Oval Definition:	oval:com.redhat.rhsa:def:20150750
Revision Date: 2015-03-30 Version: 635 Title: RHSA-2015:0750: postgresql security update (Moderate) Description: PostgreSQL is an advanced object-relational database management system (DBMS). An information leak flaw was found in the way the PostgreSQL database server handled certain error messages. An authenticated database user could possibly obtain the results of a query they did not have privileges to execute by observing the constraint violation error messages produced when the query was executed. (CVE-2014-8161) A buffer overflow flaw was found in the way PostgreSQL handled certain numeric formatting. An authenticated database user could use a specially crafted timestamp formatting template to cause PostgreSQL to crash or, under certain conditions, execute arbitrary code with the permissions of the user running PostgreSQL. (CVE-2015-0241) A stack-buffer overflow flaw was found in PostgreSQL's pgcrypto module. An authenticated database user could use this flaw to cause PostgreSQL to crash or, potentially, execute arbitrary code with the permissions of the user running PostgreSQL. (CVE-2015-0243) A flaw was found in the way PostgreSQL handled certain errors that were generated during protocol synchronization. An authenticated database user could use this flaw to inject queries into an existing connection. (CVE-2015-0244) Red Hat would like to thank the PostgreSQL project for reporting these issues. Upstream acknowledges Stephen Frost as the original reporter of CVE-2014-8161; Andres Freund, Peter Geoghegan, Bernd Helmle, and Noah Misch as the original reporters of CVE-2015-0241; Marko Tiikkaja as the original reporter of CVE-2015-0243; and Emil Lenngren as the original reporter of CVE-2015-0244. All PostgreSQL users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. If the postgresql service is running, it will be automatically restarted after installing this update. Family: unix Class: patch Status: Reference(s): CVE-2014-8161 CVE-2015-0241 CVE-2015-0243 CVE-2015-0244 RHSA-2015:0750 RHSA-2015:0750-00 RHSA-2015:0750-01 Platform(s): Red Hat Enterprise Linux 6 Red Hat Enterprise Linux 7 Product(s): Definition Synopsis Red Hat Enterprise Linux must be installed OR Package Information Red Hat Enterprise Linux 6 is installed AND postgresql is earlier than 0:8.4.20-2.el6_6 AND postgresql is signed with Red Hat redhatrelease2 key postgresql-contrib is earlier than 0:8.4.20-2.el6_6 AND postgresql-contrib is signed with Red Hat redhatrelease2 key postgresql-devel is earlier than 0:8.4.20-2.el6_6 AND postgresql-devel is signed with Red Hat redhatrelease2 key postgresql-docs is earlier than 0:8.4.20-2.el6_6 AND postgresql-docs is signed with Red Hat redhatrelease2 key postgresql-libs is earlier than 0:8.4.20-2.el6_6 AND postgresql-libs is signed with Red Hat redhatrelease2 key postgresql-plperl is earlier than 0:8.4.20-2.el6_6 AND postgresql-plperl is signed with Red Hat redhatrelease2 key postgresql-plpython is earlier than 0:8.4.20-2.el6_6 AND postgresql-plpython is signed with Red Hat redhatrelease2 key postgresql-pltcl is earlier than 0:8.4.20-2.el6_6 AND postgresql-pltcl is signed with Red Hat redhatrelease2 key postgresql-server is earlier than 0:8.4.20-2.el6_6 AND postgresql-server is signed with Red Hat redhatrelease2 key postgresql-test is earlier than 0:8.4.20-2.el6_6 AND postgresql-test is signed with Red Hat redhatrelease2 key OR Package Information Red Hat Enterprise Linux 7 is installed AND postgresql is earlier than 0:9.2.10-2.el7_1 AND postgresql is signed with Red Hat redhatrelease2 key postgresql-contrib is earlier than 0:9.2.10-2.el7_1 AND postgresql-contrib is signed with Red Hat redhatrelease2 key postgresql-devel is earlier than 0:9.2.10-2.el7_1 AND postgresql-devel is signed with Red Hat redhatrelease2 key postgresql-docs is earlier than 0:9.2.10-2.el7_1 AND postgresql-docs is signed with Red Hat redhatrelease2 key postgresql-libs is earlier than 0:9.2.10-2.el7_1 AND postgresql-libs is signed with Red Hat redhatrelease2 key postgresql-plperl is earlier than 0:9.2.10-2.el7_1 AND postgresql-plperl is signed with Red Hat redhatrelease2 key postgresql-plpython is earlier than 0:9.2.10-2.el7_1 AND postgresql-plpython is signed with Red Hat redhatrelease2 key postgresql-pltcl is earlier than 0:9.2.10-2.el7_1 AND postgresql-pltcl is signed with Red Hat redhatrelease2 key postgresql-server is earlier than 0:9.2.10-2.el7_1 AND postgresql-server is signed with Red Hat redhatrelease2 key postgresql-test is earlier than 0:9.2.10-2.el7_1 AND postgresql-test is signed with Red Hat redhatrelease2 key postgresql-upgrade is earlier than 0:9.2.10-2.el7_1 AND postgresql-upgrade is signed with Red Hat redhatrelease2 key Definition Synopsis Release Information Red Hat Enterprise Linux 6 Client is installed OR Red Hat Enterprise Linux 6 Server is installed OR Red Hat Enterprise Linux 6 Workstation is installed OR Red Hat Enterprise Linux 6 ComputeNode is installed AND postgresql is earlier than 0:8.4.20-2.el6_6 AND postgresql is signed with Red Hat redhatrelease2 key postgresql-contrib is earlier than 0:8.4.20-2.el6_6 AND postgresql-contrib is signed with Red Hat redhatrelease2 key postgresql-devel is earlier than 0:8.4.20-2.el6_6 AND postgresql-devel is signed with Red Hat redhatrelease2 key postgresql-docs is earlier than 0:8.4.20-2.el6_6 AND postgresql-docs is signed with Red Hat redhatrelease2 key postgresql-libs is earlier than 0:8.4.20-2.el6_6 AND postgresql-libs is signed with Red Hat redhatrelease2 key postgresql-plperl is earlier than 0:8.4.20-2.el6_6 AND postgresql-plperl is signed with Red Hat redhatrelease2 key postgresql-plpython is earlier than 0:8.4.20-2.el6_6 AND postgresql-plpython is signed with Red Hat redhatrelease2 key postgresql-pltcl is earlier than 0:8.4.20-2.el6_6 AND postgresql-pltcl is signed with Red Hat redhatrelease2 key postgresql-server is earlier than 0:8.4.20-2.el6_6 AND postgresql-server is signed with Red Hat redhatrelease2 key postgresql-test is earlier than 0:8.4.20-2.el6_6 AND postgresql-test is signed with Red Hat redhatrelease2 key OR Package Information Red Hat Enterprise Linux 7 Client is installed OR Red Hat Enterprise Linux 7 Server is installed OR Red Hat Enterprise Linux 7 Workstation is installed OR Red Hat Enterprise Linux 7 ComputeNode is installed AND postgresql is earlier than 0:9.2.10-2.el7_1 AND postgresql is signed with Red Hat redhatrelease2 key postgresql-contrib is earlier than 0:9.2.10-2.el7_1 AND postgresql-contrib is signed with Red Hat redhatrelease2 key postgresql-devel is earlier than 0:9.2.10-2.el7_1 AND postgresql-devel is signed with Red Hat redhatrelease2 key postgresql-docs is earlier than 0:9.2.10-2.el7_1 AND postgresql-docs is signed with Red Hat redhatrelease2 key postgresql-libs is earlier than 0:9.2.10-2.el7_1 AND postgresql-libs is signed with Red Hat redhatrelease2 key postgresql-plperl is earlier than 0:9.2.10-2.el7_1 AND postgresql-plperl is signed with Red Hat redhatrelease2 key postgresql-plpython is earlier than 0:9.2.10-2.el7_1 AND postgresql-plpython is signed with Red Hat redhatrelease2 key postgresql-pltcl is earlier than 0:9.2.10-2.el7_1 AND postgresql-pltcl is signed with Red Hat redhatrelease2 key postgresql-server is earlier than 0:9.2.10-2.el7_1 AND postgresql-server is signed with Red Hat redhatrelease2 key postgresql-test is earlier than 0:9.2.10-2.el7_1 AND postgresql-test is signed with Red Hat redhatrelease2 key postgresql-upgrade is earlier than 0:9.2.10-2.el7_1 AND postgresql-upgrade is signed with Red Hat redhatrelease2 key
BACK