Advisories » MGASA-2015-0069

Updated postgresql packages fix security vulnerabilities

Publication date: 17 Feb 2015
Modification date: 17 Feb 2015
Type: security
Affected Mageia releases : 4
CVE: CVE-2015-0241 , CVE-2015-0242 , CVE-2015-0243 , CVE-2015-0244 , CVE-2014-8161

Description

Updated postgresql packages fix security vulnerabilities:

A user with limited clearance on a table might have access to information in
columns without SELECT rights on through server error messages
(CVE-2014-8161).

The function to_char() might read/write past the end of a buffer. This might
crash the server when a formatting template is processed (CVE-2015-0241).

The pgcrypto module is vulnerable to stack buffer overrun that might crash
the server (CVE-2015-0243).

Emil Lenngren reported that an attacker can inject SQL commands when the
synchronization between client and server is lost (CVE-2015-0244).

This update provides PostgreSQL versions 9.3.6, 9.2.10, 9.1.15, and
9.0.19 that fix these issues, as well as several others.
                

References

• https://bugs.mageia.org/show_bug.cgi?id=15217
• http://www.postgresql.org/about/news/1569/
• https://www.debian.org/security/2015/dsa-3155
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0241
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0242
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0243
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0244
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8161

SRPMS

4/core

• postgresql9.0-9.0.19-1.mga4
• postgresql9.1-9.1.15-1.mga4
• postgresql9.2-9.2.10-1.mga4
• postgresql9.3-9.3.6-1.mga4