Security update for postgresql91 SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2015:1091-1 Final 1 1 2015-06-11T14:04:18Z current 2015-06-11T14:04:18Z 2015-06-11T14:04:18Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for postgresql91 This update provides PostgreSQL 9.1.18, which brings fixes for security issues and other enhancements. The following vulnerabilities have been fixed: * CVE-2015-3165: Avoid possible crash when client disconnects. (bsc#931972) * CVE-2015-3166: Consistently check for failure of the *printf(). (bsc#931973) * CVE-2015-3167: In contrib/pgcrypto, uniformly report decryption failures. (bsc#931974) For a comprehensive list of changes, please refer to http://www.postgresql.org/docs/9.1/static/release-9-1-18.html <http://www.postgresql.org/docs/9.1/static/release-9-1-18.html> . This update also includes changes in PostgreSQL's packaging to prepare for the migration to the new major version 9.4. (FATE#316970, bsc#907651) Security Issues: * CVE-2015-3165 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3165> * CVE-2015-3166 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3166> * CVE-2015-3167 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3167> The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). sdksp3-postgresql91-201505,sledsp3-postgresql91-201505,sleman21-postgresql91-201505,slessp3-postgresql91-201505 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2015/suse-su-20151091-1/ Link for SUSE-SU-2015:1091-1 https://lists.suse.com/pipermail/sle-security-updates/2015-June/001446.html E-Mail link for SUSE-SU-2015:1091-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/907651 SUSE Bug 907651 https://bugzilla.suse.com/931972 SUSE Bug 931972 https://bugzilla.suse.com/931973 SUSE Bug 931973 https://bugzilla.suse.com/931974 SUSE Bug 931974 https://bugzilla.suse.com/932040 SUSE Bug 932040 https://www.suse.com/security/cve/CVE-2015-3165/ SUSE CVE CVE-2015-3165 page https://www.suse.com/security/cve/CVE-2015-3166/ SUSE CVE CVE-2015-3166 page https://www.suse.com/security/cve/CVE-2015-3167/ SUSE CVE CVE-2015-3167 page SUSE Linux Enterprise Desktop 11 SP3 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA SUSE Linux Enterprise Server for SAP Applications 11 SP3 SUSE Linux Enterprise Software Development Kit 11 SP3 SUSE Manager 2.1 postgresql91-devel-9.1.18-0.3.1 postgresql91-9.1.18-0.3.1 postgresql91-docs-9.1.18-0.3.1 postgresql91-pltcl-9.1.18-0.3.1 postgresql91-contrib-9.1.18-0.3.1 postgresql91-server-9.1.18-0.3.1 postgresql91-9.1.18-0.3.1 as a component of SUSE Linux Enterprise Desktop 11 SP3 postgresql91-docs-9.1.18-0.3.1 as a component of SUSE Linux Enterprise Desktop 11 SP3 postgresql91-9.1.18-0.3.1 as a component of SUSE Linux Enterprise Server 11 SP3 postgresql91-contrib-9.1.18-0.3.1 as a component of SUSE Linux Enterprise Server 11 SP3 postgresql91-docs-9.1.18-0.3.1 as a component of SUSE Linux Enterprise Server 11 SP3 postgresql91-server-9.1.18-0.3.1 as a component of SUSE Linux Enterprise Server 11 SP3 postgresql91-9.1.18-0.3.1 as a component of SUSE Linux Enterprise Server 11 SP3-TERADATA postgresql91-contrib-9.1.18-0.3.1 as a component of SUSE Linux Enterprise Server 11 SP3-TERADATA postgresql91-docs-9.1.18-0.3.1 as a component of SUSE Linux Enterprise Server 11 SP3-TERADATA postgresql91-server-9.1.18-0.3.1 as a component of SUSE Linux Enterprise Server 11 SP3-TERADATA postgresql91-9.1.18-0.3.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP3 postgresql91-contrib-9.1.18-0.3.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP3 postgresql91-docs-9.1.18-0.3.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP3 postgresql91-server-9.1.18-0.3.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP3 postgresql91-devel-9.1.18-0.3.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP3 postgresql91-pltcl-9.1.18-0.3.1 as a component of SUSE Manager 2.1 Double free vulnerability in PostgreSQL before 9.0.20, 9.1.x before 9.1.16, 9.2.x before 9.2.11, 9.3.x before 9.3.7, and 9.4.x before 9.4.2 allows remote attackers to cause a denial of service (crash) by closing an SSL session at a time when the authentication timeout will expire during the session shutdown sequence. CVE-2015-3165 SUSE Linux Enterprise Desktop 11 SP3:postgresql91-9.1.18-0.3.1 SUSE Linux Enterprise Desktop 11 SP3:postgresql91-docs-9.1.18-0.3.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:postgresql91-9.1.18-0.3.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:postgresql91-contrib-9.1.18-0.3.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:postgresql91-docs-9.1.18-0.3.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:postgresql91-server-9.1.18-0.3.1 SUSE Linux Enterprise Server 11 SP3:postgresql91-9.1.18-0.3.1 SUSE Linux Enterprise Server 11 SP3:postgresql91-contrib-9.1.18-0.3.1 SUSE Linux Enterprise Server 11 SP3:postgresql91-docs-9.1.18-0.3.1 SUSE Linux Enterprise Server 11 SP3:postgresql91-server-9.1.18-0.3.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:postgresql91-9.1.18-0.3.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:postgresql91-contrib-9.1.18-0.3.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:postgresql91-docs-9.1.18-0.3.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:postgresql91-server-9.1.18-0.3.1 SUSE Linux Enterprise Software Development Kit 11 SP3:postgresql91-devel-9.1.18-0.3.1 SUSE Manager 2.1:postgresql91-pltcl-9.1.18-0.3.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20151091-1/ https://www.suse.com/security/cve/CVE-2015-3165.html CVE-2015-3165 https://bugzilla.suse.com/931972 SUSE Bug 931972 https://bugzilla.suse.com/931973 SUSE Bug 931973 https://bugzilla.suse.com/931974 SUSE Bug 931974 https://bugzilla.suse.com/932040 SUSE Bug 932040 The snprintf implementation in PostgreSQL before 9.0.20, 9.1.x before 9.1.16, 9.2.x before 9.2.11, 9.3.x before 9.3.7, and 9.4.x before 9.4.2 does not properly handle system-call errors, which allows attackers to obtain sensitive information or have other unspecified impact via unknown vectors, as demonstrated by an out-of-memory error. CVE-2015-3166 SUSE Linux Enterprise Desktop 11 SP3:postgresql91-9.1.18-0.3.1 SUSE Linux Enterprise Desktop 11 SP3:postgresql91-docs-9.1.18-0.3.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:postgresql91-9.1.18-0.3.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:postgresql91-contrib-9.1.18-0.3.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:postgresql91-docs-9.1.18-0.3.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:postgresql91-server-9.1.18-0.3.1 SUSE Linux Enterprise Server 11 SP3:postgresql91-9.1.18-0.3.1 SUSE Linux Enterprise Server 11 SP3:postgresql91-contrib-9.1.18-0.3.1 SUSE Linux Enterprise Server 11 SP3:postgresql91-docs-9.1.18-0.3.1 SUSE Linux Enterprise Server 11 SP3:postgresql91-server-9.1.18-0.3.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:postgresql91-9.1.18-0.3.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:postgresql91-contrib-9.1.18-0.3.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:postgresql91-docs-9.1.18-0.3.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:postgresql91-server-9.1.18-0.3.1 SUSE Linux Enterprise Software Development Kit 11 SP3:postgresql91-devel-9.1.18-0.3.1 SUSE Manager 2.1:postgresql91-pltcl-9.1.18-0.3.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20151091-1/ https://www.suse.com/security/cve/CVE-2015-3166.html CVE-2015-3166 https://bugzilla.suse.com/931972 SUSE Bug 931972 https://bugzilla.suse.com/931973 SUSE Bug 931973 https://bugzilla.suse.com/931974 SUSE Bug 931974 https://bugzilla.suse.com/932040 SUSE Bug 932040 contrib/pgcrypto in PostgreSQL before 9.0.20, 9.1.x before 9.1.16, 9.2.x before 9.2.11, 9.3.x before 9.3.7, and 9.4.x before 9.4.2 uses different error responses when an incorrect key is used, which makes it easier for attackers to obtain the key via a brute force attack. CVE-2015-3167 SUSE Linux Enterprise Desktop 11 SP3:postgresql91-9.1.18-0.3.1 SUSE Linux Enterprise Desktop 11 SP3:postgresql91-docs-9.1.18-0.3.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:postgresql91-9.1.18-0.3.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:postgresql91-contrib-9.1.18-0.3.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:postgresql91-docs-9.1.18-0.3.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:postgresql91-server-9.1.18-0.3.1 SUSE Linux Enterprise Server 11 SP3:postgresql91-9.1.18-0.3.1 SUSE Linux Enterprise Server 11 SP3:postgresql91-contrib-9.1.18-0.3.1 SUSE Linux Enterprise Server 11 SP3:postgresql91-docs-9.1.18-0.3.1 SUSE Linux Enterprise Server 11 SP3:postgresql91-server-9.1.18-0.3.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:postgresql91-9.1.18-0.3.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:postgresql91-contrib-9.1.18-0.3.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:postgresql91-docs-9.1.18-0.3.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:postgresql91-server-9.1.18-0.3.1 SUSE Linux Enterprise Software Development Kit 11 SP3:postgresql91-devel-9.1.18-0.3.1 SUSE Manager 2.1:postgresql91-pltcl-9.1.18-0.3.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20151091-1/ https://www.suse.com/security/cve/CVE-2015-3167.html CVE-2015-3167 https://bugzilla.suse.com/931972 SUSE Bug 931972 https://bugzilla.suse.com/931973 SUSE Bug 931973 https://bugzilla.suse.com/931974 SUSE Bug 931974 https://bugzilla.suse.com/932040 SUSE Bug 932040