Format: 1.7 Date: Mon, 27 Feb 2012 15:23:24 +0100 Source: postgresql-8.3 Binary: libpq-dev libpq5 libecpg6 libecpg-dev libecpg-compat3 libpgtypes3 postgresql-8.3 postgresql-client-8.3 postgresql-server-dev-8.3 postgresql-doc-8.3 postgresql-contrib-8.3 postgresql-plperl-8.3 postgresql-plpython-8.3 postgresql-pltcl-8.3 postgresql postgresql-client postgresql-doc postgresql-contrib Architecture: ia64_translations ia64 Version: 8.3.18-0ubuntu0.8.04 Distribution: hardy Urgency: low Maintainer: Ubuntu/ia64 Build Daemon Changed-By: Martin Pitt Description: libecpg-compat3 - older version of run-time library for ECPG programs libecpg-dev - development files for ECPG (Embedded PostgreSQL for C) libecpg6 - run-time library for ECPG programs libpgtypes3 - shared library libpgtypes for PostgreSQL 8.3 libpq-dev - header files for libpq5 (PostgreSQL library) libpq5 - PostgreSQL C client library postgresql - object-relational SQL database (latest version) postgresql-8.3 - object-relational SQL database, version 8.3 server postgresql-client - front-end programs for PostgreSQL (latest version) postgresql-client-8.3 - front-end programs for PostgreSQL 8.3 postgresql-contrib - additional facilities for PostgreSQL (latest version) postgresql-contrib-8.3 - additional facilities for PostgreSQL postgresql-doc - documentation for the PostgreSQL database management system postgresql-doc-8.3 - documentation for the PostgreSQL database management system postgresql-plperl-8.3 - PL/Perl procedural language for PostgreSQL 8.3 postgresql-plpython-8.3 - PL/Python procedural language for PostgreSQL 8.3 postgresql-pltcl-8.3 - PL/Tcl procedural language for PostgreSQL 8.3 postgresql-server-dev-8.3 - development files for PostgreSQL 8.3 server-side programming Launchpad-Bugs-Fixed: 941912 Changes: postgresql-8.3 (8.3.18-0ubuntu0.8.04) hardy-security; urgency=low . * New upstream bug fix/security release: (LP: #941912): - Require execute permission on the trigger function for "CREATE TRIGGER". This missing check could allow another user to execute a trigger function with forged input data, by installing it on a table he owns. This is only of significance for trigger functions marked SECURITY DEFINER, since otherwise trigger functions run as the table owner anyway. (CVE-2012-0866) - Convert newlines to spaces in names written in pg_dump comments. pg_dump was incautious about sanitizing object names that are emitted within SQL comments in its output script. A name containing a newline would at least render the script syntactically incorrect. Maliciously crafted object names could present a SQL injection risk when the script is reloaded. (CVE-2012-0868) - Fix btree index corruption from insertions concurrent with vacuuming. An index page split caused by an insertion could sometimes cause a concurrently-running "VACUUM" to miss removing index entries that it should remove. After the corresponding table rows are removed, the dangling index entries would cause errors (such as "could not read block N in file ...") or worse, silently wrong query results after unrelated rows are re-inserted at the now-free table locations. This bug has been present since release 8.2, but occurs so infrequently that it was not diagnosed until now. If you have reason to suspect that it has happened in your database, reindexing the affected index will fix things. - Allow non-existent values for some settings in "ALTER USER/DATABASE SET". Allow default_text_search_config, default_tablespace, and temp_tablespaces to be set to names that are not known. This is because they might be known in another database where the setting is intended to be used, or for the tablespace cases because the tablespace might not be created yet. The same issue was previously recognized for search_path, and these settings now act like that one. - Track the OID counter correctly during WAL replay, even when it wraps around. Previously the OID counter would remain stuck at a high value until the system exited replay mode. The practical consequences of that are usually nil, but there are scenarios wherein a standby server that's been promoted to master might take a long time to advance the OID counter to a reasonable value once values are needed. - Fix regular expression back-references with - attached. Rather than enforcing an exact string match, the code would effectively accept any string that satisfies the pattern sub-expression referenced by the back-reference symbol. A similar problem still afflicts back-references that are embedded in a larger quantified expression, rather than being the immediate subject of the quantifier. This will be addressed in a future PostgreSQL release. - Fix recently-introduced memory leak in processing of inet/cidr values. - Fix I/O-conversion-related memory leaks in plpgsql. - Improve pg_dump's handling of inherited table columns. pg_dump mishandled situations where a child column has a different default expression than its parent column. If the default is textually identical to the parent's default, but not actually the same (for instance, because of schema search path differences) it would not be recognized as different, so that after dump and restore the child would be allowed to inherit the parent's default. Child columns that are NOT NULL where their parent is not could also be restored subtly incorrectly. - Fix pg_restore's direct-to-database mode for INSERT-style table data. Direct-to-database restores from archive files made with "--inserts" or "--column-inserts" options fail when using pg_restore from a release dated September or December 2011, as a result of an oversight in a fix for another problem. The archive file itself is not at fault, and text-mode output is okay. - Fix error in "contrib/intarray"'s int[] & int[] operator. If the smallest integer the two input arrays have in common is 1, and there are smaller values in either array, then 1 would be incorrectly omitted from the result. - Fix error detection in "contrib/pgcrypto"'s encrypt_iv() and decrypt_iv(). These functions failed to report certain types of invalid-input errors, and would instead return random garbage values for incorrect input. - Fix one-byte buffer overrun in "contrib/test_parser". The code would try to read one more byte than it should, which would crash in corner cases. Since "contrib/test_parser" is only example code, this is not a security issue in itself, but bad example code is still bad. - Use __sync_lock_test_and_set() for spinlocks on ARM, if available. This function replaces our previous use of the SWPB instruction, which is deprecated and not available on ARMv6 and later. Reports suggest that the old code doesn't fail in an obvious way on recent ARM boards, but simply doesn't interlock concurrent accesses, leading to bizarre failures in multiprocess operation. - Use "-fexcess-precision=standard" option when building with gcc versions that accept it. This prevents assorted scenarios wherein recent versions of gcc will produce creative results. - Allow use of threaded Python on FreeBSD. * Drop 00git_inet_cidr_unpack.patch, applied upstream. Files: 0021d1b792a2b7159d4eed9f08082866 2655608 raw-translations - postgresql-8.3_8.3.18-0ubuntu0.8.04_ia64_translations.tar.gz 03861f971222232e107abf8305193bee 232532 libdevel optional libpq-dev_8.3.18-0ubuntu0.8.04_ia64.deb d9edd371252e8ddff014c1666d2fa32d 387198 libs optional libpq5_8.3.18-0ubuntu0.8.04_ia64.deb b899f80c840c5b2b5b21d339861a5176 44866 libs optional libecpg6_8.3.18-0ubuntu0.8.04_ia64.deb 58d4c6e8011eace0c97a19b2af9ed128 280680 libdevel optional libecpg-dev_8.3.18-0ubuntu0.8.04_ia64.deb c965d341ea11a12d848fdbf553f8d61d 13940 libs optional libecpg-compat3_8.3.18-0ubuntu0.8.04_ia64.deb c37fabb7bd37d323633a8a1396391b36 341310 libs optional libpgtypes3_8.3.18-0ubuntu0.8.04_ia64.deb 59d17eeae7e439e4f054318109df76ba 4715258 misc optional postgresql-8.3_8.3.18-0ubuntu0.8.04_ia64.deb b6549767a981ebeaa5ca01837f528bbb 932188 misc optional postgresql-client-8.3_8.3.18-0ubuntu0.8.04_ia64.deb d9b8e42b7e2114c93577335069f15741 879294 libdevel optional postgresql-server-dev-8.3_8.3.18-0ubuntu0.8.04_ia64.deb 00ef8b782fab1923298eed85934af1ce 485502 misc optional postgresql-contrib-8.3_8.3.18-0ubuntu0.8.04_ia64.deb 80e7c5d818d1f63967c975a1e62910d1 341066 misc optional postgresql-plperl-8.3_8.3.18-0ubuntu0.8.04_ia64.deb 21ede838fe0842232988d07c0e698186 329152 misc optional postgresql-plpython-8.3_8.3.18-0ubuntu0.8.04_ia64.deb 085a606d5c27d5922283da1e8694889f 321834 misc optional postgresql-pltcl-8.3_8.3.18-0ubuntu0.8.04_ia64.deb Original-Maintainer: Martin Pitt