From: Devrim GÜNDÜZ Date: Mon, 17 May 2010 15:30:38 +0000 (+0000) Subject: Apply website updates for new releases. X-Git-Url: http://git.postgresql.org/gitweb/static/gitweb.js?a=commitdiff_plain;h=50532e58863a6339135cc834573fd8c0e94adacd;p=pgweb-old.git Apply website updates for new releases. git-svn-id: file:///Users/dpage/pgweb/svn-repo/trunk@2677 8f5c7a92-453e-0410-a47f-ad33c8a6b003 --- diff --git a/portal/system/global/settings.php b/portal/system/global/settings.php index ab62dc05..533dd4c6 100644 --- a/portal/system/global/settings.php +++ b/portal/system/global/settings.php @@ -35,39 +35,39 @@ define ('DEBUG', false); // Version information $_SETTINGS['versions'] = array( '8.4' => array ( - 'version' => '8.4.3', - 'reldate' => '2010-03-15', - 'relnotes' => 'release-8-4-3.html', + 'version' => '8.4.4', + 'reldate' => '2010-05-17', + 'relnotes' => 'release-8-4-4.html', 'frontpage' => 1, ), '8.3' => array ( - 'version' => '8.3.10', - 'reldate' => '2010-03-15', - 'relnotes' => 'release-8-3-10.html', + 'version' => '8.3.11', + 'reldate' => '2010-05-17', + 'relnotes' => 'release-8-3-11.html', 'frontpage' => 1, ), '8.2' => array ( - 'version' => '8.2.16', - 'reldate' => '2010-03-15', - 'relnotes' => 'release-8-2-16.html', + 'version' => '8.2.17', + 'reldate' => '2010-05-17', + 'relnotes' => 'release-8-2-17.html', 'frontpage' => 1, ), '8.1' => array ( - 'version' => '8.1.20', - 'reldate' => '2010-03-15', - 'relnotes' => 'release.html#RELEASE-8-1-20', + 'version' => '8.1.21', + 'reldate' => '2010-05-17', + 'relnotes' => 'release.html#RELEASE-8-1-21', 'frontpage' => 1, ), '8.0' => array ( - 'version' => '8.0.24', - 'reldate' => '2010-03-15', - 'relnotes' => 'release.html#RELEASE-8-0-24', + 'version' => '8.0.25', + 'reldate' => '2010-05-17', + 'relnotes' => 'release.html#RELEASE-8-0-25', 'frontpage' => 1, ), '7.4' => array ( - 'version' => '7.4.28', - 'reldate' => '2010-03-15', - 'relnotes' => 'release.html#RELEASE-7-4-28', + 'version' => '7.4.29', + 'reldate' => '2010-05-17', + 'relnotes' => 'release.html#RELEASE-7-4-29', 'frontpage' => 0, ) ); diff --git a/portal/template/en/support/security.html b/portal/template/en/support/security.html index 477b462b..73b47265 100644 --- a/portal/template/en/support/security.html +++ b/portal/template/en/support/security.html @@ -12,6 +12,7 @@ For reporting non-security bugs, please see the Rep

+ The PostgreSQL Global Development Group (PGDG) takes security seriously, allowing our users to place their trust in the web sites and applications built around PostgreSQL. Our approach covers fail-safe configuration options, @@ -53,28 +54,55 @@ to determine if the bug affects specific installations or not. Reference Affected
versions + Fixed in Component Class Description + + + CVE-2010-1169 + 8.4, 8.3, 8.2, 8.1, 8.0, 7.4 + 8.4.4, 8.3.11, 8.2.17, 8.1.21, 8.0.25, 7.4.29 + core server, limited deployments + C + A vulnerability in Safe.pm and PL/Perl can allow an authenticated user to run arbitrary Perl code on the database + server if PL/Perl is installed and enabled. + + + + + CVE-2010-1170 + 8.4, 8.3, 8.2, 8.1, 8.0, 7.4 + 8.4.4, 8.3.11, 8.2.17, 8.1.21, 8.0.25, 7.4.29 + core server, limited deployments + + C + Insecure permissions on the pltcl_modules table could allow an authenticated user to run arbitrary Tcl code on the + database server if PL/Tcl is installed and enabled. + + CVE-2009-4034 8.4, 8.3, 8.2, 8.1, 8.0, 7.4 + 8.4.2, 8.3.9, 8.2.15, 8.1.19, 8.0.23, 7.4.27 - client, core server, limited deployments only + client, core server, limited deployments A NULL Bytes in SSL Certificates can be used to falsify client or server authentication. This only affects users who have SSL enabled, perform certificate name validation or client certificate authentication, and where the Certificate Authority (CA) has been tricked into issuing invalid certificates. The use of a CA that can be trusted to always issue valid certificates is recommended to ensure you are not vulnerable to this issue. + CVE-2009-4136 8.4, 8.3, 8.2, 8.1, 8.0, 7.4 8.4.2, 8.3.9, 8.2.15, 8.1.19, 8.0.23, 7.4.27 core server C Privilege escalation via changing session state in an index function. This closes a corner case related to vulnerabilities CVE-2009-3230 and CVE-2007-6600 (below). + @@ -82,6 +110,7 @@ to determine if the bug affects specific installations or not. 8.4, 8.3, 8.2 8.4.1, 8.3.8, 8.2.14 core server + D Authenticated non-superusers can shut down the backend server by re-LOAD-ing libraries in $libdir/plugins, if any libraries are present there. @@ -89,6 +118,7 @@ to determine if the bug affects specific installations or not. CVE-2009-3230 8.4, 8.3, 8.2, 8.1, 8.0, 7.4 + 8.4.1, 8.3.8, 8.2.14, 8.1.18, 8.0.22, 7.4.26 core server C @@ -96,12 +126,14 @@ to determine if the bug affects specific installations or not. + CVE-2009-3231 8.3, 8.2 8.3.8, 8.2.14 core server A If PostgreSQL is configured with LDAP authentication, and your LDAP configuration allows anonymous binds, it is possible for a user to authenticate themselves with an empty password. + @@ -109,6 +141,7 @@ to determine if the bug affects specific installations or not. 8.3, 8.2, 8.1, 8.0, 7.4 8.3.7, 8.2.13, 8.1.17, 8.0.21, 7.4.25 core server + D It is possible to cause a momentary denial of service when there is a failure to convert a localized error message to the client-specified encoding. A valid login is required to exploit this vulnerability. @@ -116,6 +149,7 @@ to determine if the bug affects specific installations or not. CVE-2007-6600
Announcement 8.2, 8.1, 8.0, 7.4, 7.3 + 8.2.6, 8.1.11, 8.0.15, 7.4.19, 7.3.21 core server C @@ -123,11 +157,13 @@ to determine if the bug affects specific installations or not. + CVE-2007-4769
CVE-2007-4772
CVE-2007-6067
Announcement 8.2, 8.1, 8.0, 7.4 8.2.6, 8.1.11, 8.0.15, 7.4.19 core server B + Three vulnearbilities in the regular expression handling libraries can be exploited to cause a backend crash, infinite loops or memory exhaustion. This vulnearbility can be exploited through frontend applications that allow unfiltered regular expressions to be passed in queries. @@ -135,6 +171,7 @@ to determine if the bug affects specific installations or not. CVE-2007-6601
Announcement 8.2, 8.1, 8.0, 7.4, 7.3 8.2.6, 8.1.11, 8.0.15, 7.4.19, 7.3.21 + contrib module C DBLink functions combined with local trust or ident access control could be used by a malicious user togain superuser privileges. A valid login is required to exploit this vulnerability. @@ -142,6 +179,7 @@ to determine if the bug affects specific installations or not. CVE-2007-2138
Announcement + 8.2, 8.1, 8.0, 7.4, 7.3 8.2.4, 8.1.9, 8.0.13, 7.4.17, 7.3.19 core server @@ -155,6 +193,7 @@ to determine if the bug affects specific installations or not. 8.2.2, 8.1.7, 8.0.11 core server C + A vulnerability involving changing the data type of a table column can easily be exploited to cause a backend crash, and in principle might be used to read database content that the user should not be able to access. @@ -162,6 +201,7 @@ to determine if the bug affects specific installations or not. CVE-2007-0555 8.2, 8.1, 8.0, 7.4, 7.3 8.2.2, 8.1.7, 8.0.11, 7.4.16, 7.3.13 + core server C A vulnerability allows suppressing the normal checks that a SQL function returns the data type it's declared to do. These errors can easily be exploited to cause a backend crash, and in principle might be used to read database content that the user should not be able to access. @@ -169,6 +209,7 @@ to determine if the bug affects specific installations or not. CVE-2006-5542
Announcement + 8.1 8.1.5 core server @@ -182,6 +223,7 @@ to determine if the bug affects specific installations or not. 8.1.5, 8.0.9, 7.4.14 core server D + A bug in the coercion of unknown literals to ANYARRAY can cause a denial of service. A valid login is required to exploit this vulnerability. @@ -189,6 +231,7 @@ to determine if the bug affects specific installations or not. CVE-2006-5540
Announcement 8.1 8.1.5 + core server D A bug in the handling of aggregates in UPDATE can cause a denial of service. A valid login is required to exploit this vulnerability. @@ -196,6 +239,7 @@ to determine if the bug affects specific installations or not. CVE-2006-2314
FAQ + 8.1, 8.0, 7.4, 7.3 8.1.4, 8.0.8, 7.4.13, 7.3.15 core server @@ -209,6 +253,7 @@ to determine if the bug affects specific installations or not. 8.1.4, 8.0.8, 7.4.13, 7.3.15 core server A + An attacker able to submit crafted strings to an application that will embed those strings in SQL commands can use invalidly-encoded multibyte characters to bypass standard string-escaping methods, resulting in possible SQL injection. @@ -216,6 +261,7 @@ to determine if the bug affects specific installations or not. CVE-2006-0553
Announcement 8.1 8.1.3 + core server C A bug in the handling of SET ROLE allows escalation of privileges to any other database user, including superuser. A valid login is required to exploit this vulnerability. @@ -223,6 +269,7 @@ to determine if the bug affects specific installations or not. CVE-2006-0678
Announcement + 8.0, 7.4, 7.3 8.0.7, 7.4.12, 7.3.14 core server @@ -236,6 +283,7 @@ to determine if the bug affects specific installations or not. 8.1.2, 8.0.6 core server, win32 only B + On Windows only, the postmaster will exit if too many connection requests arrive simultaneously. This does not affect existing database connections, but will prevent new connections from being established until the postmaster is manually restarted. @@ -243,6 +291,7 @@ to determine if the bug affects specific installations or not. Announcement 8.1, 8.0, 7.4, 7.3 8.1.2, 8.0.6, 7.4.11, 7.3.13 + contrib module There is a signedness bug in Openwall gen_salt code that pgcrypto uses. This makes the salt space for md5 and xdes algorithms a lot smaller than it should be. This only affects the gen_salt() function with md5 or xdes. @@ -251,6 +300,7 @@ to determine if the bug affects specific installations or not. Release notes 8.0, 7.4 + 8.0.3, 7.4.8 core server D @@ -258,12 +308,14 @@ to determine if the bug affects specific installations or not. + CVE-2005-1410
Announcement 8.0, 7.4 8.0.3, 7.4.8 contrib module D The tsearch2 contrib module declares several functions as internal even though they don't take an internal argument. This allows attackers to cause a denial of service and may possibly have other impacts. A valid login is required to exploit this vulnerability.
Note! See the announcement for special upgrade instructions. + @@ -271,12 +323,14 @@ to determine if the bug affects specific installations or not. 8.0, 7.4, 7.3 8.0.3, 7.4.8, 7.3.10 core server + D Public EXECUTE access is given to certain character conversion functions that are not designed to be safe against malicious arguments. This can cause at least a denial of service. A valid login is required to exploit this vulnerability.
Note! See the announcement for special upgrade instructions. CVE-2005-0247 + 8.0, 7.4 8.0.2, 7.4.8 core server @@ -290,6 +344,7 @@ to determine if the bug affects specific installations or not. 8.0.1, 7.4.7, 7.3.9 contrib module D + The intagg contrib module allows attackers to cause a denial of service. A valid login is required to exploit this vulnerability. @@ -297,6 +352,7 @@ to determine if the bug affects specific installations or not. CVE-2005-0245 8.0, 7.4, 7.3 8.0.1, 7.4.7, 7.3.10 + core server C Multiple buffer overflows in the PL/PGSQL parser may allow attackers to execute arbitrary code. A valid login is required to exploit this vulnerability. @@ -304,6 +360,7 @@ to determine if the bug affects specific installations or not. CVE-2005-0244 + 8.0, 7.4, 7.3 8.0.1, 7.4.7, 7.3.9 core server @@ -317,6 +374,7 @@ to determine if the bug affects specific installations or not. 8.0.1, 7.4.7, 7.3.9 core server C + Any database user is permitted to load arbitrary shared libraries using the LOAD command. A valid login is required to exploit this vulnerability. @@ -324,6 +382,7 @@ to determine if the bug affects specific installations or not. CVE-2005-0977 7.4, 7.3 7.4.6, 7.3.8 + client contrib module Contrib script make_oidjoins_check uses unsafe temporary files. This script is not a user-facing script. @@ -332,45 +391,19 @@ to determine if the bug affects specific installations or not. Release notes 7.4 + 7.4.3 core server C A buffer overrun vulnerability exists in the enlargeStringInfo function and can be triggered by injecting bogus data in the datastream of an existing connection. A valid login is required to exploit this vulnerability. - - - Release notes - 7.3 - 7.3.6 - core server - C - A patch applied in 7.3.3 to fix a corner case in rule permissions checks turns out to have disabled rule-related permissions checks in many not-so-corner cases. This would for example allow users to insert into views they weren't supposed to have permission to insert into. A valid login is required to exploit this vulnerability. - - - - CVE-2003-0901 - 7.3 - 7.3.4 - core server - C - A buffer overflow in the to_ascii function allows attackers to execute arbitrary code. A valid login is required to exploit this vulnerability. - - - - Release notes - 7.3 - 7.3.2 - core server - C - The fastpath function interface did not properly check for permissions before executing a function. A valid login is required to exploit this vulnerability. -

Vulnerability Classes

-The following severity references are used in the above table: +The following vulnerability class references are used in the above table:

@@ -378,6 +411,7 @@ The following severity references are used in the above table: Class Description + @@ -392,6 +426,7 @@ The following severity references are used in the above table: C + A vulnerabilty that is exploitable for privilege escalation, but requiring a valid prior login. @@ -401,6 +436,7 @@ The following severity references are used in the above table: +
@@ -413,6 +449,7 @@ The following component references are used in the above table: + @@ -429,6 +466,7 @@ The following component references are used in the above table: + @@ -439,3 +477,4 @@ The following component references are used in the above table:
ComponentDescription
contrib module This vulnerability exists in a contrib modules. Contrib modules are not installed by default when PostgreSQL is installed from source. They may be installed by binary packages.
+ diff --git a/portal/template/index.html b/portal/template/index.html index c2adcfa5..c3fdf6a0 100644 --- a/portal/template/index.html +++ b/portal/template/index.html @@ -6,14 +6,14 @@ func_lang("The world's most advanced open source database")

- func_lang("PostgreSQL 9.0beta1 release now available!") + func_lang("PostgreSQL updates released.")

- func_lang("Beta release 9.0beta1 is now available for download. We encourage developers and users to test this version. The release includes built-in simple replication, the ability to execute read-only queries on a replication slave server and many other features.") + func_lang("Update releases 8.4.4, 8.3.11, 8.2.17, 8.1.21, 8.0.25 and 7.4.29 are now available for download. All users are recommended to upgrade as soon as possible.")