1 - PL/Python procedural language for PostgreSQL 9.1
 postgresql-plpython3-9.1 - PL/Python 3 procedural language for PostgreSQL 9.1
 postgresql-pltcl-9.1 - PL/Tcl procedural language for PostgreSQL 9.1
 postgresql-server-dev-9.1 - development files for PostgreSQL 9.1 server-side programming
 postgresql-9.1 (9.1.12-0wheezy1~bpo60+1) squeeze-backports; urgency=high
   * Rebuild for squeeze-backports.
 postgresql-9.1 (9.1.12-0wheezy1) wheezy-security; urgency=high
   * New upstream security/bugfix release.
     + Shore up GRANT ... WITH ADMIN OPTION restrictions (Noah Misch)
       Granting a role without ADMIN OPTION is supposed to prevent the grantee
       from adding or removing members from the granted role, but this
       restriction was easily bypassed by doing SET ROLE first. The security
       impact is mostly that a role member can revoke the access of others,
       contrary to the wishes of his grantor. Unapproved role member additions
       are a lesser concern, since an uncooperative role member could provide
       most of his rights to others anyway by creating views or SECURITY
       DEFINER functions. (CVE-2014-0060)
     + Prevent privilege escalation via manual calls to PL validator functions
       (Andres Freund)
       The primary role of PL validator functions is to be called implicitly
       during CREATE FUNCTION, but they are also normal SQL functions that a
       user can call explicitly. Calling a validator on a function actually
       written in some other language was not checked for and could be
       exploited for privilege-escalation purposes. The fix involves adding a
       call to a privilege-checking function in each validator function.
       Non-core procedural languages will also need to make this change to
       their own validator functions, if any. (CVE-2014-0061)
     + Avoid multiple name lookups during table and index DDL (Robert Haas,
       Andres Freund)
       If the name lookups come to different conclusions due to concurrent
       activity, we might perform some parts of the DDL on a different table
       than other parts. At least in the case of CREATE INDEX, this can be used
       to cause the permissions checks to be performed against a different
       table than the index creation, allowing for a privilege escalation
       attack. (CVE-2014-0062)
     + Prevent buffer overrun with long datetime strings (Noah Misch)
       The MAXDATELEN constant was too small for the longest possible value of
       type interval, allowing a buffer overrun in interval_out(). Although the
       datetime input functions were more careful about avoiding buffer
       overrun, the limit was short enough to cause them to reject some valid
       inputs, such as input containing a very long timezone name. The ecpg
       library contained these vulnerabilities along with some of its own.
     + Prevent buffer overrun due to integer overflow in size calculations
       (Noah Misch, Heikki Linnakangas)
       Several functions, mostly type input functions, calculated an allocation
       size without checking for overflow. If overflow did occur, a too-small
       buffer would be allocated and then written past. (CVE-2014-0064)
     + Prevent overruns of fixed-size buffers (Peter Eisentraut, Jozef Mlich)
       Use strlcpy() and related functions to provide a clear guarantee that
       fixed-size buffers are not overrun. Unlike the preceding items, it is
       unclear whether these cases really represent live issues, since in most
       cases there appear to be previous constraints on the size of the input
       string. Nonetheless it seems prudent to silence all Coverity warnings of
       this type. (CVE-2014-0065)
     + Avoid crashing if crypt() returns NULL (Honza Horak, Bruce Momjian)
       There are relatively few scenarios in which crypt() could return NULL,
       but contrib/chkpass would crash if it did. One practical case in which
       this could be an issue is if libc is configured to refuse to execute
       unapproved hashing algorithms (e.g., "FIPS mode"). (CVE-2014-0066)
     + Document risks of make check in the regression testing instructions
       (Noah Misch, Tom Lane)
       Since the temporary server started by make check uses "trust"
       authentication, another user on the same machine could connect to it as
       database superuser, and then potentially exploit the privileges of the
       operating-system user who started the tests. A future release will
       probably incorporate changes in the testing procedure to prevent this
       risk, but some public discussion is needed first. So for the moment,
       just warn people against using make check when there are untrusted users
       on the same machine. (CVE-2014-0067)
   * The upstream tarballs no longer contain a plain HISTORY file, but point to
     the html documentation. Note the location of these files in our
     changelog.gz file.
 postgresql-9.1 (9.1.11-0wheezy1) stable; urgency=low
   * New upstream bug fix release:
     - Fix "VACUUM"'s tests to see whether it can update relfrozenxid
       In some cases "VACUUM" (either manual or autovacuum) could
       incorrectly advance a table's relfrozenxid value, allowing tuples
       to escape freezing, causing those rows to become invisible once
       2^31 transactions have elapsed. The probability of data loss is
       fairly low since multiple incorrect advancements would need to
       happen before actual loss occurs, but it's not zero. Users
       upgrading from releases 9.0.4 or 8.4.8 or earlier are not affected,
       but all later versions contain the bug.
       The issue can be ameliorated by, after upgrading, vacuuming all
       tables in all databases while having vacuum_freeze_table_age set to
       zero. This will fix any latent corruption but will not be able to
       fix all pre-existing data errors. However, an installation can be
       presumed safe after performing this vacuuming if it has executed
       fewer than 2^31 update transactions in its lifetime (check this
       with SELECT txid_current() < 2^31).
     - Fix initialization of "pg_clog" and "pg_subtrans" during hot
       standby startup
       This bug can cause data loss on standby servers at the moment they
       start to accept hot-standby queries, by marking committed
       transactions as uncommitted. The likelihood of such corruption is
       small unless, at the time of standby startup, the primary server
       has executed many updating transactions since its last checkpoint.
       Symptoms include missing rows, rows that should have been deleted
       being still visible, and obsolete versions of updated rows being
       still visible alongside their newer versions.
       This bug was introduced in versions 9.3.0, 9.2.5, 9.1.10, and
       9.0.14. Standby servers that have only been running earlier
       releases are not at risk. It's recommended that standby servers
       that have ever run any of the buggy releases be re-cloned from the
       primary (e.g., with a new base backup) after upgrading.
     - See HISTORY/changelog.gz for details about other bug fixes.
 postgresql-9.1 (9.1.10-0wheezy1) stable; urgency=low
   * New upstream bug fix release. See HISTORY/changelog.gz for details.
     (No security or critical issues this time.)
 011b2803f47b7daaa7d799121bce9ae2ba94092f 3369 postgresql-9.1_9.1.12-0wheezy1~bpo60+1.dsc
 aaf9097de94a03a4136d36704c48be539c5734ac 15638909 postgresql-9.1_9.1.12.orig.tar.bz2
 a5b2a6d4c3cb53070eae08aeea8775d623940785 40428 postgresql-9.1_9.1.12-0wheezy1~bpo60+1.debian.tar.gz
 64720e1564ea3e10cb8b785ca1222502444745ad 192544 libpq-dev_9.1.12-0wheezy1~bpo60+1_amd64.deb
 51b7d082158b81e278f5f58ba7ad7bf0a752bdb3 137176 libpq5_9.1.12-0wheezy1~bpo60+1_amd64.deb
 98305c67a94da9fa02e36c7d9698a02b595e3b14 93938 libecpg6_9.1.12-0wheezy1~bpo60+1_amd64.deb
 11ada6fd862cd7f005dfb71ea57e24ccc1dda0b5 226256 libecpg-dev_9.1.12-0wheezy1~bpo60+1_amd64.deb
 a3a050ab7be1c4c85cd42ef0b5fd20f633f22255 31712 libecpg-compat3_9.1.12-0wheezy1~bpo60+1_amd64.deb
 96e7ed244a42f33f47134df35a14b407759031ff 53140 libpgtypes3_9.1.12-0wheezy1~bpo60+1_amd64.deb
 77b859c1b81e4b9670c65279f63c2e434662af98 3260902 postgresql-9.1_9.1.12-0wheezy1~bpo60+1_amd64.deb
 cbfbd2ea99f862c50c8e5004273effe734e98add 4478540 postgresql-9.1-dbg_9.1.12-0wheezy1~bpo60+1_amd64.deb
 9f0f5fb4dad3c8e8ece12971f6deb544be2996d1 996606 postgresql-client-9.1_9.1.12-0wheezy1~bpo60+1_amd64.deb
 3ab31ef22b661157538fe32414c73994a4185797 552064 postgresql-server-dev-9.1_9.1.12-0wheezy1~bpo60+1_amd64.deb
 a5f2f0c44257bb0354280332e56369c0efe39bb5 1625082 postgresql-doc-9.1_9.1.12-0wheezy1~bpo60+1_all.deb
 eb3688716106b6550f0b1d0cdc0273b46dc21aaa 360712 postgresql-contrib-9.1_9.1.12-0wheezy1~bpo60+1_amd64.deb
 46d358af7813648e8835ae26a47a0f501ea13491 71424 postgresql-plperl-9.1_9.1.12-0wheezy1~bpo60+1_amd64.deb
 69f747a550bff5832a64ca4e1337113fab183e72 56588 postgresql-plpython-9.1_9.1.12-0wheezy1~bpo60+1_amd64.deb
 ff4ee8dbf6d5ea2dfa6501663392f12f03d507ab 56350 postgresql-plpython3-9.1_9.1.12-0wheezy1~bpo60+1_amd64.deb
 597d96fab706aca187c93c3d650d55d4e3162455 46546 postgresql-pltcl-9.1_9.1.12-0wheezy1~bpo60+1_amd64.deb
 44c3974ca6e29a9d97ba34902c838b257bfd7d6ac3d56f4f51afd66d8acb8e44 3369 postgresql-9.1_9.1.12-0wheezy1~bpo60+1.dsc
 0b267ebab5feb39ad6ef945b9588787886e7f7e5284467921d18cc7b76bcb383 15638909 postgresql-9.1_9.1.12.orig.tar.bz2
 c70bd91397698c6a6ca4971c5e2519156ea2c75b79fb39488a8d3766927e0b6e 40428 postgresql-9.1_9.1.12-0wheezy1~bpo60+1.debian.tar.gz
 a2e05cec14edc088a4582b1167dc234a1a98a3c8cf510db55fe2f2af6fdb65c6 192544 libpq-dev_9.1.12-0wheezy1~bpo60+1_amd64.deb
 0fc5f00284a1ee857b4fb4d2539fc8cdb61aa015a4d07f0310579e3603140301 137176 libpq5_9.1.12-0wheezy1~bpo60+1_amd64.deb
 de927587441384d9f2a7b54a2dfb97522a38b8e4b9432c8ecd90d0e4fe9fca08 93938 libecpg6_9.1.12-0wheezy1~bpo60+1_amd64.deb
 c70ce463ab11f6e6de16ae5ede5d269b1de351106d248a601823289856e9fe65 226256 libecpg-dev_9.1.12-0wheezy1~bpo60+1_amd64.deb
 ad0ea4f6a707fa242b606be44a903353457f2c97209b08bb07147f9c9346d9c1 31712 libecpg-compat3_9.1.12-0wheezy1~bpo60+1_amd64.deb
 6fa1e939617b47b6fdc05a5f8116bc3f46eeb1194aafa9cf10392074909f67ff 53140 libpgtypes3_9.1.12-0wheezy1~bpo60+1_amd64.deb
 1a5968043ad14d5a8af555f955e92c735ab2d1c6cb11d280439c5947ef83bdce 3260902 postgresql-9.1_9.1.12-0wheezy1~bpo60+1_amd64.deb
 e1fdd064b68256083229fc8376531a878c3ed384fdefdbae29bc5d2dbbec2f39 4478540 postgresql-9.1-dbg_9.1.12-0wheezy1~bpo60+1_amd64.deb
 359780d20431c277187c5b588dbcbebb44e1074be16a60f47d9480dbce0eaccd 996606 postgresql-client-9.1_9.1.12-0wheezy1~bpo60+1_amd64.deb
 d7cb17ce38d57defb9b15da3f66f874196b2bd20e609e664f46b806e5cb96934 552064 postgresql-server-dev-9.1_9.1.12-0wheezy1~bpo60+1_amd64.deb
 d495d7b44e5e32490aaddd9b56096ba71b2e021f3a66c1db25e5dd984d1b5717 1625082 postgresql-doc-9.1_9.1.12-0wheezy1~bpo60+1_all.deb
 384ab84b7f5ae48904caeaa1033dd2a63d81a00af2d1ba5fd066514509c28f25 360712 postgresql-contrib-9.1_9.1.12-0wheezy1~bpo60+1_amd64.deb
 e7e60f63d2e6aa7991e4346ac0ed35d5cf0e72f29236bbea8b22086bf7b02e7e 71424 postgresql-plperl-9.1_9.1.12-0wheezy1~bpo60+1_amd64.deb
 28c345711a789310d15e3932de88d7e1563162055a5b2c0a7d82c2b04508b7a2 56588 postgresql-plpython-9.1_9.1.12-0wheezy1~bpo60+1_amd64.deb
 a7a45862ba43214447544d39d5c109d882e09fd97129b6af0ab6495719627027 56350 postgresql-plpython3-9.1_9.1.12-0wheezy1~bpo60+1_amd64.deb
 0219ae879dd294d2d49bdf55a7282d7b3691e7f07441c7cc513d1165529978c6 46546 postgresql-pltcl-9.1_9.1.12-0wheezy1~bpo60+1_amd64.deb
 5b837a72d4f8e1d7d8d983a57673ad72 3369 database optional postgresql-9.1_9.1.12-0wheezy1~bpo60+1.dsc
 a14eb8a602af44f1827a9ecf928e7b44 15638909 database optional postgresql-9.1_9.1.12.orig.tar.bz2
 2fd42889285532f3ed88b8266395e6d2 40428 database optional postgresql-9.1_9.1.12-0wheezy1~bpo60+1.debian.tar.gz
 d7c9a74c1d5b3333749139e193b4bc13 192544 libdevel optional libpq-dev_9.1.12-0wheezy1~bpo60+1_amd64.deb
 068859e93cacbc46768f997e0bd655f3 137176 libs optional libpq5_9.1.12-0wheezy1~bpo60+1_amd64.deb
 ce05ce0dff16c390d9413636cd73406b 93938 libs optional libecpg6_9.1.12-0wheezy1~bpo60+1_amd64.deb
 c044105a73eebea9f8947e033a51d50c 226256 libdevel optional libecpg-dev_9.1.12-0wheezy1~bpo60+1_amd64.deb
 2c9d5f3aa6a5b0dec1e6c0e898196ee5 31712 libs optional libecpg-compat3_9.1.12-0wheezy1~bpo60+1_amd64.deb
 7f3cf22e0ac053c2ecd449af2b72908b 53140 libs optional libpgtypes3_9.1.12-0wheezy1~bpo60+1_amd64.deb
 2bfccdf1424c87324e2d1af05cb43862 3260902 database optional postgresql-9.1_9.1.12-0wheezy1~bpo60+1_amd64.deb
 b6d63b3d7b060d4092274eaf065e62de 4478540 debug extra postgresql-9.1-dbg_9.1.12-0wheezy1~bpo60+1_amd64.deb
 be3b7d5b04bbeea2724876bcaed9466e 996606 database optional postgresql-client-9.1_9.1.12-0wheezy1~bpo60+1_amd64.deb
 8083614fb14168f0d63551f55dd9dde9 552064 libdevel optional postgresql-server-dev-9.1_9.1.12-0wheezy1~bpo60+1_amd64.deb
 8c366da6c243b33333b4a391279409aa 1625082 doc optional postgresql-doc-9.1_9.1.12-0wheezy1~bpo60+1_all.deb
 367eb8637f4ef06fa17145d7520674e5 360712 database optional postgresql-contrib-9.1_9.1.12-0wheezy1~bpo60+1_amd64.deb
 77e36f0deee4835bde08da096a9ad5c2 71424 database optional postgresql-plperl-9.1_9.1.12-0wheezy1~bpo60+1_amd64.deb
 1fd2ab672ac4c5e64e3243f7fe9d031e 56588 database optional postgresql-plpython-9.1_9.1.12-0wheezy1~bpo60+1_amd64.deb
 e50139faa4f54bbb61fb4421c55f0a30 56350 database optional postgresql-plpython3-9.1_9.1.12-0wheezy1~bpo60+1_amd64.deb
 6e2519c8bb2876087c52739fb951567c 46546 database optional postgresql-pltcl-9.1_9.1.12-0wheezy1~bpo60+1_amd64.deb

Version: GnuPG v1


Thank you for your contribution to Debian.

More information about the Pkg-postgresql-public mailing list