Security update for postgresql93 SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2015:1264-1 Final 1 1 2015-06-24T11:25:40Z current 2015-06-24T11:25:40Z 2015-06-24T11:25:40Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for postgresql93 PostgreSQL was updated to the security and bugfix release 9.3.8 including 9.3.7. Security issues fixed: * CVE-2015-3165, bsc#931972: Avoid possible crash when client disconnects just before the authentication timeout expires. * CVE-2015-3166, bsc#931973: Consistently check for failure of the printf() family of functions. * CVE-2015-3167, bsc#931974: In contrib/pgcrypto, uniformly report decryption failures as 'Wrong key or corrupt data' Bugs fixed: * Protect against wraparound of multixact member IDs. * Avoid failures while fsync'ing data directory during crash restart. * Fix pg_get_functiondef() to show functions' LEAKPROOF property, if set. * Allow libpq to use TLS protocol versions beyond v1. - For the full release notes, see the following two URLs http://www.postgresql.org/docs/9.3/static/release-9-3-8.html http://www.postgresql.org/docs/9.3/static/release-9-3-7.html The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-SLE-DESKTOP-12-2015-328,SUSE-SLE-SDK-12-2015-328,SUSE-SLE-SERVER-12-2015-328 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2015/suse-su-20151264-1/ Link for SUSE-SU-2015:1264-1 https://lists.suse.com/pipermail/sle-security-updates/2015-July/001499.html E-Mail link for SUSE-SU-2015:1264-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/931972 SUSE Bug 931972 https://bugzilla.suse.com/931973 SUSE Bug 931973 https://bugzilla.suse.com/931974 SUSE Bug 931974 https://www.suse.com/security/cve/CVE-2015-3165/ SUSE CVE CVE-2015-3165 page https://www.suse.com/security/cve/CVE-2015-3166/ SUSE CVE CVE-2015-3166 page https://www.suse.com/security/cve/CVE-2015-3167/ SUSE CVE CVE-2015-3167 page SUSE Linux Enterprise Desktop 12 SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Server for SAP Applications 12 SUSE Linux Enterprise Software Development Kit 12 libecpg6-9.3.8-8.1 libpq5-9.3.8-8.1 libpq5-32bit-9.3.8-8.1 postgresql93-9.3.8-8.1 postgresql93-devel-9.3.8-8.1 postgresql93-contrib-9.3.8-8.1 postgresql93-docs-9.3.8-8.1 postgresql93-server-9.3.8-8.1 libecpg6-9.3.8-8.1 as a component of SUSE Linux Enterprise Desktop 12 libpq5-9.3.8-8.1 as a component of SUSE Linux Enterprise Desktop 12 libpq5-32bit-9.3.8-8.1 as a component of SUSE Linux Enterprise Desktop 12 postgresql93-9.3.8-8.1 as a component of SUSE Linux Enterprise Desktop 12 libecpg6-9.3.8-8.1 as a component of SUSE Linux Enterprise Server 12 libpq5-9.3.8-8.1 as a component of SUSE Linux Enterprise Server 12 libpq5-32bit-9.3.8-8.1 as a component of SUSE Linux Enterprise Server 12 postgresql93-9.3.8-8.1 as a component of SUSE Linux Enterprise Server 12 postgresql93-contrib-9.3.8-8.1 as a component of SUSE Linux Enterprise Server 12 postgresql93-docs-9.3.8-8.1 as a component of SUSE Linux Enterprise Server 12 postgresql93-server-9.3.8-8.1 as a component of SUSE Linux Enterprise Server 12 libecpg6-9.3.8-8.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 libpq5-9.3.8-8.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 libpq5-32bit-9.3.8-8.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 postgresql93-9.3.8-8.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 postgresql93-contrib-9.3.8-8.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 postgresql93-docs-9.3.8-8.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 postgresql93-server-9.3.8-8.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 postgresql93-devel-9.3.8-8.1 as a component of SUSE Linux Enterprise Software Development Kit 12 Double free vulnerability in PostgreSQL before 9.0.20, 9.1.x before 9.1.16, 9.2.x before 9.2.11, 9.3.x before 9.3.7, and 9.4.x before 9.4.2 allows remote attackers to cause a denial of service (crash) by closing an SSL session at a time when the authentication timeout will expire during the session shutdown sequence. CVE-2015-3165 SUSE Linux Enterprise Desktop 12:libecpg6-9.3.8-8.1 SUSE Linux Enterprise Desktop 12:libpq5-32bit-9.3.8-8.1 SUSE Linux Enterprise Desktop 12:libpq5-9.3.8-8.1 SUSE Linux Enterprise Desktop 12:postgresql93-9.3.8-8.1 SUSE Linux Enterprise Server 12:libecpg6-9.3.8-8.1 SUSE Linux Enterprise Server 12:libpq5-32bit-9.3.8-8.1 SUSE Linux Enterprise Server 12:libpq5-9.3.8-8.1 SUSE Linux Enterprise Server 12:postgresql93-9.3.8-8.1 SUSE Linux Enterprise Server 12:postgresql93-contrib-9.3.8-8.1 SUSE Linux Enterprise Server 12:postgresql93-docs-9.3.8-8.1 SUSE Linux Enterprise Server 12:postgresql93-server-9.3.8-8.1 SUSE Linux Enterprise Server for SAP Applications 12:libecpg6-9.3.8-8.1 SUSE Linux Enterprise Server for SAP Applications 12:libpq5-32bit-9.3.8-8.1 SUSE Linux Enterprise Server for SAP Applications 12:libpq5-9.3.8-8.1 SUSE Linux Enterprise Server for SAP Applications 12:postgresql93-9.3.8-8.1 SUSE Linux Enterprise Server for SAP Applications 12:postgresql93-contrib-9.3.8-8.1 SUSE Linux Enterprise Server for SAP Applications 12:postgresql93-docs-9.3.8-8.1 SUSE Linux Enterprise Server for SAP Applications 12:postgresql93-server-9.3.8-8.1 SUSE Linux Enterprise Software Development Kit 12:postgresql93-devel-9.3.8-8.1 critical To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20151264-1/ https://www.suse.com/security/cve/CVE-2015-3165.html CVE-2015-3165 https://bugzilla.suse.com/931972 SUSE Bug 931972 https://bugzilla.suse.com/931973 SUSE Bug 931973 https://bugzilla.suse.com/931974 SUSE Bug 931974 https://bugzilla.suse.com/932040 SUSE Bug 932040 The snprintf implementation in PostgreSQL before 9.0.20, 9.1.x before 9.1.16, 9.2.x before 9.2.11, 9.3.x before 9.3.7, and 9.4.x before 9.4.2 does not properly handle system-call errors, which allows attackers to obtain sensitive information or have other unspecified impact via unknown vectors, as demonstrated by an out-of-memory error. CVE-2015-3166 SUSE Linux Enterprise Desktop 12:libecpg6-9.3.8-8.1 SUSE Linux Enterprise Desktop 12:libpq5-32bit-9.3.8-8.1 SUSE Linux Enterprise Desktop 12:libpq5-9.3.8-8.1 SUSE Linux Enterprise Desktop 12:postgresql93-9.3.8-8.1 SUSE Linux Enterprise Server 12:libecpg6-9.3.8-8.1 SUSE Linux Enterprise Server 12:libpq5-32bit-9.3.8-8.1 SUSE Linux Enterprise Server 12:libpq5-9.3.8-8.1 SUSE Linux Enterprise Server 12:postgresql93-9.3.8-8.1 SUSE Linux Enterprise Server 12:postgresql93-contrib-9.3.8-8.1 SUSE Linux Enterprise Server 12:postgresql93-docs-9.3.8-8.1 SUSE Linux Enterprise Server 12:postgresql93-server-9.3.8-8.1 SUSE Linux Enterprise Server for SAP Applications 12:libecpg6-9.3.8-8.1 SUSE Linux Enterprise Server for SAP Applications 12:libpq5-32bit-9.3.8-8.1 SUSE Linux Enterprise Server for SAP Applications 12:libpq5-9.3.8-8.1 SUSE Linux Enterprise Server for SAP Applications 12:postgresql93-9.3.8-8.1 SUSE Linux Enterprise Server for SAP Applications 12:postgresql93-contrib-9.3.8-8.1 SUSE Linux Enterprise Server for SAP Applications 12:postgresql93-docs-9.3.8-8.1 SUSE Linux Enterprise Server for SAP Applications 12:postgresql93-server-9.3.8-8.1 SUSE Linux Enterprise Software Development Kit 12:postgresql93-devel-9.3.8-8.1 critical To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20151264-1/ https://www.suse.com/security/cve/CVE-2015-3166.html CVE-2015-3166 https://bugzilla.suse.com/931972 SUSE Bug 931972 https://bugzilla.suse.com/931973 SUSE Bug 931973 https://bugzilla.suse.com/931974 SUSE Bug 931974 https://bugzilla.suse.com/932040 SUSE Bug 932040 contrib/pgcrypto in PostgreSQL before 9.0.20, 9.1.x before 9.1.16, 9.2.x before 9.2.11, 9.3.x before 9.3.7, and 9.4.x before 9.4.2 uses different error responses when an incorrect key is used, which makes it easier for attackers to obtain the key via a brute force attack. CVE-2015-3167 SUSE Linux Enterprise Desktop 12:libecpg6-9.3.8-8.1 SUSE Linux Enterprise Desktop 12:libpq5-32bit-9.3.8-8.1 SUSE Linux Enterprise Desktop 12:libpq5-9.3.8-8.1 SUSE Linux Enterprise Desktop 12:postgresql93-9.3.8-8.1 SUSE Linux Enterprise Server 12:libecpg6-9.3.8-8.1 SUSE Linux Enterprise Server 12:libpq5-32bit-9.3.8-8.1 SUSE Linux Enterprise Server 12:libpq5-9.3.8-8.1 SUSE Linux Enterprise Server 12:postgresql93-9.3.8-8.1 SUSE Linux Enterprise Server 12:postgresql93-contrib-9.3.8-8.1 SUSE Linux Enterprise Server 12:postgresql93-docs-9.3.8-8.1 SUSE Linux Enterprise Server 12:postgresql93-server-9.3.8-8.1 SUSE Linux Enterprise Server for SAP Applications 12:libecpg6-9.3.8-8.1 SUSE Linux Enterprise Server for SAP Applications 12:libpq5-32bit-9.3.8-8.1 SUSE Linux Enterprise Server for SAP Applications 12:libpq5-9.3.8-8.1 SUSE Linux Enterprise Server for SAP Applications 12:postgresql93-9.3.8-8.1 SUSE Linux Enterprise Server for SAP Applications 12:postgresql93-contrib-9.3.8-8.1 SUSE Linux Enterprise Server for SAP Applications 12:postgresql93-docs-9.3.8-8.1 SUSE Linux Enterprise Server for SAP Applications 12:postgresql93-server-9.3.8-8.1 SUSE Linux Enterprise Software Development Kit 12:postgresql93-devel-9.3.8-8.1 critical To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20151264-1/ https://www.suse.com/security/cve/CVE-2015-3167.html CVE-2015-3167 https://bugzilla.suse.com/931972 SUSE Bug 931972 https://bugzilla.suse.com/931973 SUSE Bug 931973 https://bugzilla.suse.com/931974 SUSE Bug 931974 https://bugzilla.suse.com/932040 SUSE Bug 932040