FreeBSD ports tree https://cgit-dev.freebsd.org/ports/atom?h=pre-xorg-7 2007-04-23T16:10:54Z 2007-04-23T16:10:54Z Palle Girgensohn girgen@FreeBSD.org 2007-04-23T16:10:54Z urn:sha1:0460921154a83d30802fb47542396c669821a8c0 The PostgreSQL Global Development Group has released updated versions for PostgreSQL 8.2 and all back versions to patch a privilege escalation exploit in SECURITY DEFINER functions. All users of this feature are urged to update to the latest minor version and follow instructions on securing these functions as soon as possible. This minor release also contains other fixes, so all users should plan to deploy it. Once you have updated, additional steps are required to secure your database against the exploit. Please read the release notes at http://www.postgresql.org/docs/8.2/static/release.html and the TechDocs article at http://www.postgresql.org/docs/techdocs.77 on how to lock down your security definer functions, if you use them. As always, application of a minor release does not require a dump and reload of the database. The frequency of security fixes recently is a result of increased scrutiny of the PostgreSQL code by government agencies and security-conscious companies. Rapid turnaround on security patches is key to keeping PostgreSQL the most secure SQL database. Your work and vigilance in applying the latest security updates ensures that there will never be a PostgreSQL "worm". http://www.postgresql.org/docs/8.2/static/release-8-2-4.html http://www.postgresql.org/docs/8.1/static/release.html#RELEASE-8-1-9 http://www.postgresql.org/docs/8.0/static/release.html#RELEASE-8-0-13 http://www.postgresql.org/docs/7.4/static/release.html#RELEASE-7-4-17 http://www.postgresql.org/docs/techdocs.77 Security: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2138 2007-03-18T16:23:18Z Norikatsu Shigemura nork@FreeBSD.org 2007-03-18T16:23:18Z urn:sha1:ded27d2f669df09aefffe801ef9e3490f63aaf72 Approved by: maintainer timeout (1 month) 2007-02-07T09:51:48Z Palle Girgensohn girgen@FreeBSD.org 2007-02-07T09:51:48Z urn:sha1:8fb2e60bb61e1598fefc3e977851b53413bc1bd5 The recent security release (8.0.11, 8.1.7, 8.2.2) has been withdrawn. It contained an issue which causes error with custom data types, type constraints and expression indexes. These upgrades fix the problem. 2007-02-06T15:53:24Z Palle Girgensohn girgen@FreeBSD.org 2007-02-06T15:53:24Z urn:sha1:7e70627d9cbffa595ad1f3da5fb47df308e01903 Suggested by: Ederson de Moura 2007-02-05T15:41:41Z Palle Girgensohn girgen@FreeBSD.org 2007-02-05T15:41:41Z urn:sha1:7f54aaa474633d692b8f806cbbc92e36ff9a5208 A vulnerability allows suppressing the normal checks that a SQL function returns the data type it's declared to do. These errors can easily be exploited to cause a backend crash, and in principle might be used to read database content that the user should not be able to access. [CVE-2007-0555] A vulnerability involving changing the data type of a table column can easily be exploited to cause a backend crash, and in principle might be used to read database content that the user should not be able to access. [CVE-2007-0556] The release includes a set of other fixes as well. Please see the release information at http://www.postgresql.org/docs/8.2/static/release-8-2-2.html Security: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0555 Security: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0556 2007-01-09T16:29:35Z Palle Girgensohn girgen@FreeBSD.org 2007-01-09T16:29:35Z urn:sha1:6b11e898761ec7ced9bf9b652a24b78697eac863 Release notes: http://www.postgresql.org/docs/7.3/static/release.html#RELEASE-7-3-17 http://www.postgresql.org/docs/7.4/static/release.html#RELEASE-7-4-15 http://www.postgresql.org/docs/8.0/static/release.html#RELEASE-8-0-10 http://www.postgresql.org/docs/8.1/static/release.html#RELEASE-8-1-6 http://www.postgresql.org/docs/8.2/static/release-8-2-1.html The server-side utilities of postgresql (initdb, initlocation, ipcclean, pg_controldata, pg_ctl, pg_id and pg_resetxlog) are now installed by the respective postgresql*-server port (previously they where installed with the client). If you update the client, you should also update the server to make sure you are not left without the server-side tools. Do something like: portupgrade postgresql-client postgresql-server 2006-12-07T14:28:41Z Palle Girgensohn girgen@FreeBSD.org 2006-12-07T14:28:41Z urn:sha1:ac681feb0cb58da546a6e61a101b7d3e9c4df307 2006-12-06T16:50:34Z Palle Girgensohn girgen@FreeBSD.org 2006-12-06T16:50:34Z urn:sha1:5b1dcdfc6fde3d24f31e5afec5e3d67d11a4e639 PostgreSQL 8.2.0 Complete release notes are available at http://www.postgresql.org/docs/current/static/release-8-2.html 2006-11-06T09:03:04Z Palle Girgensohn girgen@FreeBSD.org 2006-11-06T09:03:04Z urn:sha1:74002c4532c859994d149235db48bcca1be7a2b2 2006-09-27T12:58:53Z Palle Girgensohn girgen@FreeBSD.org 2006-09-27T12:58:53Z urn:sha1:c03d288c14630e726f945e5a689c1302682f54b7 Update the patches to handle ICU version 3.6 and fall back to 3.4.