Security update for postgresql93 SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2015:0478-1 Final 1 1 2015-02-23T15:59:41Z current 2015-02-23T15:59:41Z 2015-02-23T15:59:41Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for postgresql93 postgresql93 was updated to version 9.3.6 to fix four security issues. These security issues were fixed: - CVE-2015-0241: Fix buffer overruns in to_char() (bnc#916953). - CVE-2015-0243: Fix buffer overruns in contrib/pgcrypto (bnc#916953). - CVE-2015-0244: Fix possible loss of frontend/backend protocol synchronization after an error (bnc#916953). - CVE-2014-8161: Fix information leak via constraint-violation error messages (bnc#916953). This non-security issue was fixed: - Move the server socket from /tmp to /var/run to avoid problems with clients that use PrivateTmp (bnc#888564). More information is available at http://www.postgresql.org/docs/9.3/static/release-9-3-6.html The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-SLE-DESKTOP-12-2015-118,SUSE-SLE-SDK-12-2015-118,SUSE-SLE-SERVER-12-2015-118 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2015/suse-su-20150478-1/ Link for SUSE-SU-2015:0478-1 https://lists.suse.com/pipermail/sle-security-updates/2015-March/001280.html E-Mail link for SUSE-SU-2015:0478-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/888564 SUSE Bug 888564 https://bugzilla.suse.com/916953 SUSE Bug 916953 https://www.suse.com/security/cve/CVE-2014-8161/ SUSE CVE CVE-2014-8161 page https://www.suse.com/security/cve/CVE-2015-0241/ SUSE CVE CVE-2015-0241 page https://www.suse.com/security/cve/CVE-2015-0243/ SUSE CVE CVE-2015-0243 page https://www.suse.com/security/cve/CVE-2015-0244/ SUSE CVE CVE-2015-0244 page SUSE Linux Enterprise Desktop 12 SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Server for SAP Applications 12 SUSE Linux Enterprise Software Development Kit 12 libecpg6-9.3.6-5.1 libpq5-9.3.6-5.1 libpq5-32bit-9.3.6-5.1 postgresql93-9.3.6-5.2 postgresql93-devel-9.3.6-5.1 postgresql93-contrib-9.3.6-5.2 postgresql93-docs-9.3.6-5.2 postgresql93-server-9.3.6-5.2 libecpg6-9.3.6-5.1 as a component of SUSE Linux Enterprise Desktop 12 libpq5-9.3.6-5.1 as a component of SUSE Linux Enterprise Desktop 12 libpq5-32bit-9.3.6-5.1 as a component of SUSE Linux Enterprise Desktop 12 postgresql93-9.3.6-5.2 as a component of SUSE Linux Enterprise Desktop 12 libecpg6-9.3.6-5.1 as a component of SUSE Linux Enterprise Server 12 libpq5-9.3.6-5.1 as a component of SUSE Linux Enterprise Server 12 libpq5-32bit-9.3.6-5.1 as a component of SUSE Linux Enterprise Server 12 postgresql93-9.3.6-5.2 as a component of SUSE Linux Enterprise Server 12 postgresql93-contrib-9.3.6-5.2 as a component of SUSE Linux Enterprise Server 12 postgresql93-docs-9.3.6-5.2 as a component of SUSE Linux Enterprise Server 12 postgresql93-server-9.3.6-5.2 as a component of SUSE Linux Enterprise Server 12 libecpg6-9.3.6-5.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 libpq5-9.3.6-5.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 libpq5-32bit-9.3.6-5.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 postgresql93-9.3.6-5.2 as a component of SUSE Linux Enterprise Server for SAP Applications 12 postgresql93-contrib-9.3.6-5.2 as a component of SUSE Linux Enterprise Server for SAP Applications 12 postgresql93-docs-9.3.6-5.2 as a component of SUSE Linux Enterprise Server for SAP Applications 12 postgresql93-server-9.3.6-5.2 as a component of SUSE Linux Enterprise Server for SAP Applications 12 postgresql93-devel-9.3.6-5.1 as a component of SUSE Linux Enterprise Software Development Kit 12 PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1 allows remote authenticated users to obtain sensitive column values by triggering constraint violation and then reading the error message. CVE-2014-8161 SUSE Linux Enterprise Desktop 12:libecpg6-9.3.6-5.1 SUSE Linux Enterprise Desktop 12:libpq5-32bit-9.3.6-5.1 SUSE Linux Enterprise Desktop 12:libpq5-9.3.6-5.1 SUSE Linux Enterprise Desktop 12:postgresql93-9.3.6-5.2 SUSE Linux Enterprise Server 12:libecpg6-9.3.6-5.1 SUSE Linux Enterprise Server 12:libpq5-32bit-9.3.6-5.1 SUSE Linux Enterprise Server 12:libpq5-9.3.6-5.1 SUSE Linux Enterprise Server 12:postgresql93-9.3.6-5.2 SUSE Linux Enterprise Server 12:postgresql93-contrib-9.3.6-5.2 SUSE Linux Enterprise Server 12:postgresql93-docs-9.3.6-5.2 SUSE Linux Enterprise Server 12:postgresql93-server-9.3.6-5.2 SUSE Linux Enterprise Server for SAP Applications 12:libecpg6-9.3.6-5.1 SUSE Linux Enterprise Server for SAP Applications 12:libpq5-32bit-9.3.6-5.1 SUSE Linux Enterprise Server for SAP Applications 12:libpq5-9.3.6-5.1 SUSE Linux Enterprise Server for SAP Applications 12:postgresql93-9.3.6-5.2 SUSE Linux Enterprise Server for SAP Applications 12:postgresql93-contrib-9.3.6-5.2 SUSE Linux Enterprise Server for SAP Applications 12:postgresql93-docs-9.3.6-5.2 SUSE Linux Enterprise Server for SAP Applications 12:postgresql93-server-9.3.6-5.2 SUSE Linux Enterprise Software Development Kit 12:postgresql93-devel-9.3.6-5.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20150478-1/ https://www.suse.com/security/cve/CVE-2014-8161.html CVE-2014-8161 https://bugzilla.suse.com/916953 SUSE Bug 916953 The to_char function in PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1 allows remote authenticated users to cause a denial of service (crash) or possibly execute arbitrary code via a (1) large number of digits when processing a numeric formatting template, which triggers a buffer over-read, or (2) crafted timestamp formatting template, which triggers a buffer overflow. CVE-2015-0241 SUSE Linux Enterprise Desktop 12:libecpg6-9.3.6-5.1 SUSE Linux Enterprise Desktop 12:libpq5-32bit-9.3.6-5.1 SUSE Linux Enterprise Desktop 12:libpq5-9.3.6-5.1 SUSE Linux Enterprise Desktop 12:postgresql93-9.3.6-5.2 SUSE Linux Enterprise Server 12:libecpg6-9.3.6-5.1 SUSE Linux Enterprise Server 12:libpq5-32bit-9.3.6-5.1 SUSE Linux Enterprise Server 12:libpq5-9.3.6-5.1 SUSE Linux Enterprise Server 12:postgresql93-9.3.6-5.2 SUSE Linux Enterprise Server 12:postgresql93-contrib-9.3.6-5.2 SUSE Linux Enterprise Server 12:postgresql93-docs-9.3.6-5.2 SUSE Linux Enterprise Server 12:postgresql93-server-9.3.6-5.2 SUSE Linux Enterprise Server for SAP Applications 12:libecpg6-9.3.6-5.1 SUSE Linux Enterprise Server for SAP Applications 12:libpq5-32bit-9.3.6-5.1 SUSE Linux Enterprise Server for SAP Applications 12:libpq5-9.3.6-5.1 SUSE Linux Enterprise Server for SAP Applications 12:postgresql93-9.3.6-5.2 SUSE Linux Enterprise Server for SAP Applications 12:postgresql93-contrib-9.3.6-5.2 SUSE Linux Enterprise Server for SAP Applications 12:postgresql93-docs-9.3.6-5.2 SUSE Linux Enterprise Server for SAP Applications 12:postgresql93-server-9.3.6-5.2 SUSE Linux Enterprise Software Development Kit 12:postgresql93-devel-9.3.6-5.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20150478-1/ https://www.suse.com/security/cve/CVE-2015-0241.html CVE-2015-0241 https://bugzilla.suse.com/916953 SUSE Bug 916953 Multiple buffer overflows in contrib/pgcrypto in PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1 allow remote authenticated users to cause a denial of service (crash) and possibly execute arbitrary code via unspecified vectors. CVE-2015-0243 SUSE Linux Enterprise Desktop 12:libecpg6-9.3.6-5.1 SUSE Linux Enterprise Desktop 12:libpq5-32bit-9.3.6-5.1 SUSE Linux Enterprise Desktop 12:libpq5-9.3.6-5.1 SUSE Linux Enterprise Desktop 12:postgresql93-9.3.6-5.2 SUSE Linux Enterprise Server 12:libecpg6-9.3.6-5.1 SUSE Linux Enterprise Server 12:libpq5-32bit-9.3.6-5.1 SUSE Linux Enterprise Server 12:libpq5-9.3.6-5.1 SUSE Linux Enterprise Server 12:postgresql93-9.3.6-5.2 SUSE Linux Enterprise Server 12:postgresql93-contrib-9.3.6-5.2 SUSE Linux Enterprise Server 12:postgresql93-docs-9.3.6-5.2 SUSE Linux Enterprise Server 12:postgresql93-server-9.3.6-5.2 SUSE Linux Enterprise Server for SAP Applications 12:libecpg6-9.3.6-5.1 SUSE Linux Enterprise Server for SAP Applications 12:libpq5-32bit-9.3.6-5.1 SUSE Linux Enterprise Server for SAP Applications 12:libpq5-9.3.6-5.1 SUSE Linux Enterprise Server for SAP Applications 12:postgresql93-9.3.6-5.2 SUSE Linux Enterprise Server for SAP Applications 12:postgresql93-contrib-9.3.6-5.2 SUSE Linux Enterprise Server for SAP Applications 12:postgresql93-docs-9.3.6-5.2 SUSE Linux Enterprise Server for SAP Applications 12:postgresql93-server-9.3.6-5.2 SUSE Linux Enterprise Software Development Kit 12:postgresql93-devel-9.3.6-5.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20150478-1/ https://www.suse.com/security/cve/CVE-2015-0243.html CVE-2015-0243 https://bugzilla.suse.com/916953 SUSE Bug 916953 PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1 does not properly handle errors while reading a protocol message, which allows remote attackers to conduct SQL injection attacks via crafted binary data in a parameter and causing an error, which triggers the loss of synchronization and part of the protocol message to be treated as a new message, as demonstrated by causing a timeout or query cancellation. CVE-2015-0244 SUSE Linux Enterprise Desktop 12:libecpg6-9.3.6-5.1 SUSE Linux Enterprise Desktop 12:libpq5-32bit-9.3.6-5.1 SUSE Linux Enterprise Desktop 12:libpq5-9.3.6-5.1 SUSE Linux Enterprise Desktop 12:postgresql93-9.3.6-5.2 SUSE Linux Enterprise Server 12:libecpg6-9.3.6-5.1 SUSE Linux Enterprise Server 12:libpq5-32bit-9.3.6-5.1 SUSE Linux Enterprise Server 12:libpq5-9.3.6-5.1 SUSE Linux Enterprise Server 12:postgresql93-9.3.6-5.2 SUSE Linux Enterprise Server 12:postgresql93-contrib-9.3.6-5.2 SUSE Linux Enterprise Server 12:postgresql93-docs-9.3.6-5.2 SUSE Linux Enterprise Server 12:postgresql93-server-9.3.6-5.2 SUSE Linux Enterprise Server for SAP Applications 12:libecpg6-9.3.6-5.1 SUSE Linux Enterprise Server for SAP Applications 12:libpq5-32bit-9.3.6-5.1 SUSE Linux Enterprise Server for SAP Applications 12:libpq5-9.3.6-5.1 SUSE Linux Enterprise Server for SAP Applications 12:postgresql93-9.3.6-5.2 SUSE Linux Enterprise Server for SAP Applications 12:postgresql93-contrib-9.3.6-5.2 SUSE Linux Enterprise Server for SAP Applications 12:postgresql93-docs-9.3.6-5.2 SUSE Linux Enterprise Server for SAP Applications 12:postgresql93-server-9.3.6-5.2 SUSE Linux Enterprise Software Development Kit 12:postgresql93-devel-9.3.6-5.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20150478-1/ https://www.suse.com/security/cve/CVE-2015-0244.html CVE-2015-0244 https://bugzilla.suse.com/916953 SUSE Bug 916953