[IT-SecNots] [SECURITY] [DSA 3374-1] postgresql-9.4 security update

[Salvatore Bonaccorso <carnil AT debian.org>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

- -------------------------------------------------------------------------
Debian Security Advisory DSA-3374-1                   security AT debian.org
https://www.debian.org/security/                     Salvatore Bonaccorso
October 19, 2015                      https://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package        : postgresql-9.4
CVE ID         : CVE-2015-5288 CVE-2015-5289

Several vulnerabilities have been found in PostgreSQL-9.4, a SQL
database system.

CVE-2015-5288

    Josh Kupershmidt discovered a vulnerability in the crypt() function
    in the pgCrypto extension. Certain invalid salt arguments can cause
    the server to crash or to disclose a few bytes of server memory.

CVE-2015-5289

    Oskari Saarenmaa discovered that json or jsonb input values
    constructed from arbitrary user input can crash the PostgreSQL
    server and cause a denial of service.

For the stable distribution (jessie), these problems have been fixed in
version 9.4.5-0+deb8u1.

For the testing distribution (stretch), these problems have been fixed
in version 9.4.5-1.

For the unstable distribution (sid), these problems have been fixed in
version 9.4.5-1.

We recommend that you upgrade your postgresql-9.4 packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

Mailing list: debian-security-announce AT lists.debian.org
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCgAGBQJWJQ6uAAoJEAVMuPMTQ89EgeYP/2ddc78SvGZvp0bvW8k9QReb
lPZuARqC1lmtLY51rDEM43aFDWwM01TpnoRvYyVXcphsalK16Sz0Ho7m20gqGrSj
RGNwG2zSQFcyU1OWINdEgmV10x/ufSrbyHQyf4m5hS9luMRlIGbGXV/DbSqvDF90
kNZ0NXz/g8iVOAf+9h+i6R5X6tPTAWgrj+X6IBngMi0jntvA30kAknUc73cnfrmG
YzxblZp5eMyf56EbXecbUfMz1751wxNxbp97HuQLv29KJ/FtYr8fwC1fJqmKje9S
ngqwrJw0RQphviZ2+QxaKk+7f+VuJdfRUqPKHUau62Uxk096rVRVD1p+wAGkLW7o
PoDqx3DrF05QnoqlxyIjAJ2Lkt9CW9RyGTDwxAzdq2VQ9jnxSoKmjGkVLMSf1T+t
Ljo3z3HSi+NYQJBwegD+Uy66dKwJ8au4qL+XkGpT9dnw40iryM9Li01w9H9tJYOE
Jea+ppT53JUWjA1EEz64qVEjlbFmp/sp4J1ggXTpp9pX06i88DJZ+9ff2PU/JLZa
Br6WnK6RgCbaIIAwjUBCb1qxUNFiJBfeD1fymhcEhudvd3tKRQHC0NPouNHw3VwE
s7sRCaNnS4s/wuYpJr+nxu3HR3CQgnPVTibISg6GLNBEBTWQGfbDhdUPTyAO2yZN
y/szRjAt/4yVhJiIZd+X
=sz5D
-----END PGP SIGNATURE-----