-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Format: 1.8
Date: Sat, 25 Feb 2012 11:52:09 +0100
Source: postgresql-8.4
Binary: libpq-dev libpq5 libecpg6 libecpg-dev libecpg-compat3 libpgtypes3 postgresql-8.4 postgresql-client-8.4 postgresql-server-dev-8.4 postgresql-doc-8.4 postgresql-contrib-8.4 postgresql-plperl-8.4 postgresql-plpython-8.4 postgresql-pltcl-8.4 postgresql postgresql-client postgresql-doc postgresql-contrib
Architecture: source all amd64
Version: 8.4.11-0squeeze1
Distribution: stable-security
Urgency: high
Maintainer: Martin Pitt <mpitt@debian.org>
Changed-By: Martin Pitt <mpitt@debian.org>
Description:
libecpg-compat3 - older version of run-time library for ECPG programs
libecpg-dev - development files for ECPG (Embedded PostgreSQL for C)
libecpg6 - run-time library for ECPG programs
libpgtypes3 - shared library libpgtypes for PostgreSQL 8.4
libpq-dev - header files for libpq5 (PostgreSQL library)
libpq5 - PostgreSQL C client library
postgresql - object-relational SQL database (supported version)
postgresql-8.4 - object-relational SQL database, version 8.4 server
postgresql-client - front-end programs for PostgreSQL (supported version)
postgresql-client-8.4 - front-end programs for PostgreSQL 8.4
postgresql-contrib - additional facilities for PostgreSQL (supported version)
postgresql-contrib-8.4 - additional facilities for PostgreSQL
postgresql-doc - documentation for the PostgreSQL database management system
postgresql-doc-8.4 - documentation for the PostgreSQL database management system
postgresql-plperl-8.4 - PL/Perl procedural language for PostgreSQL 8.4
postgresql-plpython-8.4 - PL/Python procedural language for PostgreSQL 8.4
postgresql-pltcl-8.4 - PL/Tcl procedural language for PostgreSQL 8.4
postgresql-server-dev-8.4 - development files for PostgreSQL 8.4 server-side programming
Changes:
postgresql-8.4 (8.4.11-0squeeze1) stable-security; urgency=high
.
* New upstream bug fix/security release:
- Require execute permission on the trigger function for "CREATE
TRIGGER".
This missing check could allow another user to execute a trigger
function with forged input data, by installing it on a table he
owns. This is only of significance for trigger functions marked
SECURITY DEFINER, since otherwise trigger functions run as the
table owner anyway. (CVE-2012-0866)
- Remove arbitrary limitation on length of common name in SSL
certificates.
Both libpq and the server truncated the common name extracted from
an SSL certificate at 32 bytes. Normally this would cause nothing
worse than an unexpected verification failure, but there are some
rather-implausible scenarios in which it might allow one
certificate holder to impersonate another. The victim would have to
have a common name exactly 32 bytes long, and the attacker would
have to persuade a trusted CA to issue a certificate in which the
common name has that string as a prefix. Impersonating a server
would also require some additional exploit to redirect client
connections. (CVE-2012-0867)
- Convert newlines to spaces in names written in pg_dump comments.
pg_dump was incautious about sanitizing object names that are
emitted within SQL comments in its output script. A name containing
a newline would at least render the script syntactically incorrect.
Maliciously crafted object names could present a SQL injection risk
when the script is reloaded. (CVE-2012-0868)
- Fix btree index corruption from insertions concurrent with
vacuuming.
An index page split caused by an insertion could sometimes cause a
concurrently-running "VACUUM" to miss removing index entries that
it should remove. After the corresponding table rows are removed,
the dangling index entries would cause errors (such as "could not
read block N in file ...") or worse, silently wrong query results
after unrelated rows are re-inserted at the now-free table
locations. This bug has been present since release 8.2, but occurs
so infrequently that it was not diagnosed until now. If you have
reason to suspect that it has happened in your database, reindexing
the affected index will fix things.
- Update per-column permissions, not only per-table permissions, when
changing table owner.
Failure to do this meant that any previously granted column
permissions were still shown as having been granted by the old
owner. This meant that neither the new owner nor a superuser could
revoke the now-untraceable-to-table-owner permissions.
- Allow non-existent values for some settings in "ALTER USER/DATABASE
SET".
Allow default_text_search_config, default_tablespace, and
temp_tablespaces to be set to names that are not known. This is
because they might be known in another database where the setting
is intended to be used, or for the tablespace cases because the
tablespace might not be created yet. The same issue was previously
recognized for search_path, and these settings now act like that
one.
- Avoid crashing when we have problems deleting table files
post-commit.
Dropping a table should lead to deleting the underlying disk files
only after the transaction commits. In event of failure then (for
instance, because of wrong file permissions) the code is supposed
to just emit a warning message and go on, since it's too late to
abort the transaction. This logic got broken as of release 8.4,
causing such situations to result in a PANIC and an unrestartable
database.
- Track the OID counter correctly during WAL replay, even when it
wraps around.
Previously the OID counter would remain stuck at a high value until
the system exited replay mode. The practical consequences of that
are usually nil, but there are scenarios wherein a standby server
that's been promoted to master might take a long time to advance
the OID counter to a reasonable value once values are needed.
- Fix regular expression back-references with - attached.
Rather than enforcing an exact string match, the code would
effectively accept any string that satisfies the pattern
sub-expression referenced by the back-reference symbol.
A similar problem still afflicts back-references that are embedded
in a larger quantified expression, rather than being the immediate
subject of the quantifier. This will be addressed in a future
PostgreSQL release.
- Fix recently-introduced memory leak in processing of inet/cidr
values.
- Fix dangling pointer after "CREATE TABLE AS"/"SELECT INTO" in a
SQL-language function.
In most cases this only led to an assertion failure in
assert-enabled builds, but worse consequences seem possible.
- Fix I/O-conversion-related memory leaks in plpgsql.
- Improve pg_dump's handling of inherited table columns.
pg_dump mishandled situations where a child column has a different
default expression than its parent column. If the default is
textually identical to the parent's default, but not actually the
same (for instance, because of schema search path differences) it
would not be recognized as different, so that after dump and
restore the child would be allowed to inherit the parent's default.
Child columns that are NOT NULL where their parent is not could
also be restored subtly incorrectly.
- Fix pg_restore's direct-to-database mode for INSERT-style table
data.
Direct-to-database restores from archive files made with
"--inserts" or "--column-inserts" options fail when using
pg_restore from a release dated September or December 2011, as a
result of an oversight in a fix for another problem. The archive
file itself is not at fault, and text-mode output is okay.
- Allow AT option in ecpg DEALLOCATE statements.
The infrastructure to support this has been there for awhile, but
through an oversight there was still an error check rejecting the
case.
- Fix error in "contrib/intarray"'s int[] & int[] operator.
If the smallest integer the two input arrays have in common is 1,
and there are smaller values in either array, then 1 would be
incorrectly omitted from the result.
- Fix error detection in "contrib/pgcrypto"'s encrypt_iv() and
decrypt_iv().
These functions failed to report certain types of invalid-input
errors, and would instead return random garbage values for
incorrect input.
- Fix one-byte buffer overrun in "contrib/test_parser".
The code would try to read one more byte than it should, which
would crash in corner cases. Since "contrib/test_parser" is only
example code, this is not a security issue in itself, but bad
example code is still bad.
- Use __sync_lock_test_and_set() for spinlocks on ARM, if available.
This function replaces our previous use of the SWPB instruction,
which is deprecated and not available on ARMv6 and later. Reports
suggest that the old code doesn't fail in an obvious way on recent
ARM boards, but simply doesn't interlock concurrent accesses,
leading to bizarre failures in multiprocess operation.
- Use "-fexcess-precision=standard" option when building with gcc
versions that accept it.
This prevents assorted scenarios wherein recent versions of gcc
will produce creative results.
- Allow use of threaded Python on FreeBSD.
Our configure script previously believed that this combination
wouldn't work; but FreeBSD fixed the problem, so remove that error
check.
* Drop 04-armel-tas.patch, applied upstream.
Checksums-Sha1:
8644d70f3c7003d22e81edb227d226a8f8114c3e 2506 postgresql-8.4_8.4.11-0squeeze1.dsc
b12084003937d8ed59287b6db2508e098ac52953 18178451 postgresql-8.4_8.4.11.orig.tar.gz
97e0409e7346da7479cbd8df0722cc8a20e82c3d 55229 postgresql-8.4_8.4.11-0squeeze1.diff.gz
f05543ae7c832dcd0bb0d689cb6a28a16536d182 2182820 postgresql-doc-8.4_8.4.11-0squeeze1_all.deb
718fbabbbe81d8e04fc74f6a00e634870f2a4db2 28062 postgresql_8.4.11-0squeeze1_all.deb
b5a6c09a161f628dfaf70f32b8cd0afe171da6d3 28026 postgresql-client_8.4.11-0squeeze1_all.deb
b11bc278654188f9f6d95f63b6320b46ea1fe9d5 27870 postgresql-doc_8.4.11-0squeeze1_all.deb
4af16a6b25ccb2f8e77939a09e266b3a58612ba9 27928 postgresql-contrib_8.4.11-0squeeze1_all.deb
de9f8ee99c7f76d00ca6b740f250a33cb19042ac 247150 libpq-dev_8.4.11-0squeeze1_amd64.deb
410531cfd4db684f000d22db3506d4b1660d655f 167854 libpq5_8.4.11-0squeeze1_amd64.deb
bd07c32ef0cdf0935e5ce0a1f2096a95305f7e13 101206 libecpg6_8.4.11-0squeeze1_amd64.deb
c909b9ab7f797bbb51808e55be75d1a1f4c3face 265982 libecpg-dev_8.4.11-0squeeze1_amd64.deb
4ef72a5fd5b5ea9fd5b1d484ff387a4a033d2783 35966 libecpg-compat3_8.4.11-0squeeze1_amd64.deb
987cd33bf772f2cf495cd781a82f3944b053bee6 59792 libpgtypes3_8.4.11-0squeeze1_amd64.deb
f0a3f07d2c9978db58e3d25741918842287a7cd2 5487656 postgresql-8.4_8.4.11-0squeeze1_amd64.deb
2644f7b0d0c27b45aa387187988eafd3daf059f0 1536812 postgresql-client-8.4_8.4.11-0squeeze1_amd64.deb
912e599896b4f8fba0083bd73113477869b97087 644430 postgresql-server-dev-8.4_8.4.11-0squeeze1_amd64.deb
5f904b4dc8f5756ead6c162b1cfc93ff6a3034b8 438728 postgresql-contrib-8.4_8.4.11-0squeeze1_amd64.deb
aa6808887a457e996a9c3539d32770c7510fed00 65286 postgresql-plperl-8.4_8.4.11-0squeeze1_amd64.deb
e90802db82a0fe0909cb26546d433cd0cbe5a305 66586 postgresql-plpython-8.4_8.4.11-0squeeze1_amd64.deb
0e5944b36c313f2dfedfe6c474218887e0621f4c 51178 postgresql-pltcl-8.4_8.4.11-0squeeze1_amd64.deb
Checksums-Sha256:
5ada8540b8737aa4af85ff5e82280aff8788adc0f9123f2bb9fbeb7402499ab2 2506 postgresql-8.4_8.4.11-0squeeze1.dsc
5d430fe7b72ad466d477867bad8ee428b25eeefbd161560dc13ac73d77b3541d 18178451 postgresql-8.4_8.4.11.orig.tar.gz
3664b81f1fe43e8a8f46ffe9812c8397307324fa72768b8ec54cfceda12a0da3 55229 postgresql-8.4_8.4.11-0squeeze1.diff.gz
58b993536ffe0ec69e6eeb2b91797a5354b93708636ca6c9a4bdb54e160cdace 2182820 postgresql-doc-8.4_8.4.11-0squeeze1_all.deb
4aa5da24da6636d068f092a33e320d9b8d995b1a56d7812ca2c50cf66d2db200 28062 postgresql_8.4.11-0squeeze1_all.deb
73be959d6d361c51953185fb07def62b5c05253b5e69fcd3b9e1fa0d10839036 28026 postgresql-client_8.4.11-0squeeze1_all.deb
f3fe429b3a2dd53292eb32f0e387e1f90d6e03bffdb590c5b0db0f6051c69f2c 27870 postgresql-doc_8.4.11-0squeeze1_all.deb
60f5b13c3ea027e84051dd3fbaf85446544a39a2f0a1b2c5822695fb48cf2189 27928 postgresql-contrib_8.4.11-0squeeze1_all.deb
d8416c0546561d670309e851f15585e27a2cdab519a118402b079a788ab68a4f 247150 libpq-dev_8.4.11-0squeeze1_amd64.deb
9aac7352aaeb771e6f70297a0e06f6023fad1f9fc1ff06039907b8d776dfa0ac 167854 libpq5_8.4.11-0squeeze1_amd64.deb
8a0d8953d4f1600a3e33d7c0e2d5ad1a8d0461d893ee4e78bafdbacc5cd6e7c1 101206 libecpg6_8.4.11-0squeeze1_amd64.deb
88d4ee83a566ffa1163be7672ff91087ecdf61c8fb8a4cbcb122698a509010fa 265982 libecpg-dev_8.4.11-0squeeze1_amd64.deb
fc6c4108bf88c706bb0083daa301557cb6ef84da0c0ef463eda51aea7e1d47d6 35966 libecpg-compat3_8.4.11-0squeeze1_amd64.deb
3d465d6be57ce523375b1ccc21f1c1832731c89e1bd8705a7409b6b1b3610247 59792 libpgtypes3_8.4.11-0squeeze1_amd64.deb
468890058a7669cbe136569cdaa2eead1c399ce74a88db928372261a8c7fe081 5487656 postgresql-8.4_8.4.11-0squeeze1_amd64.deb
af90c842ee0acc4a4530157dda0e0a6cad8ae337231ec837751393c633db3dd0 1536812 postgresql-client-8.4_8.4.11-0squeeze1_amd64.deb
60b45bff274530b4be87de85dfa5c11cb2ffefe300ab8c4117aa175bc79354d1 644430 postgresql-server-dev-8.4_8.4.11-0squeeze1_amd64.deb
b0542a90a61711bc9e2710e4ab485ffe7fb9c649df6e20e42456526d4d0e554d 438728 postgresql-contrib-8.4_8.4.11-0squeeze1_amd64.deb
b6dfb7d62e6f92d1c122e1d1a0a0b393bea4937662776ec1049d8a74716b8b4e 65286 postgresql-plperl-8.4_8.4.11-0squeeze1_amd64.deb
a0aa327b22d4c945a40a58a8b566af55806bf3b4842653d9993feb701468aedb 66586 postgresql-plpython-8.4_8.4.11-0squeeze1_amd64.deb
05c9c4fc0f90f9346f41bbc0c26e2bf4ba7a90cab36f5f26186c1e30542fc6cd 51178 postgresql-pltcl-8.4_8.4.11-0squeeze1_amd64.deb
Files:
330e50d39a30a2062753e20ae23afce7 2506 database optional postgresql-8.4_8.4.11-0squeeze1.dsc
413b8ae9ae6e7f053e2a992e068af63e 18178451 database optional postgresql-8.4_8.4.11.orig.tar.gz
3e5e309f8ee09cab04230be653872b43 55229 database optional postgresql-8.4_8.4.11-0squeeze1.diff.gz
5a4eef5bee88caa86ed95981846bd29e 2182820 doc optional postgresql-doc-8.4_8.4.11-0squeeze1_all.deb
470296f796370ac62f6e8cce1a14f521 28062 database optional postgresql_8.4.11-0squeeze1_all.deb
72e7268712d4a3facd69f93a0f125d62 28026 database optional postgresql-client_8.4.11-0squeeze1_all.deb
f428db5e3a18686b893d7ea57d4e42b6 27870 doc optional postgresql-doc_8.4.11-0squeeze1_all.deb
f181748a3ec3b08cee6cd9353a4f6ad4 27928 database optional postgresql-contrib_8.4.11-0squeeze1_all.deb
3b27b057696158c20b3d72c95f98dbdb 247150 libdevel optional libpq-dev_8.4.11-0squeeze1_amd64.deb
697b5ae846916594b100d20e30c18c09 167854 libs optional libpq5_8.4.11-0squeeze1_amd64.deb
00e6fc7ebe33fc476145a0db70eaaff3 101206 libs optional libecpg6_8.4.11-0squeeze1_amd64.deb
2eaecbbfa9d2b545a3f9c42ecc094d97 265982 libdevel optional libecpg-dev_8.4.11-0squeeze1_amd64.deb
41923a06d5e298ce3bcc688367f613e8 35966 libs optional libecpg-compat3_8.4.11-0squeeze1_amd64.deb
69b69f80b044907f071d3ff1efee6c28 59792 libs optional libpgtypes3_8.4.11-0squeeze1_amd64.deb
be7125380e50308a27f1a21d14f39c06 5487656 database optional postgresql-8.4_8.4.11-0squeeze1_amd64.deb
a27f5201951a28554c104ed34dccf56f 1536812 database optional postgresql-client-8.4_8.4.11-0squeeze1_amd64.deb
e5fb7ca880aa486d3b222b961520090c 644430 libdevel optional postgresql-server-dev-8.4_8.4.11-0squeeze1_amd64.deb
8fe4e91d3d1a357bb7370db62eb6f85e 438728 database optional postgresql-contrib-8.4_8.4.11-0squeeze1_amd64.deb
a5b60959f43aecf61d91d407e1cc590b 65286 database optional postgresql-plperl-8.4_8.4.11-0squeeze1_amd64.deb
c4887515d6c7cb4dfa9755d2a99cb1d4 66586 database optional postgresql-plpython-8.4_8.4.11-0squeeze1_amd64.deb
3f63065e724989488305ae8f58cdc346 51178 database optional postgresql-pltcl-8.4_8.4.11-0squeeze1_amd64.deb
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)
iQIcBAEBCAAGBQJPSMIaAAoJEPmIJawmtHufwaoP/2JWASsj769JnOEA4XacwXs3
myB8SY/TYQBCSh9VlOrE5JOXRE1kdqxus1uT0q9E2Az+WlxR26HggEA5Qd8xk+dV
CFJyfKD3sFEa7L/tZ5b/kK9bjwxKcbTzxlcvsQ/IIX4aD1TKyXGDx1Ulv2Q0/2Bi
KHDJZfQaiY42RJ+23375LFG/zF4WhHrR6sr5dItqYyJeh+1YGCw8tdjvMvHHXTnN
3gqwjP24HiHmPbaeypNuj/vZ2pGmxQmkH+0LeRjBvb+yMWZzgI7X10DoSQ7CRUVe
1PNQ7oFgHDlxT1Oahu8IUSAzjh4C8MSmgNSwbuqaTk7gy5lN2S+htIWjdHwJBPoG
wLNIAkc56d+/MSFPsId3zDENOndEWlOeJV/O3cnbUAiVzzDtuI1xDFGi0RFNqfXv
VLrQCaH8q2JYevk5iZry2DPK/Dk21WUpv3WF1lNjt/dtN9kGGlx2Go57uHW3LbKB
xSyLvy6fCEK9/fcMZJgM+dVEjTcOOuprkHcvtvEsgEmCwgwAYN6Ha+fAE9WzoAcd
lHXbXMYdXJwag2CE1LjT+r65eqEuqi/r+wLUtmR2DhSsc9P4m2Hnc26nExh0W+Dr
djaDlUghE7o8WUfrpuNq0jAp4RhmJ4HT1Cq9pYZmg9MY5MDCi+0CFrxDQB4mFpej
hG2yx3m5uYpi3tGVk84C
=HSWN
-----END PGP SIGNATURE-----
Accepted:
libecpg-compat3_8.4.11-0squeeze1_amd64.deb
to main/p/postgresql-8.4/libecpg-compat3_8.4.11-0squeeze1_amd64.deb
libecpg-dev_8.4.11-0squeeze1_amd64.deb
to main/p/postgresql-8.4/libecpg-dev_8.4.11-0squeeze1_amd64.deb
libecpg6_8.4.11-0squeeze1_amd64.deb
to main/p/postgresql-8.4/libecpg6_8.4.11-0squeeze1_amd64.deb
libpgtypes3_8.4.11-0squeeze1_amd64.deb
to main/p/postgresql-8.4/libpgtypes3_8.4.11-0squeeze1_amd64.deb
libpq-dev_8.4.11-0squeeze1_amd64.deb
to main/p/postgresql-8.4/libpq-dev_8.4.11-0squeeze1_amd64.deb
libpq5_8.4.11-0squeeze1_amd64.deb
to main/p/postgresql-8.4/libpq5_8.4.11-0squeeze1_amd64.deb
postgresql-8.4_8.4.11-0squeeze1.diff.gz
to main/p/postgresql-8.4/postgresql-8.4_8.4.11-0squeeze1.diff.gz
postgresql-8.4_8.4.11-0squeeze1.dsc
to main/p/postgresql-8.4/postgresql-8.4_8.4.11-0squeeze1.dsc
postgresql-8.4_8.4.11-0squeeze1_amd64.deb
to main/p/postgresql-8.4/postgresql-8.4_8.4.11-0squeeze1_amd64.deb
postgresql-client-8.4_8.4.11-0squeeze1_amd64.deb
to main/p/postgresql-8.4/postgresql-client-8.4_8.4.11-0squeeze1_amd64.deb
postgresql-client_8.4.11-0squeeze1_all.deb
to main/p/postgresql-8.4/postgresql-client_8.4.11-0squeeze1_all.deb
postgresql-contrib-8.4_8.4.11-0squeeze1_amd64.deb
to main/p/postgresql-8.4/postgresql-contrib-8.4_8.4.11-0squeeze1_amd64.deb
postgresql-contrib_8.4.11-0squeeze1_all.deb
to main/p/postgresql-8.4/postgresql-contrib_8.4.11-0squeeze1_all.deb
postgresql-doc-8.4_8.4.11-0squeeze1_all.deb
to main/p/postgresql-8.4/postgresql-doc-8.4_8.4.11-0squeeze1_all.deb
postgresql-doc_8.4.11-0squeeze1_all.deb
to main/p/postgresql-8.4/postgresql-doc_8.4.11-0squeeze1_all.deb
postgresql-plperl-8.4_8.4.11-0squeeze1_amd64.deb
to main/p/postgresql-8.4/postgresql-plperl-8.4_8.4.11-0squeeze1_amd64.deb
postgresql-plpython-8.4_8.4.11-0squeeze1_amd64.deb
to main/p/postgresql-8.4/postgresql-plpython-8.4_8.4.11-0squeeze1_amd64.deb
postgresql-pltcl-8.4_8.4.11-0squeeze1_amd64.deb
to main/p/postgresql-8.4/postgresql-pltcl-8.4_8.4.11-0squeeze1_amd64.deb
postgresql-server-dev-8.4_8.4.11-0squeeze1_amd64.deb
to main/p/postgresql-8.4/postgresql-server-dev-8.4_8.4.11-0squeeze1_amd64.deb
postgresql_8.4.11-0squeeze1_all.deb
to main/p/postgresql-8.4/postgresql_8.4.11-0squeeze1_all.deb
