FreeBSD ports tree https://cgit-dev.freebsd.org/ports/atom?h=7-eol 2013-02-08T07:54:09Z 2013-02-08T07:54:09Z Palle Girgensohn girgen@FreeBSD.org 2013-02-08T07:54:09Z urn:sha1:687fb3c056fa64ea1f71ae6b94a7ae67ed33e432 This update fixes a denial-of-service (DOS) vulnerability. All users should update their PostgreSQL installations as soon as possible. The security issue fixed in this release, CVE-2013-0255, allows a previously authenticated user to crash the server by calling an internal function with invalid arguments. URL: http://www.postgresql.org/about/news/1446/ Security: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0255 2012-12-06T16:40:35Z Palle Girgensohn girgen@FreeBSD.org 2012-12-06T16:40:35Z urn:sha1:9cc899464036b9361e2cba83b99f1bd4922f18f5 versions of the PostgreSQL database system, including versions 9.2.2, 9.1.7, 9.0.11, 8.4.15, and 8.3.22. Users of PostgreSQL Hot Standby replication should update at the next possible opportunity. Other users should update at their next maintenance window. Deprecate the 8.3.22 version, since it is near end-of-life. URL: http://www.postgresql.org/about/news/1430/ Feature safe: yes 2012-09-24T22:03:10Z Palle Girgensohn girgen@FreeBSD.org 2012-09-24T22:03:10Z urn:sha1:1c8d4acc4906e78d4ffadf6070d71b8723194334 This update fixes critical issues for major versions 9.1 and 9.2, and users running those versions should apply it as soon as possible. URL: http://www.postgresql.org/about/news/1416/ 2012-08-17T19:39:51Z Jason Helfman jgh@FreeBSD.org 2012-08-17T19:39:51Z urn:sha1:9cf373f5efd4db60af1683e91f2a9e359562622c of the PostgreSQL database system, including versions 9.1.5, 9.0.9, 8.4.13 and 8.3.20. This update patches security holes associated with libxml2 and libxslt, similar to those affecting other open source projects. All users are urged to update their installations at the first available opportunity. This security release fixes a vulnerability in the built-in XML functionality, and a vulnerability in the XSLT functionality supplied by the optional XML2 extension. Both vulnerabilities allow reading of arbitrary files by any authenticated database user, and the XSLT vulnerability allows writing files as well. The fixes cause limited backwards compatibility issues. These issues correspond to the following two vulnerabilities: CVE-2012-3488: PostgreSQL insecure use of libxslt CVE-2012-3489: PostgreSQL insecure use of libxml2 This release also contains several fixes to version 9.1, and a smaller number of fixes to older versions, including: Updates and corrections to time zone data Multiple documentation updates and corrections Add limit on max_wal_senders Fix dependencies generated during ALTER TABLE ADD CONSTRAINT USING INDEX. Correct behavior of unicode conversions for PL/Python Fix WITH attached to a nested set operation (UNION/INTERSECT/EXCEPT). Fix syslogger so that log_truncate_on_rotation works in the first rotation. Only allow autovacuum to be auto-canceled by a directly blocked process. Improve fsync request queue operation Prevent corner-case core dump in rfree(). Fix Walsender so that it responds correctly to timeouts and deadlocks Several PL/Perl fixes for encoding-related issues Make selectivity operators use the correct collation Prevent unsuitable slaves from being selected for synchronous replication Make REASSIGN OWNED work on extensions as well Fix race condition with ENUM comparisons Make NOTIFY cope with out-of-disk-space Fix memory leak in ARRAY subselect queries Reduce data loss at replication failover Fix behavior of subtransactions with Hot Standby 2012-06-04T11:00:52Z Palle Girgensohn girgen@FreeBSD.org 2012-06-04T11:00:52Z urn:sha1:3d2b0e285a074ae100671923ddf0e98f6a765488 active branches of the PostgreSQL database system, including versions 9.1.4, 9.0.8, 8.4.12 and 8.3.19. Users of the crypt(text, text) function with DES encryption in the optional pg_crypto module should upgrade their installations immediately, if you have'nt already updated since the port was patched on May 30. All other database administrators are urged to upgrade your version of PostgreSQL at the next scheduled downtime. URL: http://www.postgresql.org/about/news/1398/ Security: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2143 Fix incorrect password transformation in contrib/pgcrypto’s DES crypt() function This was fixed in a patch release for the FreeBSD ports on May 30. Security: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2655 Ignore SECURITY DEFINER and SET attributes for a procedural language’s call handle 2012-02-27T16:24:48Z Palle Girgensohn girgen@FreeBSD.org 2012-02-27T16:24:48Z urn:sha1:9b471aa8352ccd784f07c60fbb11df80b08ee578 active branches of the PostgreSQL object-relational database system, including versions 9.1.3, 9.0.7, 8.4.11 and 8.3.18. Users of pg_dump, users of SSL certificates for validation or users of triggers using SECURITY DEFINER should upgrade their installations immediately. All other database administrators are urged to upgrade your version of PostgreSQL at the next scheduled downtime. More details on the security fixes here: URL: http://www.postgresql.org/about/news/1377/ Security: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0866 Security: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0867 Security: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0868 2011-12-05T16:45:14Z Palle Girgensohn girgen@FreeBSD.org 2011-12-05T16:45:14Z urn:sha1:c87711cb50473799919e04a96db229000040b860 active branches of the PostgreSQL object-relational database system, including versions 9.1.2, 9.0.6, 8.4.10, 8.3.17 and 8.2.23. This release contains 52 fixes to version 9.1, and a smaller number of fixes to older versions, including: - Fix bugs in information_schema.referential_constraints view** - Correct collations for citext columns and indexes** - Prevent possible crash when joining to a scalar function - Prevent transitory data corruption of GIN indexes after a crash - Prevent data corruption on TOAST columns when copying data - Fix failures during hot standby startup - Correct another "variable not found in subplan target list" bug - Fix bug with sorting on aggregate expressions in windowing functions - Multiple bug fixes for pg_upgrade - Change Foreign Key creation order to better support self-referential keys** - Multiple bug fixes to CREATE EXTENSION - Ensure that function return type and data returned from PL/perl agree - Ensure that PL/perl strings are always UTF-8 - Assorted bug fixes for various Extensions - Updates to the time zone database, particularly to CST6 Changes marked with ** above require additional, post-update steps in order to fix all described issues. URL: http://www.postgresql.org/docs/current/static/release.html Also, fix a pthread problem in the FreeBSD port. [1] PR: 160580 [1] Feature safe: yes 2011-10-18T09:03:33Z Palle Girgensohn girgen@FreeBSD.org 2011-10-18T09:03:33Z urn:sha1:d9a60ff20fdef5ff2634ff38096cc7c163b9eca3 for all active branches of the PostgreSQL object-relational database system, including versions 9.1.1, 9.0.5, 8.4.9, 8.3.16 and 8.2.22. All users are strongly urged to update their installations at the next scheduled downtime. URL: http://www.postgresql.org/about/news.1355 Cleanup ports. Better handling of the knob PG_USER. Also add uuid to 9.0 and 9.1 contrib ports. 2011-04-18T23:34:27Z Palle Girgensohn girgen@FreeBSD.org 2011-04-18T23:34:27Z urn:sha1:73c856222edb8c22377bf9a1c81a724065e3a31c This update contains a critical fix to the pg_upgrade utility which prevents significant downtime issues. Do not use pg_upgrade without installing this update first. The issue with pg_upgrade and the fix are detailed on the PostgreSQL wiki: http://wiki.postgresql.org/wiki/20110408pg_upgrade_fix Users who have already used pg_upgrade should run the database repair script given on that page on their databases as soon as possible. See the release notes for each version at http://www.postgresql.org/docs/current/static/release.html for a full list of changes with details. Allow the username of the postgresql user to configurable for 8.4 and 9.0. Largely inspired by the work of Jason Helfman [153668, 153136]. Change PGUSER knob to PG_USER not to clash with PGUSER environment. PR: 153668, 153136, 155493, 155137 2011-02-01T14:48:17Z Palle Girgensohn girgen@FreeBSD.org 2011-02-01T14:48:17Z urn:sha1:3832212b4c72fa781f5430ebda26997442c38e1e This update includes a security fix which prevents a buffer overrun in the contrib module intarray's input function for the query_int type. This bug is a security risk since the function's return address could be overwritten by malicious code. All supported versions of PostgreSQL are impacted. However, the affected contrib module is optional. Only users who have installed the intarray module in their database are affected. See the CVE Advisory at http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4015 This release includes 63 bugfixes, including: - Avoid unexpected conversion overflow in planner for distant date values - Fix assignment to an array slice that is before the existing range of subscripts - Fix pg_restore to do the right thing when escaping large objects - Avoid failures when EXPLAIN tries to display a simple-form CASE expression - Improved build support for Windows version - Fix bug in contrib/seg's GiST picksplit algorithm which caused performance degredation The 9.0.3 update also contains several fixes for issues with features introduced or changed in version 9.0: - Ensure all the received WAL is fsync'd to disk before exiting walreceiver - Improve performance of walreceiver by avoiding excess fsync activity - Make ALTER TABLE revalidate uniqueness and exclusion constraints when needed - Fix EvalPlanQual for UPDATE of an inheritance tree when the tables are not all alike PR: ports/154436 Security: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4015 Feature safe: yes Approved by: portmgr