Advisories » MGASA-2015-0420

Updated postgresql packages fix security vulnerabilities

Publication date: 02 Nov 2015
Modification date: 02 Nov 2015
Type: security
Affected Mageia releases : 5
CVE: CVE-2015-5288 , CVE-2015-5289

Description

Josh Kupershmidt discovered the pgCrypto extension could expose
several bytes of server memory if the crypt() function was provided a
too-short salt. An attacker could use this flaw to read private data.
(CVE-2015-5288)

Oskari Saarenmaa discovered that the json and jsonb handlers could exhaust
available stack space. An attacker could use this flaw to perform a denial
of service attack. (CVE-2015-5289)

The postgresql9.3 and postgresql9.4 packages have been updated to versions 
9.3.10 and 9.4.5, respectively, to fix these issues.
See the upstream release notes for more details.
                

References

• https://bugs.mageia.org/show_bug.cgi?id=16924
• http://www.postgresql.org/about/news/1615/
• http://www.ubuntu.com/usn/usn-2772-1/
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5288
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5289

SRPMS

5/core

• postgresql9.3-9.3.10-1.mga5
• postgresql9.4-9.4.5-1.mga5