openSUSE Build Service

Overview Details Repositories Revisions Requests Users Attributes Meta

File _patchinfo of Package patchinfo (Revision cac46fc54f0be6d8e329d74b7cb1d5f4)

Currently displaying revision cac46fc54f0be6d8e329d74b7cb1d5f4 , Show latest

<patchinfo>
  <issue id="776523" tracker="bnc">postgresql: arbitrary read + write of files via XSL functionality</issue>
  <issue id="776524" tracker="bnc">postgresql: determination of the existence of files</issue>
  <issue id="766797" tracker="bnc">postgresql: BSD crypt 8bit character mishandling</issue>
  <issue id="765069" tracker="bnc">postgresql: denial of service (stack exhaustion) via specially-crafted SQL</issue>
  <issue id="CVE-2012-3489" tracker="cve" />
  <issue id="CVE-2012-3488" tracker="cve" />
  <issue id="CVE-2012-2655" tracker="cve" />
  <issue id="CVE-2012-2143" tracker="cve" />
  <category>security</category>
  <rating>moderate</rating>
  <packager>zawel1</packager>
  <description>

- Security and bugfix release 9.1.5:
  * Ignore SECURITY DEFINER and SET attributes for a procedural
    language's call handler (CVE-2012-2655) bnc#765069
  * Fix incorrect password transformation in "contrib/pgcrypto"'s DES
    crypt() function (CVE-2012-2143) bnc#766799
  * Prevent access to external files/URLs via "contrib/xml2"'s
    xslt_process() (CVE-2012-3488) bnc#776523
  * Prevent access to external files/URLs via XML entity references
    (CVE-2012-3489) bnc#776524
  * See the release notes for the rest of the changes:
    http://www.postgresql.org/docs/9.1/static/release.html
    /usr/share/doc/packages/postgresql/HISTORY
  </description>
  <summary>security update for postgresql, postgresql-libs</summary>
</patchinfo>

Places

File _patchinfo of Package patchinfo (Revision cac46fc54f0be6d8e329d74b7cb1d5f4)

Places