FreeBSD ports tree https://cgit-dev.freebsd.org/ports/atom?h=2017Q2 2017-06-06T10:59:48Z 2017-06-06T10:59:48Z Torsten Zuehlsdorff tz@FreeBSD.org 2017-06-06T10:59:48Z urn:sha1:e14e8f1e873404eb6f33092606465321b1a8dc14 PostgreSQL security updates The PostgreSQL Global Development Group has released an update to all supported versions of our database system, including 9.6.3, 9.5.7, 9.4.12, 9.3.17, and 9.2.21. This release fixes three security issues. It also patches a number of other bugs reported over the last three months. Users who use the PGREQUIRESSL environment variable to control connections, and users who rely on security isolation between database users when using foreign servers, should update as soon as possible. Other users should plan to update at the next convenient downtime. URL: https://www.postgresql.org/about/news/1746/ Security: CVE-2017-7484, CVE-2017-7485, CVE-2017-7486 Also modify rcorder and let sshd start before PostgreSQL, so any problems during startup can be reviewed promplty from an ssh login. Approved by: ports-secteam (miwi) 2017-02-09T15:22:44Z Palle Girgensohn girgen@FreeBSD.org 2017-02-09T15:22:44Z urn:sha1:f17d7f2051a9e288d043107bec7d55bd6d9e4a47 The PostgreSQL Global Development Group has released an update to all supported versions of our database system, including 9.6.2, 9.5.6, 9.4.11, 9.3.16, and 9.2.20. This release includes fixes that prevent data corruption issues in index builds and in certain write-ahead-log replay situations, which are detailed below. It also patches over 75 other bugs reported over the last three months. Users should plan to apply this update at the next scheduled downtime. Build corruption with CREATE INDEX CONCURRENTLY There existed a race condition if CREATE INDEX CONCURRENTLY was called on a column that had not been indexed before, then rows that were updated by transactions running at the same time as the CREATE INDEX CONCURRENTLY command could have been indexed incorrectly. If you suspect this may have happened, the most reliable solution is to rebuild affected indexes after installing this update. This issue is present in the 9.2, 9.3, 9.4, 9.5, and 9.6 series of PostgreSQL. URL https://www.postgresql.org/about/news/1733/ 2016-10-27T14:04:55Z Palle Girgensohn girgen@FreeBSD.org 2016-10-27T14:04:55Z urn:sha1:57c3f72fc137af2e08f70911d5ed32924f3b515c The PostgreSQL Global Development Group has released an update to all supported versions of our database system, including 9.6.1, 9.5.5, 9.4.10, 9.3.15, 9.2.19, and 9.1.24. This release fixes two issues that can cause data corruption, which are described in more detail below. It also patches a number of other bugs reported over the last three months. The project urges users to apply this update at the next possible downtime. 2016-05-12T22:36:10Z Palle Girgensohn girgen@FreeBSD.org 2016-05-12T22:36:10Z urn:sha1:71b54620678ff776dc658f03ada695403280ce37 URL: http://www.postgresql.org/docs/9.5/static/release-9-5-3.html 2016-03-31T14:49:01Z Palle Girgensohn girgen@FreeBSD.org 2016-03-31T14:49:01Z urn:sha1:1b201272e79fe7d0bb509523405e44a27cb3d7ab URL: http://www.postgresql.org/about/news/1656/ 2015-10-08T21:25:01Z Palle Girgensohn girgen@FreeBSD.org 2015-10-08T21:25:01Z urn:sha1:0642ae4b77cc7e0c9aa0ffaa0045771924380dc5 Two security issues have been fixed in this release which affect users of specific PostgreSQL features: CVE-2015-5289: json or jsonb input values constructed from arbitrary user input can crash the PostgreSQL server and cause a denial of service. CVE-2015-5288: The crypt( function included with the optional pgCrypto extension could be exploited to read a few additional bytes of memory. No working exploit for this issue has been developed. This update will also disable SSL renegotiation by default; previously, it was enabled by default. SSL renegotiation will be removed entirely in PostgreSQL versions 9.5 and later. URL: http://www.postgresql.org/about/news/1615/ Security: CVE-2015-5288 CVE-2015-5289 2015-07-22T22:45:35Z Baptiste Daroussin bapt@FreeBSD.org 2015-07-22T22:45:35Z urn:sha1:bc460272039a723eb5950cc2fa4ac0e6c717ef17 Use OPTIONS_SUB to automatically PLIST_SUB Use OPTIONS helpers 2015-07-22T21:46:27Z Baptiste Daroussin bapt@FreeBSD.org 2015-07-22T21:46:27Z urn:sha1:ab7ead91d49e59e716af676bed3409e102c0624a 2015-02-05T22:54:34Z Palle Girgensohn girgen@FreeBSD.org 2015-02-05T22:54:34Z urn:sha1:262af710e75062789fef1dfdcd828d76841b8ffc This update fixes multiple security issues reported in PostgreSQL over the past few months. All of these issues require prior authentication, and some require additional conditions, and as such are not considered generally urgent. However, users should examine the list of security holes patched below in case they are particularly vulnerable. Security: CVE-2015-0241,CVE-2015-0242,CVE-2015-0243, CVE-2015-0244,CVE-2014-8161 2014-07-30T18:21:47Z Chris Rees crees@FreeBSD.org 2014-07-30T18:21:47Z urn:sha1:421b8a5f6eb19e46c05ad3aa2b47126dea7afea4 uuid-ossp patch has been outdated with irrelevant changes (for us), so massage back in. In head of postgresql, this is handled properly, so eventually the ossp patches can go.