openSUSE Security Update: Security update for postgresql95 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0529-1 Rating: important References: #1051684 #1051685 #1053259 #1067841 #1067844 #1077983 #1079757 Cross-References: CVE-2017-15098 CVE-2017-15099 CVE-2017-7546 CVE-2017-7547 CVE-2017-7548 CVE-2018-1053 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that solves 6 vulnerabilities and has one errata is now available. Description: This update for postgresql95 fixes the following issues: Upate to PostgreSQL 9.5.11: Security issues fixed: * https://www.postgresql.org/docs/9.5/static/release-9-5-11.html * CVE-2018-1053, boo#1077983: Ensure that all temporary files made by pg_upgrade are non-world-readable. * boo#1079757: Rename pg_rewind's copy_file_range function to avoid conflict with new Linux system call of that name. In version 9.5.10: * https://www.postgresql.org/docs/9.5/static/release-9-5-10.html * CVE-2017-15098, boo#1067844: Memory disclosure in JSON functions. * CVE-2017-15099, boo#1067841: INSERT ... ON CONFLICT DO UPDATE fails to enforce SELECT privileges. In version 9.5.9: * https://www.postgresql.org/docs/9.5/static/release-9-5-9.html * Show foreign tables in information_schema.table_privileges view. * Clean up handling of a fatal exit (e.g., due to receipt of SIGTERM) that occurs while trying to execute a ROLLBACK of a failed transaction. * Remove assertion that could trigger during a fatal exit. * Correctly identify columns that are of a range type or domain type over a composite type or domain type being searched for. * Fix crash in pg_restore when using parallel mode and using a list file to select a subset of items to restore. * Change ecpg's parser to allow RETURNING clauses without attached C variables. In version 9.5.8 * https://www.postgresql.org/docs/9.5/static/release-9-5-8.html * CVE-2017-7547, boo#1051685: Further restrict visibility of pg_user_mappings.umoptions, to protect passwords stored as user mapping options. * CVE-2017-7546, boo#1051684: Disallow empty passwords in all password-based authentication methods. * CVE-2017-7548, boo#1053259: lo_put() function ignores ACLs. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-204=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): postgresql95-9.5.11-2.3.1 postgresql95-contrib-9.5.11-2.3.1 postgresql95-contrib-debuginfo-9.5.11-2.3.1 postgresql95-debuginfo-9.5.11-2.3.1 postgresql95-debugsource-9.5.11-2.3.1 postgresql95-devel-9.5.11-2.3.1 postgresql95-devel-debuginfo-9.5.11-2.3.1 postgresql95-libs-debugsource-9.5.11-2.3.1 postgresql95-plperl-9.5.11-2.3.1 postgresql95-plperl-debuginfo-9.5.11-2.3.1 postgresql95-plpython-9.5.11-2.3.1 postgresql95-plpython-debuginfo-9.5.11-2.3.1 postgresql95-pltcl-9.5.11-2.3.1 postgresql95-pltcl-debuginfo-9.5.11-2.3.1 postgresql95-server-9.5.11-2.3.1 postgresql95-server-debuginfo-9.5.11-2.3.1 postgresql95-test-9.5.11-2.3.1 - openSUSE Leap 42.3 (noarch): postgresql95-docs-9.5.11-2.3.1 References: https://www.suse.com/security/cve/CVE-2017-15098.html https://www.suse.com/security/cve/CVE-2017-15099.html https://www.suse.com/security/cve/CVE-2017-7546.html https://www.suse.com/security/cve/CVE-2017-7547.html https://www.suse.com/security/cve/CVE-2017-7548.html https://www.suse.com/security/cve/CVE-2018-1053.html https://bugzilla.suse.com/1051684 https://bugzilla.suse.com/1051685 https://bugzilla.suse.com/1053259 https://bugzilla.suse.com/1067841 https://bugzilla.suse.com/1067844 https://bugzilla.suse.com/1077983 https://bugzilla.suse.com/1079757