Advisories ยป MGASA-2015-0069

Updated postgresql packages fix security vulnerabilities

Publication date: 17 Feb 2015
Type: security
Affected Mageia releases : 4
CVE: CVE-2015-0241 , CVE-2015-0242 , CVE-2015-0243 , CVE-2015-0244 , CVE-2014-8161


Updated postgresql packages fix security vulnerabilities:

A user with limited clearance on a table might have access to information in
columns without SELECT rights on through server error messages

The function to_char() might read/write past the end of a buffer. This might
crash the server when a formatting template is processed (CVE-2015-0241).

The pgcrypto module is vulnerable to stack buffer overrun that might crash
the server (CVE-2015-0243).

Emil Lenngren reported that an attacker can inject SQL commands when the
synchronization between client and server is lost (CVE-2015-0244).

This update provides PostgreSQL versions 9.3.6, 9.2.10, 9.1.15, and
9.0.19 that fix these issues, as well as several others.