USN-1542-1: PostgreSQL vulnerabilities

Packages

postgresql-8.3 - Object-relational SQL database
postgresql-8.4 - Object-relational SQL database
postgresql-9.1 - Object-relational SQL database

Details

Peter Eisentraut discovered that the XSLT functionality in the optional
XML2 extension would allow unprivileged database users to both read and
write data with the privileges of the database server. (CVE-2012-3488)

Noah Misch and Tom Lane discovered that the XML functionality in the
optional XML2 extension would allow unprivileged database users to
read data with the privileges of the database server. (CVE-2012-3489)

Peter Eisentraut discovered that the XSLT functionality in the optional
XML2 extension would allow unprivileged database users to both read and
write data with the privileges of the database server. (CVE-2012-3488)

Noah Misch and Tom Lane discovered that the XML functionality in the
optional XML2 extension would allow unprivileged database users to
read data with the privileges of the database server. (CVE-2012-3489)

Update instructions

This update uses a new upstream release, which includes additional bug fixes. Due to upstream security policies, this update removes the ability of xslt_process() to fetch documents or stylesheets from external URLs. Please see http://www.postgresql.org/about/news/1407/ for more information. In general, a standard system update will make all the necessary changes.

Learn more about how to get the fixes.

Ubuntu Release	Package Version
8.04 hardy	postgresql-8.3 – 8.3.20-0ubuntu8.04
12.04 precise	postgresql-9.1 – 9.1.5-0ubuntu12.04
11.10 oneiric	postgresql-9.1 – 9.1.5-0ubuntu11.10
11.04 natty	postgresql-8.4 – 8.4.13-0ubuntu11.04
10.04 lucid	postgresql-8.4 – 8.4.13-0ubuntu10.04

Reduce your security exposure

Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.

Get Ubuntu Pro

Packages

Details

Update instructions

Reduce your security exposure

References