Ubuntu

“postgresql-9.1” 9.1.5-0ubuntu12.04 source package in Ubuntu

Changelog

postgresql-9.1 (9.1.5-0ubuntu12.04) precise-security; urgency=low

  * New upstream bug fix/security release:
   - Prevent access to external files/URLs via XML entity references
     (Noah Misch, Tom Lane)
     xml_parse() would attempt to fetch external files or URLs as needed
     to resolve DTD and entity references in an XML value, thus allowing
     unprivileged database users to attempt to fetch data with the
     privileges of the database server. While the external data wouldn't
     get returned directly to the user, portions of it could be exposed
     in error messages if the data didn't parse as valid XML; and in any
     case the mere ability to check existence of a file might be useful
     to an attacker. (CVE-2012-3489)
   - Prevent access to external files/URLs via "contrib/xml2"'s
     xslt_process() (Peter Eisentraut)
     libxslt offers the ability to read and write both files and URLs
     through stylesheet commands, thus allowing unprivileged database
     users to both read and write data with the privileges of the
     database server. Disable that through proper use of libxslt's
     security options. (CVE-2012-3488)
     Also, remove xslt_process()'s ability to fetch documents and
     stylesheets from external files/URLs. While this was a documented
     "feature", it was long regarded as a bad idea. The fix for
     CVE-2012-3489 broke that capability, and rather than expend effort
     on trying to fix it, we're just going to summarily remove it.
   - Prevent too-early recycling of btree index pages (Noah Misch)
     When we allowed read-only transactions to skip assigning XIDs, we
     introduced the possibility that a deleted btree page could be
     recycled while a read-only transaction was still in flight to it.
     This would result in incorrect index search results. The
     probability of such an error occurring in the field seems very low
     because of the timing requirements, but nonetheless it should be
     fixed.
   - Fix crash-safety bug with newly-created-or-reset sequences (Tom
     Lane)
     If "ALTER SEQUENCE" was executed on a freshly created or reset
     sequence, and then precisely one nextval() call was made on it, and
     then the server crashed, WAL replay would restore the sequence to a
     state in which it appeared that no nextval() had been done, thus
     allowing the first sequence value to be returned again by the next
     nextval() call. In particular this could manifest for serial
     columns, since creation of a serial column's sequence includes an
     "ALTER SEQUENCE OWNED BY" step.
   - Fix race condition in enum-type value comparisons (Robert Haas, Tom
     Lane)
     Comparisons could fail when encountering an enum value added since
     the current query started.
   - Fix txid_current() to report the correct epoch when not in hot
     standby (Heikki Linnakangas)
     This fixes a regression introduced in the previous minor release.
   - Prevent selection of unsuitable replication connections as the
     synchronous standby (Fujii Masao)
     The master might improperly choose pseudo-servers such as
     pg_receivexlog or pg_basebackup as the synchronous standby, and
     then wait indefinitely for them.
   - Fix bug in startup of Hot Standby when a master transaction has
     many subtransactions (Andres Freund)
     This mistake led to failures reported as "out-of-order XID
     insertion in KnownAssignedXids".
   - Ensure the "backup_label" file is fsync'd after pg_start_backup()
     (Dave Kerr)
   - Fix timeout handling in walsender processes (Tom Lane)
     WAL sender background processes neglected to establish a SIGALRM
     handler, meaning they would wait forever in some corner cases where
     a timeout ought to happen.
   - Wake walsenders after each background flush by walwriter (Andres
     Freund, Simon Riggs)
     This greatly reduces replication delay when the workload contains
     only asynchronously-committed transactions.
   - Fix LISTEN/NOTIFY to cope better with I/O problems, such as out of
     disk space (Tom Lane)
     After a write failure, all subsequent attempts to send more NOTIFY
     messages would fail with messages like "Could not read from file
     "pg_notify/nnnn" at offset nnnnn: Success".
   - Only allow autovacuum to be auto-canceled by a directly blocked
     process (Tom Lane)
     The original coding could allow inconsistent behavior in some
     cases; in particular, an autovacuum could get canceled after less
     than deadlock_timeout grace period.
   - Improve logging of autovacuum cancels (Robert Haas)
   - Fix log collector so that log_truncate_on_rotation works during the
     very first log rotation after server start (Tom Lane)
   - Fix WITH attached to a nested set operation
     (UNION/INTERSECT/EXCEPT) (Tom Lane)
   - Ensure that a whole-row reference to a subquery doesn't include any
     extra GROUP BY or ORDER BY columns (Tom Lane)
   - Fix dependencies generated during ALTER TABLE ... ADD CONSTRAINT
     USING INDEX (Tom Lane)
     This command left behind a redundant pg_depend entry for the index,
     which could confuse later operations, notably ALTER TABLE ... ALTER
     COLUMN TYPE on one of the indexed columns.
   - Fix "REASSIGN OWNED" to work on extensions (Alvaro Herrera)
   - Disallow copying whole-row references in CHECK constraints and
     index definitions during "CREATE TABLE" (Tom Lane)
     This situation can arise in "CREATE TABLE" with LIKE or INHERITS.
     The copied whole-row variable was incorrectly labeled with the row
     type of the original table not the new one. Rejecting the case
     seems reasonable for LIKE, since the row types might well diverge
     later. For INHERITS we should ideally allow it, with an implicit
     coercion to the parent table's row type; but that will require more
     work than seems safe to back-patch.
   - Fix memory leak in ARRAY(SELECT ...) subqueries (Heikki
     Linnakangas, Tom Lane)
   - Fix planner to pass correct collation to operator selectivity
     estimators (Tom Lane)
     This was not previously required by any core selectivity estimation
     function, but third-party code might need it.
   - Fix extraction of common prefixes from regular expressions (Tom
     Lane)
     The code could get confused by quantified parenthesized
     subexpressions, such as ^(foo)?bar. This would lead to incorrect
     index optimization of searches for such patterns.
   - Fix bugs with parsing signed "hh":"mm" and "hh":"mm":"ss" fields in
     interval constants (Amit Kapila, Tom Lane)
   - Fix pg_dump to better handle views containing partial GROUP BY
     lists (Tom Lane)
     A view that lists only a primary key column in GROUP BY, but uses
     other table columns as if they were grouped, gets marked as
     depending on the primary key. Improper handling of such primary key
     dependencies in pg_dump resulted in poorly-ordered dumps, which at
     best would be inefficient to restore and at worst could result in
     outright failure of a parallel pg_restore run.
   - In PL/Perl, avoid setting UTF8 flag when in SQL_ASCII encoding
     (Alex Hunsaker, Kyotaro Horiguchi, Alvaro Herrera)
   - Use Postgres' encoding conversion functions, not Python's, when
     converting a Python Unicode string to the server encoding in
     PL/Python (Jan Urbanski)
     This avoids some corner-case problems, notably that Python doesn't
     support all the encodings Postgres does. A notable functional
     change is that if the server encoding is SQL_ASCII, you will get
     the UTF-8 representation of the string; formerly, any non-ASCII
     characters in the string would result in an error.
   - Fix mapping of PostgreSQL encodings to Python encodings in
     PL/Python (Jan Urbanski)
   - Report errors properly in "contrib/xml2"'s xslt_process() (Tom
     Lane)
   - Update time zone data files to tzdata release 2012e for DST law
     changes in Morocco and Tokelau
 -- Jamie Strandboge <email address hidden>   Thu, 16 Aug 2012 16:49:18 -0500

Upload details

Uploaded by:
Jamie Strandboge on 2012-08-16
Uploaded to:
Precise
Original maintainer:
Ubuntu Developers
Component:
main
Architectures:
any all
Section:
database
Urgency:
Low Urgency

See full publishing history Publishing

Series Pocket Published Component Section

Downloads

File Size MD5 Checksum
postgresql-9.1_9.1.5.orig.tar.bz2 14.9 MiB c784decb60615aa94c6a31601bc6ffd2
postgresql-9.1_9.1.5-0ubuntu12.04.debian.tar.gz 34.7 KiB 4448db2b9e04965117038517265e0478
postgresql-9.1_9.1.5-0ubuntu12.04.dsc 3.2 KiB 83cf1aa2b9299eba245a40e19cb01b94

Binary packages built by this source

libecpg-compat3: older version of run-time library for ECPG programs

 The libecpg_compat shared library is used by programs built with ecpg.
 (Embedded PostgreSQL for C).
 .
 PostgreSQL is an object-relational SQL database management system.

libecpg-dev: development files for ECPG (Embedded PostgreSQL for C)

 This package contains the necessary files to build ECPG (Embedded
 PostgreSQL for C) programs. It includes the development libraries
 and the preprocessor program ecpg.
 .
 PostgreSQL is an object-relational SQL database management system.
 .
 Install this package if you want to write C programs with SQL statements
 embedded in them (rather than run by an external process).

libecpg6: run-time library for ECPG programs

 The libecpg shared library is used by programs built with ECPG
 (Embedded PostgreSQL for C).
 .
 PostgreSQL is an object-relational SQL database management system.

libpgtypes3: shared library libpgtypes for PostgreSQL 9.1

 The libpgtypes shared library is used by programs built with ecpg.
 (Embedded PostgreSQL for C).
 .
 PostgreSQL is an object-relational SQL database management system.

libpq-dev: header files for libpq5 (PostgreSQL library)

 Header files and static library for compiling C programs to link
 with the libpq library in order to communicate with a PostgreSQL
 database backend.
 .
 PostgreSQL is an object-relational SQL database management system.

libpq5: PostgreSQL C client library

 libpq is a C library that enables user programs to communicate with
 the PostgreSQL database server. The server can be on another machine
 and accessed through TCP/IP. This version of libpq is compatible
 with servers from PostgreSQL 8.2 or later.
 .
 This package contains the run-time library, needed by packages using
 libpq.
 .
 PostgreSQL is an object-relational SQL database management system.

postgresql-9.1: object-relational SQL database, version 9.1 server

 PostgreSQL is a fully featured object-relational database management
 system. It supports a large part of the SQL standard and is designed
 to be extensible by users in many aspects. Some of the features are:
 ACID transactions, foreign keys, views, sequences, subqueries,
 triggers, user-defined types and functions, outer joins, multiversion
 concurrency control. Graphical user interfaces and bindings for many
 programming languages are available as well.
 .
 This package provides the database server for PostgreSQL 9.1. Servers
 for other major release versions can be installed simultaneously and
 are coordinated by the postgresql-common package. A package providing
 ident-server is needed if you want to authenticate remote connections
 with identd.

postgresql-9.1-dbg: debug symbols for postgresql-9.1

 PostgreSQL is a fully featured object-relational database management
 system. It supports a large part of the SQL standard and is designed
 to be extensible by users in many aspects. Some of the features are:
 ACID transactions, foreign keys, views, sequences, subqueries,
 triggers, user-defined types and functions, outer joins, multiversion
 concurrency control. Graphical user interfaces and bindings for many
 programming languages are available as well.
 .
 This package provides detached debugging symbols for PostgreSQL 9.1.

postgresql-client-9.1: front-end programs for PostgreSQL 9.1

 This package contains client and administrative programs for
 PostgreSQL: these are the interactive terminal client psql and
 programs for creating and removing users and databases.
 .
 This is the client package for PostgreSQL 9.1. If you install
 PostgreSQL 9.1 on a standalone machine, you need the server package
 postgresql-9.1, too. On a network, you can install this package on
 many client machines, while the server package may be installed on
 only one machine.
 .
 PostgreSQL is an object-relational SQL database management system.

postgresql-contrib-9.1: additional facilities for PostgreSQL

 The PostgreSQL contrib package provides several additional features
 for the PostgreSQL database. This version is built to work with the
 server package postgresql-9.1. contrib often serves as a testbed for
 features before they are adopted into PostgreSQL proper:
 .
  adminpack - File and log manipulation routines, used by pgAdmin
  btree_gist - B-Tree indexing using GiST (Generalised Search Tree)
  chkpass - An auto-encrypted password datatype
  cube - Multidimensional-cube datatype (GiST indexing example)
  dblink - Functions to return results from a remote database
  earthdistance - Operator for computing the distance (in miles) between
                   two points on the earth's surface
  fuzzystrmatch - Levenshtein, metaphone, and soundex fuzzy string matching
  hstore - Store (key, value) pairs
  intagg - Integer aggregator/enumerator
  _int - Index support for arrays of int4, using GiST (benchmark
                   needs the libdbd-pg-perl package)
  isn - type extensions for ISBN, ISSN, ISMN, EAN13 product numbers
  lo - Large Object maintenance
  ltree - Tree-like data structures
  oid2name - Maps OIDs to table names
  pageinspect - Inspection of database pages
  passwordcheck - Simple password strength checker
  pg_buffercache - Real time queries on the shared buffer cache
  pg_freespacemap- Displays the contents of the free space map (FSM)
  pg_trgm - Determine the similarity of text based on trigram matching
  pg_standby - Create a warm stand-by server
  pgbench - TPC-B like benchmark
  pgcrypto - Cryptographic functions
  pgrowlocks - A function to return row locking information
  pgstattuple - Returns the percentage of dead tuples in a table; this
                   indicates whether a vacuum is required.
  seg - Confidence-interval datatype (GiST indexing example)
  spi - PostgreSQL Server Programming Interface; 4 examples of
                   its use:
                   autoinc - A function for implementing AUTOINCREMENT/
                                IDENTITY
                   insert_username - function for inserting user names
                   moddatetime - Update modification timestamps
                   refint - Functions for implementing referential
                                integrity (foreign keys). Note that this is
                                now superseded by built-in referential
                                integrity.
                   timetravel - Re-implements in user code the time travel
                                feature that was removed in 6.3.
  tablefunc - examples of functions returning tables
  uuid-ossp - UUID generation functions
  vacuumlo - Remove orphaned large objects
 .
 PostgreSQL is an object-relational SQL database management system.

postgresql-doc-9.1: documentation for the PostgreSQL database management system

 This package contains all README files, user manual, and examples for
 PostgreSQL 9.1. The manual is in HTML format.
 .
 PostgreSQL is an object-relational SQL database management system.

postgresql-plperl-9.1: PL/Perl procedural language for PostgreSQL 9.1

 PL/Perl enables an SQL developer to write procedural language functions
 for PostgreSQL 9.1 in Perl. You need this package if you have any
 PostgreSQL 9.1 functions that use the languages plperl or plperlu.
 .
 PostgreSQL is an object-relational SQL database management system.

postgresql-plpython-9.1: PL/Python procedural language for PostgreSQL 9.1

 PL/Python enables an SQL developer to write procedural language functions
 for PostgreSQL 9.1 in Python. You need this package if you have any
 PostgreSQL 9.1 functions that use the languages plpython or plpythonu.
 .
 PostgreSQL is an object-relational SQL database management system.

postgresql-plpython3-9.1: PL/Python 3 procedural language for PostgreSQL 9.1

 PL/Python 3 enables an SQL developer to write procedural language functions
 for PostgreSQL 9.1 in Python 3. You need this package if you have any
 PostgreSQL 9.1 functions that use the languages plpython3 or plpython3u.
 .
 PostgreSQL is an object-relational SQL database management system.

postgresql-pltcl-9.1: PL/Tcl procedural language for PostgreSQL 9.1

 PL/Tcl enables an SQL developer to write procedural language functions
 for PostgreSQL 9.1 in Tcl. You need this package if you have any
 PostgreSQL 9.1 functions that use the languages pltcl or pltclu.
 .
 PostgreSQL is an object-relational SQL database management system.

postgresql-server-dev-9.1: development files for PostgreSQL 9.1 server-side programming

 Header files for compiling SSI code to link into PostgreSQL's backend; for
 example, for C functions to be called from SQL.
 .
 This package also contains the Makefiles necessary for building add-on
 modules of PostgreSQL, which would otherwise have to be built in the
 PostgreSQL source-code tree.
 .
 PostgreSQL is an object-relational SQL database management system.