Oval Definition:	oval:com.redhat.rhsa:def:20121264
Revision Date: 2012-09-13 Version: 634 Title: RHSA-2012:1264: postgresql security update (Moderate) Description: PostgreSQL is an advanced object-relational database management system (DBMS). It was found that the optional PostgreSQL xml2 contrib module allowed local files and remote URLs to be read and written to with the privileges of the database server when parsing Extensible Stylesheet Language Transformations (XSLT). An unprivileged database user could use this flaw to read and write to local files (such as the database's configuration files) and remote URLs they would otherwise not have access to by issuing a specially-crafted SQL query. (CVE-2012-3488) Red Hat would like to thank the PostgreSQL project for reporting this issue. Upstream acknowledges Peter Eisentraut as the original reporter. All PostgreSQL users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. If the postgresql service is running, it will be automatically restarted after installing this update. Family: unix Class: patch Status: Reference(s): CVE-2012-3488 RHSA-2012:1264 RHSA-2012:1264-00 RHSA-2012:1264-01 RHSA-2012:1264-01 Platform(s): Red Hat Enterprise Linux 5 Product(s): Definition Synopsis Red Hat Enterprise Linux must be installed OR Package Information Red Hat Enterprise Linux 5 is installed AND postgresql is earlier than 0:8.1.23-6.el5_8 AND postgresql is signed with Red Hat redhatrelease2 key postgresql-contrib is earlier than 0:8.1.23-6.el5_8 AND postgresql-contrib is signed with Red Hat redhatrelease2 key postgresql-devel is earlier than 0:8.1.23-6.el5_8 AND postgresql-devel is signed with Red Hat redhatrelease2 key postgresql-docs is earlier than 0:8.1.23-6.el5_8 AND postgresql-docs is signed with Red Hat redhatrelease2 key postgresql-libs is earlier than 0:8.1.23-6.el5_8 AND postgresql-libs is signed with Red Hat redhatrelease2 key postgresql-pl is earlier than 0:8.1.23-6.el5_8 AND postgresql-pl is signed with Red Hat redhatrelease2 key postgresql-python is earlier than 0:8.1.23-6.el5_8 AND postgresql-python is signed with Red Hat redhatrelease2 key postgresql-server is earlier than 0:8.1.23-6.el5_8 AND postgresql-server is signed with Red Hat redhatrelease2 key postgresql-tcl is earlier than 0:8.1.23-6.el5_8 AND postgresql-tcl is signed with Red Hat redhatrelease2 key postgresql-test is earlier than 0:8.1.23-6.el5_8 AND postgresql-test is signed with Red Hat redhatrelease2 key
BACK