Format: 1.8 Date: Mon, 27 Feb 2012 15:15:19 +0100 Source: postgresql-8.4 Binary: libpq-dev libpq5 libecpg6 libecpg-dev libecpg-compat3 libpgtypes3 postgresql-8.4 postgresql-client-8.4 postgresql-server-dev-8.4 postgresql-doc-8.4 postgresql-contrib-8.4 postgresql-plperl-8.4 postgresql-plpython-8.4 postgresql-pltcl-8.4 postgresql postgresql-client postgresql-doc postgresql-contrib Architecture: all i386_translations i386 Version: 8.4.11-0ubuntu0.10.04 Distribution: lucid Urgency: low Maintainer: Ubuntu/i386 Build Daemon Changed-By: Martin Pitt Description: libecpg-compat3 - older version of run-time library for ECPG programs libecpg-dev - development files for ECPG (Embedded PostgreSQL for C) libecpg6 - run-time library for ECPG programs libpgtypes3 - shared library libpgtypes for PostgreSQL 8.4 libpq-dev - header files for libpq5 (PostgreSQL library) libpq5 - PostgreSQL C client library postgresql - object-relational SQL database (supported version) postgresql-8.4 - object-relational SQL database, version 8.4 server postgresql-client - front-end programs for PostgreSQL (supported version) postgresql-client-8.4 - front-end programs for PostgreSQL 8.4 postgresql-contrib - additional facilities for PostgreSQL (supported version) postgresql-contrib-8.4 - additional facilities for PostgreSQL postgresql-doc - documentation for the PostgreSQL database management system postgresql-doc-8.4 - documentation for the PostgreSQL database management system postgresql-plperl-8.4 - PL/Perl procedural language for PostgreSQL 8.4 postgresql-plpython-8.4 - PL/Python procedural language for PostgreSQL 8.4 postgresql-pltcl-8.4 - PL/Tcl procedural language for PostgreSQL 8.4 postgresql-server-dev-8.4 - development files for PostgreSQL 8.4 server-side programming Launchpad-Bugs-Fixed: 941912 Changes: postgresql-8.4 (8.4.11-0ubuntu0.10.04) lucid-security; urgency=low . * New upstream bug fix/security release: (LP: #941912) - Require execute permission on the trigger function for "CREATE TRIGGER". This missing check could allow another user to execute a trigger function with forged input data, by installing it on a table he owns. This is only of significance for trigger functions marked SECURITY DEFINER, since otherwise trigger functions run as the table owner anyway. (CVE-2012-0866) - Remove arbitrary limitation on length of common name in SSL certificates. Both libpq and the server truncated the common name extracted from an SSL certificate at 32 bytes. Normally this would cause nothing worse than an unexpected verification failure, but there are some rather-implausible scenarios in which it might allow one certificate holder to impersonate another. The victim would have to have a common name exactly 32 bytes long, and the attacker would have to persuade a trusted CA to issue a certificate in which the common name has that string as a prefix. Impersonating a server would also require some additional exploit to redirect client connections. (CVE-2012-0867) - Convert newlines to spaces in names written in pg_dump comments. pg_dump was incautious about sanitizing object names that are emitted within SQL comments in its output script. A name containing a newline would at least render the script syntactically incorrect. Maliciously crafted object names could present a SQL injection risk when the script is reloaded. (CVE-2012-0868) - Fix btree index corruption from insertions concurrent with vacuuming. An index page split caused by an insertion could sometimes cause a concurrently-running "VACUUM" to miss removing index entries that it should remove. After the corresponding table rows are removed, the dangling index entries would cause errors (such as "could not read block N in file ...") or worse, silently wrong query results after unrelated rows are re-inserted at the now-free table locations. This bug has been present since release 8.2, but occurs so infrequently that it was not diagnosed until now. If you have reason to suspect that it has happened in your database, reindexing the affected index will fix things. - Update per-column permissions, not only per-table permissions, when changing table owner. Failure to do this meant that any previously granted column permissions were still shown as having been granted by the old owner. This meant that neither the new owner nor a superuser could revoke the now-untraceable-to-table-owner permissions. - Allow non-existent values for some settings in "ALTER USER/DATABASE SET". Allow default_text_search_config, default_tablespace, and temp_tablespaces to be set to names that are not known. This is because they might be known in another database where the setting is intended to be used, or for the tablespace cases because the tablespace might not be created yet. The same issue was previously recognized for search_path, and these settings now act like that one. - Avoid crashing when we have problems deleting table files post-commit. Dropping a table should lead to deleting the underlying disk files only after the transaction commits. In event of failure then (for instance, because of wrong file permissions) the code is supposed to just emit a warning message and go on, since it's too late to abort the transaction. This logic got broken as of release 8.4, causing such situations to result in a PANIC and an unrestartable database. - Track the OID counter correctly during WAL replay, even when it wraps around. Previously the OID counter would remain stuck at a high value until the system exited replay mode. The practical consequences of that are usually nil, but there are scenarios wherein a standby server that's been promoted to master might take a long time to advance the OID counter to a reasonable value once values are needed. - Fix regular expression back-references with - attached. Rather than enforcing an exact string match, the code would effectively accept any string that satisfies the pattern sub-expression referenced by the back-reference symbol. A similar problem still afflicts back-references that are embedded in a larger quantified expression, rather than being the immediate subject of the quantifier. This will be addressed in a future PostgreSQL release. - Fix recently-introduced memory leak in processing of inet/cidr values. - Fix dangling pointer after "CREATE TABLE AS"/"SELECT INTO" in a SQL-language function. In most cases this only led to an assertion failure in assert-enabled builds, but worse consequences seem possible. - Fix I/O-conversion-related memory leaks in plpgsql. - Improve pg_dump's handling of inherited table columns. pg_dump mishandled situations where a child column has a different default expression than its parent column. If the default is textually identical to the parent's default, but not actually the same (for instance, because of schema search path differences) it would not be recognized as different, so that after dump and restore the child would be allowed to inherit the parent's default. Child columns that are NOT NULL where their parent is not could also be restored subtly incorrectly. - Fix pg_restore's direct-to-database mode for INSERT-style table data. Direct-to-database restores from archive files made with "--inserts" or "--column-inserts" options fail when using pg_restore from a release dated September or December 2011, as a result of an oversight in a fix for another problem. The archive file itself is not at fault, and text-mode output is okay. - Allow AT option in ecpg DEALLOCATE statements. The infrastructure to support this has been there for awhile, but through an oversight there was still an error check rejecting the case. - Fix error in "contrib/intarray"'s int[] & int[] operator. If the smallest integer the two input arrays have in common is 1, and there are smaller values in either array, then 1 would be incorrectly omitted from the result. - Fix error detection in "contrib/pgcrypto"'s encrypt_iv() and decrypt_iv(). These functions failed to report certain types of invalid-input errors, and would instead return random garbage values for incorrect input. - Fix one-byte buffer overrun in "contrib/test_parser". The code would try to read one more byte than it should, which would crash in corner cases. Since "contrib/test_parser" is only example code, this is not a security issue in itself, but bad example code is still bad. - Use __sync_lock_test_and_set() for spinlocks on ARM, if available. This function replaces our previous use of the SWPB instruction, which is deprecated and not available on ARMv6 and later. Reports suggest that the old code doesn't fail in an obvious way on recent ARM boards, but simply doesn't interlock concurrent accesses, leading to bizarre failures in multiprocess operation. - Use "-fexcess-precision=standard" option when building with gcc versions that accept it. This prevents assorted scenarios wherein recent versions of gcc will produce creative results. - Allow use of threaded Python on FreeBSD. Our configure script previously believed that this combination wouldn't work; but FreeBSD fixed the problem, so remove that error check. * Drop 00git_inet_cidr_unpack.patch, 04-armel-tas.patch: applied upstream. Checksums-Sha1: b6e83d53b696eda32e37cbe4b18bfe7cd8dfe805 1957200 postgresql-doc-8.4_8.4.11-0ubuntu0.10.04_all.deb 83de3b729020588a479a05064ed1cd18347cb9ba 2159445 postgresql-8.4_8.4.11-0ubuntu0.10.04_i386_translations.tar.gz ce9bb28abdaf4d51c99b497ff7f078ac4daee777 27890 postgresql_8.4.11-0ubuntu0.10.04_all.deb 14cc50f5ea6cc788369307447aae02f2cc162852 27856 postgresql-client_8.4.11-0ubuntu0.10.04_all.deb 26c3d16d7699bc45523abab79cce636a46f7bdc0 3442 postgresql-doc_8.4.11-0ubuntu0.10.04_all.deb 403ec838d9e53b02d52ec8361359f1c431b7c242 27758 postgresql-contrib_8.4.11-0ubuntu0.10.04_all.deb 4ba07a5efa4be250b693aa1f9a923d8207ad83bf 193162 libpq-dev_8.4.11-0ubuntu0.10.04_i386.deb 90db4452924f1b1e94645fddfe2a85f166d0b027 94094 libpq5_8.4.11-0ubuntu0.10.04_i386.deb 24fe81f8a99d720549e159bf372f3ad60e206cab 32480 libecpg6_8.4.11-0ubuntu0.10.04_i386.deb a0f9b8a072770171b6a068561ac4091ac8011689 225858 libecpg-dev_8.4.11-0ubuntu0.10.04_i386.deb f1613df378a86dd8c5cb75bec7ad262e8f34398b 10584 libecpg-compat3_8.4.11-0ubuntu0.10.04_i386.deb c0b8814a02ee164bee46b4d558cea2410bff5ca0 58820 libpgtypes3_8.4.11-0ubuntu0.10.04_i386.deb 2a9ec0ec974dbbc1ad43ca1544389cd850084bf8 3905162 postgresql-8.4_8.4.11-0ubuntu0.10.04_i386.deb 1cb7937624395d44fa482172c4cf6edf55a0015c 788084 postgresql-client-8.4_8.4.11-0ubuntu0.10.04_i386.deb 76eadcdf2b8b5df99eab3e98d7c7c90ff408f0fb 637544 postgresql-server-dev-8.4_8.4.11-0ubuntu0.10.04_i386.deb aaeb05398e7d5217e2ed27721db0779489e99827 371530 postgresql-contrib-8.4_8.4.11-0ubuntu0.10.04_i386.deb 0fbf00a6a989c38096f8680b2f80cebfcfcfb259 56142 postgresql-plperl-8.4_8.4.11-0ubuntu0.10.04_i386.deb 58662d941e84f6c8f3069c0f91260a5b35784563 48284 postgresql-plpython-8.4_8.4.11-0ubuntu0.10.04_i386.deb cbf33ecf3cb8532c5535e01aa83e26563743361f 47246 postgresql-pltcl-8.4_8.4.11-0ubuntu0.10.04_i386.deb Checksums-Sha256: ce786d49a637225e96742120f88862613172d6c8ba1418f649094ac3cbd221c4 1957200 postgresql-doc-8.4_8.4.11-0ubuntu0.10.04_all.deb 68716508f0a6c8b6f1b0d88ec31b9cfdca553e9ac3b842548d2f0016e4c066b4 2159445 postgresql-8.4_8.4.11-0ubuntu0.10.04_i386_translations.tar.gz 9e54202ec0613092c50e1bcb66902bf6fa3c7db6fdb9a637e8eda5c06ab4b53e 27890 postgresql_8.4.11-0ubuntu0.10.04_all.deb 016430f5efb51012a9f4163b24194334c2ad01609245a7982481f276fe17ee17 27856 postgresql-client_8.4.11-0ubuntu0.10.04_all.deb a0859242886fe08f632eb3d59dea167cc07d9323045a0c90478f48f3f4ca5b0b 3442 postgresql-doc_8.4.11-0ubuntu0.10.04_all.deb 0c788b2e05fec85ebd3893ad33b2ce6c68e2f6a5ecd503cb08c1740d90277f4f 27758 postgresql-contrib_8.4.11-0ubuntu0.10.04_all.deb 0096969f32c76c84badf7842d74961edfdaf4c70d3282083e14541269d420c1c 193162 libpq-dev_8.4.11-0ubuntu0.10.04_i386.deb fe3aa15e642d467748a46f2b1e63edfb4a9839714b4728bab4a9ce545989e2aa 94094 libpq5_8.4.11-0ubuntu0.10.04_i386.deb bbd2b5949b2aa93f1c1ff941452f1147cca24e673df3dca93f0d788eb957877c 32480 libecpg6_8.4.11-0ubuntu0.10.04_i386.deb 69bcc9a8af8de1c15363942ec07a8c41ac3ae27f65487a9fc97c88245ee37325 225858 libecpg-dev_8.4.11-0ubuntu0.10.04_i386.deb c4f8ec36adaa2d5d77198339c772251fed08c8308ac200cef7110f8bee23365a 10584 libecpg-compat3_8.4.11-0ubuntu0.10.04_i386.deb 78e20a22f0d21a4b81ce95c06367616951f66bff0135cd7032a5fae507f700a3 58820 libpgtypes3_8.4.11-0ubuntu0.10.04_i386.deb 53f22e9fcb91cb46898c2864e4886c46722b81f071d598e059e41d4107a85eeb 3905162 postgresql-8.4_8.4.11-0ubuntu0.10.04_i386.deb b3bf9cb577eb69177e3522b5e67f8d6aec554e0296c02000cb84433c81d9f8b4 788084 postgresql-client-8.4_8.4.11-0ubuntu0.10.04_i386.deb c31bf4010bf4d3fd9000f5a61518268445cb1133aa91399a1efae1cb5dff627c 637544 postgresql-server-dev-8.4_8.4.11-0ubuntu0.10.04_i386.deb df6888d19b900f8987e7b09e5f98d7f919fca64f6dde0e6c3225ffaec6119b5a 371530 postgresql-contrib-8.4_8.4.11-0ubuntu0.10.04_i386.deb 81c91aba8091b01baefe16734f672e4646396b9c933410ff4238490314fb98a2 56142 postgresql-plperl-8.4_8.4.11-0ubuntu0.10.04_i386.deb 567f65e8294e6b061338d00e3a44aa90f19a17288e5f30ac435ce074a1d1b205 48284 postgresql-plpython-8.4_8.4.11-0ubuntu0.10.04_i386.deb afa38d609e78276d446cc649822fba7cadca96d32dde02518403b8df2ef877bd 47246 postgresql-pltcl-8.4_8.4.11-0ubuntu0.10.04_i386.deb Files: e636b1cb066109dd6e25eb0ff2eff6ee 1957200 doc optional postgresql-doc-8.4_8.4.11-0ubuntu0.10.04_all.deb f0d09754a37122ef953da75cdea22d10 2159445 raw-translations - postgresql-8.4_8.4.11-0ubuntu0.10.04_i386_translations.tar.gz b34787a2a99692c7958a9df506222257 27890 database optional postgresql_8.4.11-0ubuntu0.10.04_all.deb c0171cff345d0d87d22fa7e0813f7ccb 27856 database optional postgresql-client_8.4.11-0ubuntu0.10.04_all.deb 55b7c06225c9e719448bd14a182846c0 3442 doc optional postgresql-doc_8.4.11-0ubuntu0.10.04_all.deb 86599a3e7a025073750b978d362dfb73 27758 database optional postgresql-contrib_8.4.11-0ubuntu0.10.04_all.deb a3b5524adf843107969866b0637dfdbe 193162 libdevel optional libpq-dev_8.4.11-0ubuntu0.10.04_i386.deb 679097d339b38d4f4c02a5d88b4bf4bb 94094 libs optional libpq5_8.4.11-0ubuntu0.10.04_i386.deb f8776a90cc3985166a184933a5cc1af1 32480 libs optional libecpg6_8.4.11-0ubuntu0.10.04_i386.deb 8c8239e76a165e303f219914873e8fa7 225858 libdevel optional libecpg-dev_8.4.11-0ubuntu0.10.04_i386.deb e65a549b442654382e441e4a705612d1 10584 libs optional libecpg-compat3_8.4.11-0ubuntu0.10.04_i386.deb 8ed244fa5f1d6c77c427b67e489de4c2 58820 libs optional libpgtypes3_8.4.11-0ubuntu0.10.04_i386.deb 745cc50c633ed97f59ef2ba312fde0b7 3905162 database optional postgresql-8.4_8.4.11-0ubuntu0.10.04_i386.deb 19deebf449b6bb9afd0f4718d4f9b8e3 788084 database optional postgresql-client-8.4_8.4.11-0ubuntu0.10.04_i386.deb 018508603fc8ba6bd06a6572e900c31e 637544 libdevel optional postgresql-server-dev-8.4_8.4.11-0ubuntu0.10.04_i386.deb 0ae463c82982be9c8ef2fde71681dfbc 371530 database optional postgresql-contrib-8.4_8.4.11-0ubuntu0.10.04_i386.deb 21a7ec5d3564bbcfa112284ab62cfe98 56142 database optional postgresql-plperl-8.4_8.4.11-0ubuntu0.10.04_i386.deb ddafaab6c7e11e7bb9d4ce4244362677 48284 database optional postgresql-plpython-8.4_8.4.11-0ubuntu0.10.04_i386.deb e8bf364b3069c0599f3af53017a59064 47246 database optional postgresql-pltcl-8.4_8.4.11-0ubuntu0.10.04_i386.deb Original-Maintainer: Martin Pitt