LISTSERV - SCIENTIFIC-LINUX-ERRATA Archives

SCIENTIFIC-LINUX-ERRATA Archives

March 2011

SCIENTIFIC-LINUX-ERRATA@LISTSERV.FNAL.GOV

	LISTSERV Archives
	SCIENTIFIC-LINUX-ERRATA Home
	SCIENTIFIC-LINUX-ERRATA March 2011

	Log In
	Register

	Subscribe or Unsubscribe

	Search Archives

Options:	Use Monospaced Font Show Text Part by Default Show All Mail Headers
Message:	[<< First] [< Prev] [Next >] [Last >>]
Topic:	[<< First] [< Prev] [Next >] [Last >>]
Author:	[<< First] [< Prev] [Next >] [Last >>]

Subject:	Security ERRATA Moderate: postgresql on SL6.x i386/x86_64
From:	Troy Dawson <[log in to unmask]>
Reply To:	Troy Dawson <[log in to unmask]>
Date:	Thu, 3 Mar 2011 16:22:49 -0600
Content-Type:	text/plain
Parts/Attachments:	text/plain (54 lines)

Synopsis:	Moderate: postgresql security update
Issue date:	2010-11-23
CVE Names:	CVE-2010-3433

It was discovered that a user could utilize the features of the PL/Perl 
andaPL/Tcl languages to modify the behavior of a SECURITY DEFINER 
functionacreated by a different user. If the PL/Perl or PL/Tcl language 
was used toaimplement a SECURITY DEFINER function, an authenticated 
database user couldause a PL/Perl or PL/Tcl script to modify the 
behavior of that functionaduring subsequent calls in the same session. 
This would result in theamodified or injected code also being executed 
with the privileges of theauser who created the SECURITY DEFINER 
function, possibly leading to privilege escalation. (CVE-2010-3433)

These updated postgresql packages upgrade PostgreSQL to version 8.4.5.
Refer to the PostgreSQL Release Notes for a list of changes:

http://www.postgresql.org/docs/8.4/static/release.html

If the postgresql service is running, it will be automatically restarted 
after installing this update.

SL 6.x

      SRPMS:
postgresql-8.4.5-1.el6_0.2.src.rpm
      i386:
postgresql-8.4.5-1.el6_0.2.i686.rpm
postgresql-contrib-8.4.5-1.el6_0.2.i686.rpm
postgresql-devel-8.4.5-1.el6_0.2.i686.rpm
postgresql-docs-8.4.5-1.el6_0.2.i686.rpm
postgresql-libs-8.4.5-1.el6_0.2.i686.rpm
postgresql-plperl-8.4.5-1.el6_0.2.i686.rpm
postgresql-plpython-8.4.5-1.el6_0.2.i686.rpm
postgresql-pltcl-8.4.5-1.el6_0.2.i686.rpm
postgresql-server-8.4.5-1.el6_0.2.i686.rpm
postgresql-test-8.4.5-1.el6_0.2.i686.rpm
      x86_64:
postgresql-8.4.5-1.el6_0.2.x86_64.rpm
postgresql-contrib-8.4.5-1.el6_0.2.x86_64.rpm
postgresql-devel-8.4.5-1.el6_0.2.i686.rpm
postgresql-devel-8.4.5-1.el6_0.2.x86_64.rpm
postgresql-docs-8.4.5-1.el6_0.2.x86_64.rpm
postgresql-libs-8.4.5-1.el6_0.2.i686.rpm
postgresql-libs-8.4.5-1.el6_0.2.x86_64.rpm
postgresql-plperl-8.4.5-1.el6_0.2.x86_64.rpm
postgresql-plpython-8.4.5-1.el6_0.2.x86_64.rpm
postgresql-pltcl-8.4.5-1.el6_0.2.x86_64.rpm
postgresql-server-8.4.5-1.el6_0.2.x86_64.rpm
postgresql-test-8.4.5-1.el6_0.2.x86_64.rpm

-Connie Sieh
-Troy Dawson

ATOM RSS1 RSS2

LISTSERV.FNAL.GOV