1. Ubuntu Security Notices
  2. USN-1461-1

USN-1461-1: PostgreSQL vulnerabilities

Publication date

5 June 2012

Overview

PostgreSQL could be made to crash or incorrectly handle authentication.

Releases

Packages

Details

It was discovered that PostgreSQL incorrectly handled certain bytes passed
to the crypt() function when using DES encryption. An attacker could use
this flaw to incorrectly handle authentication. (CVE-2012-2143)

It was discovered that PostgreSQL incorrectly handled SECURITY DEFINER and
SET attributes on procedural call handlers. An attacker could use this flaw
to cause PostgreSQL to crash, leading to a denial of service.
(CVE-2012-2655)

It was discovered that PostgreSQL incorrectly handled certain bytes passed
to the crypt() function when using DES encryption. An attacker could use
this flaw to incorrectly handle authentication. (CVE-2012-2143)

It was discovered that PostgreSQL incorrectly handled SECURITY DEFINER and
SET attributes on procedural call handlers. An attacker could use this flaw
to cause PostgreSQL to crash, leading to a denial of service.
(CVE-2012-2655)

Update instructions

This update uses a new upstream release, which includes additional bug fixes. In general, a standard system update will make all the necessary changes.

Learn more about how to get the fixes.

The problem can be corrected by updating your system to the following package versions:

Ubuntu Release Package Version
8.04 hardy postgresql-8.3 –  8.3.19-0ubuntu8.04
12.04 precise postgresql-9.1 –  9.1.4-0ubuntu12.04
11.10 oneiric postgresql-9.1 –  9.1.4-0ubuntu11.10
11.04 natty postgresql-8.4 –  8.4.12-0ubuntu11.04
10.04 lucid postgresql-8.4 –  8.4.12-0ubuntu10.04

Reduce your security exposure

Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.

Get Ubuntu Pro

References

Have additional questions?

Talk to a member of the team ›