Fwd: [ANNOUNCE] PostgreSQL 9.2.4, 9.1.9, 9.0.13 and 8.4.17 released

[Heiko W.Rupp]

FYI for all users using PostgreSQL as database

Anfang der weitergeleiteten E-Mail:

>  Von: Dave Page <dpage(a)postgresql.org&gt;
>  Betreff: [ANNOUNCE] PostgreSQL 9.2.4, 9.1.9, 9.0.13 and 8.4.17 released
>  Datum: 4. April 2013 15:29:55 MESZ
>  An: pgsql-announce <pgsql-announce(a)postgresql.org&gt;
>  
>  The PostgreSQL Global Development Group has released a security update to all
>  current versions of the PostgreSQL database system, including versions 9.2.4,
>  9.1.9, 9.0.13, and 8.4.17. This update fixes a high-exposure security
>  vulnerability in versions 9.0 and later. All users of the affected versions
>  are strongly urged to apply the update *immediately*.
>  
>  A major security issue fixed in this release, CVE-2013-1899
>  (http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1899), makes it
>  possible for a connection request containing a database name that begins
>  with "-" to be crafted that can damage or destroy files within a server's
>  data directory. Anyone with access to the port the PostgreSQL server listens
>  on can initiate this request. This issue was discovered by Mitsumasa Kondo
>  and Kyotaro Horiguchi of NTT Open Source Software Center.
>  
>  Two lesser security fixes are also included in this release: CVE-2013-1900
>  (http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1900), wherein random
>  numbers generated by contrib/pgcrypto functions may be easy for another
>  database user to guess, and CVE-2013-1901
>  (http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1901), which
>  mistakenly allows an unprivileged user to run commands that could interfere
>  with in-progress backups. Finally, this release fixes two security issues
>  with the graphical installers for Linux and Mac OS X: insecure passing of
>  superuser passwords to a script, CVE-2013-1903
>  (http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1903) and the use of
>  predictable filenames in /tmp CVE-2013-1902
>  (http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1902). Marko Kreen,
>  Noah Misch and Stefan Kaltenbrunner reported these issues, respectively.
>  
>  We are grateful for each developer's efforts in making PostgreSQL more secure.
>  
>  This release also corrects several errors in management of GiST indexes. After
>  installing this update, it is advisable to REINDEX any GiST indexes that meet
>   one or more of the conditions described below.
>  
>  This update release also contains fixes for many minor issues discovered and
>  patched by the PostgreSQL community in the last two months, including:
>  
>  * Fix GiST indexes to not use "fuzzy" geometric comparisons for box, polygon,
>   circle, and point columns
>  * Fix bugs in contrib/btree_gist for GiST indexes on text, bytea, bit, and
>   numeric columns
>  * Fix bugs in page splitting code for multi-column GiST indexes
>  * Fix buffer leak in WAL replay causing "incorrect local pin count" errors
>  * Ensure crash recovery before entering archive recovery during unclean
>   shutdown when recovery.conf is present
>  * Avoid deleting not-yet-archived WAL files during crash recovery
>  * Fix race condition in DELETE RETURNING
>  * Fix possible planner crash after adding columns to a view depending on
>   another view
>  * Eliminate memory leaks in PL/Perl's spi_prepare() function
>  * Fix pg_dumpall to handle database names containing "=" correctly
>  * Avoid crash in pg_dump when an incorrect connection string is given
>  * Ignore invalid indexes in pg_dump and pg_upgrade
>  * Include only the current server version's subdirectory when backing up a
>   tablespace with pg_basebackup
>  * Add a server version check in pg_basebackup and pg_receivexlog
>  * Fix contrib/dblink to handle inconsistent settings of DateStyle or
>   IntervalStyle safely
>  * Fix contrib/pg_trgm's similarity() function to return zero for trigram-less
>   strings
>  * Enable building PostgreSQL with Microsoft Visual Studio 2012
>  * Update time zone data files for DST law changes in Chile, Haiti, Morocco,
>   Paraguay, and some Russian areas
>  
>  As always, update releases only require installation of packages and a
>  database system restart. You do not need to dump/restore or use pg_upgrade
>  for this update release.  Users who have skipped multiple update releases may
>  need to perform additional, post-update steps; see the Release Notes for
>  details.
>  
>  Links:
>  
>  * Download: http://postgresql.org/download
>  * Release Notes: http://www.postgresql.org/docs/current/static/release.html
>  * Release FAQ: http://www.postgresql.org/support/security/faq/2013-04-04/
>  
>  --
>  Dave Page
>  PostgreSQL Core Team
>  http://www.postgresql.org/
>  
>  
>  -- 
>  Sent via pgsql-announce mailing list (pgsql-announce(a)postgresql.org)
>  To make changes to your subscription:
>  http://www.postgresql.org/mailpref/pgsql-announce 
-- 
Reg. Adresse: Red Hat GmbH, Technopark II, Haus C, 
Werner-von-Siemens-Ring 14, D-85630 Grasbrunn
Handelsregister: Amtsgericht München HRB 153243
Geschaeftsführer:  Mark Hegarty, Charlie Peters, Michael Cunningham, Charles Cachera