[Pkg-postgresql-public] postgresql-9.1_9.1.12-0wheezy1~bpo60+1_amd64.changes ACCEPTED into squeeze-backports->backports-policy
Debian FTP Masters
ftpmaster at ftp-master.debian.org
Mon Feb 24 15:40:54 UTC 2014
Accepted:
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Format: 1.8
Date: Mon, 24 Feb 2014 14:32:57 +0100
Source: postgresql-9.1
Binary: libpq-dev libpq5 libecpg6 libecpg-dev libecpg-compat3 libpgtypes3 postgresql-9.1 postgresql-9.1-dbg postgresql-client-9.1 postgresql-server-dev-9.1 postgresql-doc-9.1 postgresql-contrib-9.1 postgresql-plperl-9.1 postgresql-plpython-9.1 postgresql-plpython3-9.1 postgresql-pltcl-9.1
Architecture: source amd64 all
Version: 9.1.12-0wheezy1~bpo60+1
Distribution: squeeze-backports
Urgency: high
Maintainer: Debian PostgreSQL Maintainers <pkg-postgresql-public at lists.alioth.debian.org>
Changed-By: Christoph Berg <christoph.berg at credativ.de>
Description:
libecpg-compat3 - older version of run-time library for ECPG programs
libecpg-dev - development files for ECPG (Embedded PostgreSQL for C)
libecpg6 - run-time library for ECPG programs
libpgtypes3 - shared library libpgtypes for PostgreSQL 9.1
libpq-dev - header files for libpq5 (PostgreSQL library)
libpq5 - PostgreSQL C client library
postgresql-9.1 - object-relational SQL database, version 9.1 server
postgresql-9.1-dbg - debug symbols for postgresql-9.1
postgresql-client-9.1 - front-end programs for PostgreSQL 9.1
postgresql-contrib-9.1 - additional facilities for PostgreSQL
postgresql-doc-9.1 - documentation for the PostgreSQL database management system
postgresql-plperl-9.1 - PL/Perl procedural language for PostgreSQL 9.1
postgresql-plpython-9.1 - PL/Python procedural language for PostgreSQL 9.1
postgresql-plpython3-9.1 - PL/Python 3 procedural language for PostgreSQL 9.1
postgresql-pltcl-9.1 - PL/Tcl procedural language for PostgreSQL 9.1
postgresql-server-dev-9.1 - development files for PostgreSQL 9.1 server-side programming
Changes:
postgresql-9.1 (9.1.12-0wheezy1~bpo60+1) squeeze-backports; urgency=high
.
* Rebuild for squeeze-backports.
.
postgresql-9.1 (9.1.12-0wheezy1) wheezy-security; urgency=high
.
* New upstream security/bugfix release.
.
+ Shore up GRANT ... WITH ADMIN OPTION restrictions (Noah Misch)
.
Granting a role without ADMIN OPTION is supposed to prevent the grantee
from adding or removing members from the granted role, but this
restriction was easily bypassed by doing SET ROLE first. The security
impact is mostly that a role member can revoke the access of others,
contrary to the wishes of his grantor. Unapproved role member additions
are a lesser concern, since an uncooperative role member could provide
most of his rights to others anyway by creating views or SECURITY
DEFINER functions. (CVE-2014-0060)
.
+ Prevent privilege escalation via manual calls to PL validator functions
(Andres Freund)
.
The primary role of PL validator functions is to be called implicitly
during CREATE FUNCTION, but they are also normal SQL functions that a
user can call explicitly. Calling a validator on a function actually
written in some other language was not checked for and could be
exploited for privilege-escalation purposes. The fix involves adding a
call to a privilege-checking function in each validator function.
Non-core procedural languages will also need to make this change to
their own validator functions, if any. (CVE-2014-0061)
.
+ Avoid multiple name lookups during table and index DDL (Robert Haas,
Andres Freund)
.
If the name lookups come to different conclusions due to concurrent
activity, we might perform some parts of the DDL on a different table
than other parts. At least in the case of CREATE INDEX, this can be used
to cause the permissions checks to be performed against a different
table than the index creation, allowing for a privilege escalation
attack. (CVE-2014-0062)
.
+ Prevent buffer overrun with long datetime strings (Noah Misch)
.
The MAXDATELEN constant was too small for the longest possible value of
type interval, allowing a buffer overrun in interval_out(). Although the
datetime input functions were more careful about avoiding buffer
overrun, the limit was short enough to cause them to reject some valid
inputs, such as input containing a very long timezone name. The ecpg
library contained these vulnerabilities along with some of its own.
(CVE-2014-0063)
.
+ Prevent buffer overrun due to integer overflow in size calculations
(Noah Misch, Heikki Linnakangas)
.
Several functions, mostly type input functions, calculated an allocation
size without checking for overflow. If overflow did occur, a too-small
buffer would be allocated and then written past. (CVE-2014-0064)
.
+ Prevent overruns of fixed-size buffers (Peter Eisentraut, Jozef Mlich)
.
Use strlcpy() and related functions to provide a clear guarantee that
fixed-size buffers are not overrun. Unlike the preceding items, it is
unclear whether these cases really represent live issues, since in most
cases there appear to be previous constraints on the size of the input
string. Nonetheless it seems prudent to silence all Coverity warnings of
this type. (CVE-2014-0065)
.
+ Avoid crashing if crypt() returns NULL (Honza Horak, Bruce Momjian)
.
There are relatively few scenarios in which crypt() could return NULL,
but contrib/chkpass would crash if it did. One practical case in which
this could be an issue is if libc is configured to refuse to execute
unapproved hashing algorithms (e.g., "FIPS mode"). (CVE-2014-0066)
.
+ Document risks of make check in the regression testing instructions
(Noah Misch, Tom Lane)
.
Since the temporary server started by make check uses "trust"
authentication, another user on the same machine could connect to it as
database superuser, and then potentially exploit the privileges of the
operating-system user who started the tests. A future release will
probably incorporate changes in the testing procedure to prevent this
risk, but some public discussion is needed first. So for the moment,
just warn people against using make check when there are untrusted users
on the same machine. (CVE-2014-0067)
.
* The upstream tarballs no longer contain a plain HISTORY file, but point to
the html documentation. Note the location of these files in our
changelog.gz file.
.
postgresql-9.1 (9.1.11-0wheezy1) stable; urgency=low
.
* New upstream bug fix release:
- Fix "VACUUM"'s tests to see whether it can update relfrozenxid
In some cases "VACUUM" (either manual or autovacuum) could
incorrectly advance a table's relfrozenxid value, allowing tuples
to escape freezing, causing those rows to become invisible once
2^31 transactions have elapsed. The probability of data loss is
fairly low since multiple incorrect advancements would need to
happen before actual loss occurs, but it's not zero. Users
upgrading from releases 9.0.4 or 8.4.8 or earlier are not affected,
but all later versions contain the bug.
The issue can be ameliorated by, after upgrading, vacuuming all
tables in all databases while having vacuum_freeze_table_age set to
zero. This will fix any latent corruption but will not be able to
fix all pre-existing data errors. However, an installation can be
presumed safe after performing this vacuuming if it has executed
fewer than 2^31 update transactions in its lifetime (check this
with SELECT txid_current() < 2^31).
.
- Fix initialization of "pg_clog" and "pg_subtrans" during hot
standby startup
This bug can cause data loss on standby servers at the moment they
start to accept hot-standby queries, by marking committed
transactions as uncommitted. The likelihood of such corruption is
small unless, at the time of standby startup, the primary server
has executed many updating transactions since its last checkpoint.
Symptoms include missing rows, rows that should have been deleted
being still visible, and obsolete versions of updated rows being
still visible alongside their newer versions.
This bug was introduced in versions 9.3.0, 9.2.5, 9.1.10, and
9.0.14. Standby servers that have only been running earlier
releases are not at risk. It's recommended that standby servers
that have ever run any of the buggy releases be re-cloned from the
primary (e.g., with a new base backup) after upgrading.
.
- See HISTORY/changelog.gz for details about other bug fixes.
.
postgresql-9.1 (9.1.10-0wheezy1) stable; urgency=low
.
* New upstream bug fix release. See HISTORY/changelog.gz for details.
(No security or critical issues this time.)
Checksums-Sha1:
011b2803f47b7daaa7d799121bce9ae2ba94092f 3369 postgresql-9.1_9.1.12-0wheezy1~bpo60+1.dsc
aaf9097de94a03a4136d36704c48be539c5734ac 15638909 postgresql-9.1_9.1.12.orig.tar.bz2
a5b2a6d4c3cb53070eae08aeea8775d623940785 40428 postgresql-9.1_9.1.12-0wheezy1~bpo60+1.debian.tar.gz
64720e1564ea3e10cb8b785ca1222502444745ad 192544 libpq-dev_9.1.12-0wheezy1~bpo60+1_amd64.deb
51b7d082158b81e278f5f58ba7ad7bf0a752bdb3 137176 libpq5_9.1.12-0wheezy1~bpo60+1_amd64.deb
98305c67a94da9fa02e36c7d9698a02b595e3b14 93938 libecpg6_9.1.12-0wheezy1~bpo60+1_amd64.deb
11ada6fd862cd7f005dfb71ea57e24ccc1dda0b5 226256 libecpg-dev_9.1.12-0wheezy1~bpo60+1_amd64.deb
a3a050ab7be1c4c85cd42ef0b5fd20f633f22255 31712 libecpg-compat3_9.1.12-0wheezy1~bpo60+1_amd64.deb
96e7ed244a42f33f47134df35a14b407759031ff 53140 libpgtypes3_9.1.12-0wheezy1~bpo60+1_amd64.deb
77b859c1b81e4b9670c65279f63c2e434662af98 3260902 postgresql-9.1_9.1.12-0wheezy1~bpo60+1_amd64.deb
cbfbd2ea99f862c50c8e5004273effe734e98add 4478540 postgresql-9.1-dbg_9.1.12-0wheezy1~bpo60+1_amd64.deb
9f0f5fb4dad3c8e8ece12971f6deb544be2996d1 996606 postgresql-client-9.1_9.1.12-0wheezy1~bpo60+1_amd64.deb
3ab31ef22b661157538fe32414c73994a4185797 552064 postgresql-server-dev-9.1_9.1.12-0wheezy1~bpo60+1_amd64.deb
a5f2f0c44257bb0354280332e56369c0efe39bb5 1625082 postgresql-doc-9.1_9.1.12-0wheezy1~bpo60+1_all.deb
eb3688716106b6550f0b1d0cdc0273b46dc21aaa 360712 postgresql-contrib-9.1_9.1.12-0wheezy1~bpo60+1_amd64.deb
46d358af7813648e8835ae26a47a0f501ea13491 71424 postgresql-plperl-9.1_9.1.12-0wheezy1~bpo60+1_amd64.deb
69f747a550bff5832a64ca4e1337113fab183e72 56588 postgresql-plpython-9.1_9.1.12-0wheezy1~bpo60+1_amd64.deb
ff4ee8dbf6d5ea2dfa6501663392f12f03d507ab 56350 postgresql-plpython3-9.1_9.1.12-0wheezy1~bpo60+1_amd64.deb
597d96fab706aca187c93c3d650d55d4e3162455 46546 postgresql-pltcl-9.1_9.1.12-0wheezy1~bpo60+1_amd64.deb
Checksums-Sha256:
44c3974ca6e29a9d97ba34902c838b257bfd7d6ac3d56f4f51afd66d8acb8e44 3369 postgresql-9.1_9.1.12-0wheezy1~bpo60+1.dsc
0b267ebab5feb39ad6ef945b9588787886e7f7e5284467921d18cc7b76bcb383 15638909 postgresql-9.1_9.1.12.orig.tar.bz2
c70bd91397698c6a6ca4971c5e2519156ea2c75b79fb39488a8d3766927e0b6e 40428 postgresql-9.1_9.1.12-0wheezy1~bpo60+1.debian.tar.gz
a2e05cec14edc088a4582b1167dc234a1a98a3c8cf510db55fe2f2af6fdb65c6 192544 libpq-dev_9.1.12-0wheezy1~bpo60+1_amd64.deb
0fc5f00284a1ee857b4fb4d2539fc8cdb61aa015a4d07f0310579e3603140301 137176 libpq5_9.1.12-0wheezy1~bpo60+1_amd64.deb
de927587441384d9f2a7b54a2dfb97522a38b8e4b9432c8ecd90d0e4fe9fca08 93938 libecpg6_9.1.12-0wheezy1~bpo60+1_amd64.deb
c70ce463ab11f6e6de16ae5ede5d269b1de351106d248a601823289856e9fe65 226256 libecpg-dev_9.1.12-0wheezy1~bpo60+1_amd64.deb
ad0ea4f6a707fa242b606be44a903353457f2c97209b08bb07147f9c9346d9c1 31712 libecpg-compat3_9.1.12-0wheezy1~bpo60+1_amd64.deb
6fa1e939617b47b6fdc05a5f8116bc3f46eeb1194aafa9cf10392074909f67ff 53140 libpgtypes3_9.1.12-0wheezy1~bpo60+1_amd64.deb
1a5968043ad14d5a8af555f955e92c735ab2d1c6cb11d280439c5947ef83bdce 3260902 postgresql-9.1_9.1.12-0wheezy1~bpo60+1_amd64.deb
e1fdd064b68256083229fc8376531a878c3ed384fdefdbae29bc5d2dbbec2f39 4478540 postgresql-9.1-dbg_9.1.12-0wheezy1~bpo60+1_amd64.deb
359780d20431c277187c5b588dbcbebb44e1074be16a60f47d9480dbce0eaccd 996606 postgresql-client-9.1_9.1.12-0wheezy1~bpo60+1_amd64.deb
d7cb17ce38d57defb9b15da3f66f874196b2bd20e609e664f46b806e5cb96934 552064 postgresql-server-dev-9.1_9.1.12-0wheezy1~bpo60+1_amd64.deb
d495d7b44e5e32490aaddd9b56096ba71b2e021f3a66c1db25e5dd984d1b5717 1625082 postgresql-doc-9.1_9.1.12-0wheezy1~bpo60+1_all.deb
384ab84b7f5ae48904caeaa1033dd2a63d81a00af2d1ba5fd066514509c28f25 360712 postgresql-contrib-9.1_9.1.12-0wheezy1~bpo60+1_amd64.deb
e7e60f63d2e6aa7991e4346ac0ed35d5cf0e72f29236bbea8b22086bf7b02e7e 71424 postgresql-plperl-9.1_9.1.12-0wheezy1~bpo60+1_amd64.deb
28c345711a789310d15e3932de88d7e1563162055a5b2c0a7d82c2b04508b7a2 56588 postgresql-plpython-9.1_9.1.12-0wheezy1~bpo60+1_amd64.deb
a7a45862ba43214447544d39d5c109d882e09fd97129b6af0ab6495719627027 56350 postgresql-plpython3-9.1_9.1.12-0wheezy1~bpo60+1_amd64.deb
0219ae879dd294d2d49bdf55a7282d7b3691e7f07441c7cc513d1165529978c6 46546 postgresql-pltcl-9.1_9.1.12-0wheezy1~bpo60+1_amd64.deb
Files:
5b837a72d4f8e1d7d8d983a57673ad72 3369 database optional postgresql-9.1_9.1.12-0wheezy1~bpo60+1.dsc
a14eb8a602af44f1827a9ecf928e7b44 15638909 database optional postgresql-9.1_9.1.12.orig.tar.bz2
2fd42889285532f3ed88b8266395e6d2 40428 database optional postgresql-9.1_9.1.12-0wheezy1~bpo60+1.debian.tar.gz
d7c9a74c1d5b3333749139e193b4bc13 192544 libdevel optional libpq-dev_9.1.12-0wheezy1~bpo60+1_amd64.deb
068859e93cacbc46768f997e0bd655f3 137176 libs optional libpq5_9.1.12-0wheezy1~bpo60+1_amd64.deb
ce05ce0dff16c390d9413636cd73406b 93938 libs optional libecpg6_9.1.12-0wheezy1~bpo60+1_amd64.deb
c044105a73eebea9f8947e033a51d50c 226256 libdevel optional libecpg-dev_9.1.12-0wheezy1~bpo60+1_amd64.deb
2c9d5f3aa6a5b0dec1e6c0e898196ee5 31712 libs optional libecpg-compat3_9.1.12-0wheezy1~bpo60+1_amd64.deb
7f3cf22e0ac053c2ecd449af2b72908b 53140 libs optional libpgtypes3_9.1.12-0wheezy1~bpo60+1_amd64.deb
2bfccdf1424c87324e2d1af05cb43862 3260902 database optional postgresql-9.1_9.1.12-0wheezy1~bpo60+1_amd64.deb
b6d63b3d7b060d4092274eaf065e62de 4478540 debug extra postgresql-9.1-dbg_9.1.12-0wheezy1~bpo60+1_amd64.deb
be3b7d5b04bbeea2724876bcaed9466e 996606 database optional postgresql-client-9.1_9.1.12-0wheezy1~bpo60+1_amd64.deb
8083614fb14168f0d63551f55dd9dde9 552064 libdevel optional postgresql-server-dev-9.1_9.1.12-0wheezy1~bpo60+1_amd64.deb
8c366da6c243b33333b4a391279409aa 1625082 doc optional postgresql-doc-9.1_9.1.12-0wheezy1~bpo60+1_all.deb
367eb8637f4ef06fa17145d7520674e5 360712 database optional postgresql-contrib-9.1_9.1.12-0wheezy1~bpo60+1_amd64.deb
77e36f0deee4835bde08da096a9ad5c2 71424 database optional postgresql-plperl-9.1_9.1.12-0wheezy1~bpo60+1_amd64.deb
1fd2ab672ac4c5e64e3243f7fe9d031e 56588 database optional postgresql-plpython-9.1_9.1.12-0wheezy1~bpo60+1_amd64.deb
e50139faa4f54bbb61fb4421c55f0a30 56350 database optional postgresql-plpython3-9.1_9.1.12-0wheezy1~bpo60+1_amd64.deb
6e2519c8bb2876087c52739fb951567c 46546 database optional postgresql-pltcl-9.1_9.1.12-0wheezy1~bpo60+1_amd64.deb
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIcBAEBCAAGBQJTC1aGAAoJEExaa6sS0qeuCKsQAJztZZOZxa+nQIKv01TG/4Fz
bZwV+XYihjM9hC32PO7wqUTV1hzc41kDovIY4vFzja0YazbfFYtOMmO2Hy/s3XDq
bAU3sK7VtLJ67E6RMwtvi6liXNeSm5EE0uaKt7XgtQTEKLSi65IVJPtaVUzOZzj/
ayBLlP2cakOg/alCxBZAgQa4TLN6gw+pc26e+5aAIcDsgfQX5/HHWj8n7Mkv0+QR
lC/lI+jmURSHO9gw0EhMZRMEinDBU42gcos/t8AksxDjN9liOMhUB57637rmf/G8
/ZwP7fG7+tr+Y1hp3Mj3VgRGr9Puq+OFEFhTlSvPwBGSW+LJXp9O1d3kVCVs+ywR
6MIYzeX906fkZl1yQiY1TysyYEW6ZkXwzK59eU4pJXzaF97DNSTy0zHiuKKAzhqQ
kbSFsQpzWd6ZurYxjrTt0LQ22CKSPGXDdFF+U7Y1N+jiyH957nCH0sq7aAlMQr0Y
eTafz8gZfvyCT2r6aneWKSMBaIpBKVAFiw0GXBydroTnW5cx+EOb6kFmlNLd9XwX
C1WMFdzLB68aabEkvDNWLMjkn/aIrCsmQh0h13POiyeOHwwd2KCej64rLuta1tqe
JiX2LN+UirHB47+P/4699JbhxT1OqalEG9IALNP/CHjUTgYiQEqzejYHqf+WJPDr
d9Ou+Tgo8U5BqA6wEvKy
=+cYs
-----END PGP SIGNATURE-----
Thank you for your contribution to Debian.
More information about the Pkg-postgresql-public
mailing list