BugTraq
[SECURITY] [DSA 3374-1] postgresql-9.4 security update Oct 19 2015 03:40PM
Salvatore Bonaccorso (carnil debian org)
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

- ------------------------------------------------------------------------
-
Debian Security Advisory DSA-3374-1 security (at) debian (dot) org [email concealed]
https://www.debian.org/security/ Salvatore Bonaccorso
October 19, 2015 https://www.debian.org/security/faq
- ------------------------------------------------------------------------
-

Package : postgresql-9.4
CVE ID : CVE-2015-5288 CVE-2015-5289

Several vulnerabilities have been found in PostgreSQL-9.4, a SQL
database system.

CVE-2015-5288

Josh Kupershmidt discovered a vulnerability in the crypt() function
in the pgCrypto extension. Certain invalid salt arguments can cause
the server to crash or to disclose a few bytes of server memory.

CVE-2015-5289

Oskari Saarenmaa discovered that json or jsonb input values
constructed from arbitrary user input can crash the PostgreSQL
server and cause a denial of service.

For the stable distribution (jessie), these problems have been fixed in
version 9.4.5-0+deb8u1.

For the testing distribution (stretch), these problems have been fixed
in version 9.4.5-1.

For the unstable distribution (sid), these problems have been fixed in
version 9.4.5-1.

We recommend that you upgrade your postgresql-9.4 packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

Mailing list: debian-security-announce (at) lists.debian (dot) org [email concealed]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCgAGBQJWJQ6uAAoJEAVMuPMTQ89EgeYP/2ddc78SvGZvp0bvW8k9QReb
lPZuARqC1lmtLY51rDEM43aFDWwM01TpnoRvYyVXcphsalK16Sz0Ho7m20gqGrSj
RGNwG2zSQFcyU1OWINdEgmV10x/ufSrbyHQyf4m5hS9luMRlIGbGXV/DbSqvDF90
kNZ0NXz/g8iVOAf+9h+i6R5X6tPTAWgrj+X6IBngMi0jntvA30kAknUc73cnfrmG
YzxblZp5eMyf56EbXecbUfMz1751wxNxbp97HuQLv29KJ/FtYr8fwC1fJqmKje9S
ngqwrJw0RQphviZ2+QxaKk+7f+VuJdfRUqPKHUau62Uxk096rVRVD1p+wAGkLW7o
PoDqx3DrF05QnoqlxyIjAJ2Lkt9CW9RyGTDwxAzdq2VQ9jnxSoKmjGkVLMSf1T+t
Ljo3z3HSi+NYQJBwegD+Uy66dKwJ8au4qL+XkGpT9dnw40iryM9Li01w9H9tJYOE
Jea+ppT53JUWjA1EEz64qVEjlbFmp/sp4J1ggXTpp9pX06i88DJZ+9ff2PU/JLZa
Br6WnK6RgCbaIIAwjUBCb1qxUNFiJBfeD1fymhcEhudvd3tKRQHC0NPouNHw3VwE
s7sRCaNnS4s/wuYpJr+nxu3HR3CQgnPVTibISg6GLNBEBTWQGfbDhdUPTyAO2yZN
y/szRjAt/4yVhJiIZd+X
=sz5D
-----END PGP SIGNATURE-----

[ reply ]


 

Privacy Statement
Copyright 2010, SecurityFocus