CVE-2016-0773

These are all security issues fixed in the postgresql94-9.4.10-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the postgresql93-9.3.15-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the libecpg6-32bit-9.5.4-1.2 package on the GA media of openSUSE Tumbleweed.

This update for postgresql93 fixes the following issues:

• Security and bugfix release 9.3.11:
  • Fix infinite loops and buffer-overrun problems in regular expressions (CVE-2016-0773, bsc#966436).
  • Fix regular-expression compiler to handle loops of constraint arcs (CVE-2007-4772).
  • Prevent certain PL/Java parameters from being set by non-superusers (CVE-2016-0766, bsc#966435).
  • Fix many issues in pg_dump with specific object types
  • Prevent over-eager pushdown of HAVING clauses for GROUPING SETS
  • Fix deparsing error with ON CONFLICT ... WHERE clauses
  • Fix tableoid errors for postgres_fdw
  • Prevent floating-point exceptions in pgbench
  • Make \det search Foreign Table names consistently
  • Fix quoting of domain constraint names in pg_dump
  • Prevent putting expanded objects into Const nodes
  • Allow compile of PL/Java on Windows
  • Fix 'unresolved symbol' errors in PL/Python execution
  • Allow Python2 and Python3 to be used in the same database
  • Add support for Python 3.5 in PL/Python
  • Fix issue with subdirectory creation during initdb
  • Make pg_ctl report status correctly on Windows
  • Suppress confusing error when using pg_receivexlog with older servers
  • Multiple documentation corrections and additions
  • Fix erroneous hash calculations in gin_extract_jsonb_path()
• For the full release notse, see: http://www.postgresql.org/docs/9.3/static/release-9-3-11.html

This update for postgresql94 fixes the following issues:

• Security and bugfix release 9.4.6:

  • *** IMPORTANT *** Users of version 9.4 will need to reindex any jsonb_path_ops indexes they have created, in order to fix a persistent issue with missing index entries.
  • Fix infinite loops and buffer-overrun problems in regular expressions (CVE-2016-0773, bsc#966436).
  • Fix regular-expression compiler to handle loops of constraint arcs (CVE-2007-4772).
  • Prevent certain PL/Java parameters from being set by non-superusers (CVE-2016-0766, bsc#966435).
  • Fix many issues in pg_dump with specific object types
  • Prevent over-eager pushdown of HAVING clauses for GROUPING SETS
  • Fix deparsing error with ON CONFLICT ... WHERE clauses
  • Fix tableoid errors for postgres_fdw
  • Prevent floating-point exceptions in pgbench
  • Make \det search Foreign Table names consistently
  • Fix quoting of domain constraint names in pg_dump
  • Prevent putting expanded objects into Const nodes
  • Allow compile of PL/Java on Windows
  • Fix 'unresolved symbol' errors in PL/Python execution
  • Allow Python2 and Python3 to be used in the same database
  • Add support for Python 3.5 in PL/Python
  • Fix issue with subdirectory creation during initdb
  • Make pg_ctl report status correctly on Windows
  • Suppress confusing error when using pg_receivexlog with older servers
  • Multiple documentation corrections and additions
  • Fix erroneous hash calculations in gin_extract_jsonb_path()

• For the full release notse, see: http://www.postgresql.org/docs/9.4/static/release-9-4-6.html

• PL/Perl still needs to be linked with rpath, so that it can find libperl.so at runtime. bsc#578053, postgresql-plperl-keep-rpath.patch

This update for postgresql94 fixes the following issues:

• Security and bugfix release 9.4.6:

  • *** IMPORTANT *** Users of version 9.4 will need to reindex any jsonb_path_ops indexes they have created, in order to fix a persistent issue with missing index entries.
  • Fix infinite loops and buffer-overrun problems in regular expressions (CVE-2016-0773, bsc#966436).
  • Fix regular-expression compiler to handle loops of constraint arcs (CVE-2007-4772).
  • Prevent certain PL/Java parameters from being set by non-superusers (CVE-2016-0766, bsc#966435).
  • Fix many issues in pg_dump with specific object types
  • Prevent over-eager pushdown of HAVING clauses for GROUPING SETS
  • Fix deparsing error with ON CONFLICT ... WHERE clauses
  • Fix tableoid errors for postgres_fdw
  • Prevent floating-point exceptions in pgbench
  • Make \det search Foreign Table names consistently
  • Fix quoting of domain constraint names in pg_dump
  • Prevent putting expanded objects into Const nodes
  • Allow compile of PL/Java on Windows
  • Fix 'unresolved symbol' errors in PL/Python execution
  • Allow Python2 and Python3 to be used in the same database
  • Add support for Python 3.5 in PL/Python
  • Fix issue with subdirectory creation during initdb
  • Make pg_ctl report status correctly on Windows
  • Suppress confusing error when using pg_receivexlog with older servers
  • Multiple documentation corrections and additions
  • Fix erroneous hash calculations in gin_extract_jsonb_path()

• For the full release notse, see: http://www.postgresql.org/docs/9.4/static/release-9-4-6.html

• Security and bugfix release 9.4.5:

  • CVE-2015-5289, bsc#949670: json or jsonb input values constructed from arbitrary user input can crash the PostgreSQL server and cause a denial of service.
  • CVE-2015-5288, bsc#949669: The crypt() function included with the optional pgCrypto extension could be exploited to read a few additional bytes of memory. No working exploit for this issue has been developed.

• For the full release notse, see: http://www.postgresql.org/docs/current/static/release-9-4-5.html

• Relax dependency on libpq to major version.

It was discovered that PostgreSQL incorrectly handled certain regular expressions. A remote attacker could possibly use this issue to cause PostgreSQL to crash, resulting in a denial of service. (CVE-2016-0773)

It was discovered that PostgreSQL incorrectly handled certain configuration settings (GUCS) for users of PL/Java. A remote attacker could possibly use this issue to escalate privileges. (CVE-2016-0766)