Bug 38608 - postgresql-9.1: Multiple issues (4.0)
postgresql-9.1: Multiple issues (4.0)
Product: UCS
Classification: Unclassified
Component: Security updates
UCS 4.0
Other Linux
: P3 normal (vote)
: UCS 4.0-3-errata
Assigned To: Janek Walkenhorst
Philipp Hahn
Depends on:
  Show dependency treegraph
Reported: 2015-05-26 20:47 CEST by Arvid Requate
Modified: 2015-10-14 14:56 CEST (History)
1 user (show)

See Also:
What kind of report is it?: ---
What type of bug is this?: ---
Who will be affected by this bug?: ---
How will those affected feel about the bug?: ---
User Pain:
Enterprise Customer affected?:
School Customer affected?:
ISV affected?:
Waiting Support:
Flags outvoted (downgraded) after PO Review:
Ticket number:
Bug group (optional): Security
Max CVSS v3 score:
requate: Patch_Available+


Note You need to log in before you can comment on or make changes to this bug.
Description Arvid Requate univentionstaff 2015-05-26 20:47:10 CEST
Fix available in upstream Debian package version 9.1.16-0+deb7u1:

* Denial of service due to double-free after authentication timeout (CVE-2015-3165)
* Information disclosure due to missing checks of return codes from the standard library (CVE-2015-3166)
* Inconsistent error messages from contrib/pgcrypto (CVE-2015-3167)
Comment 1 Arvid Requate univentionstaff 2015-06-01 12:29:05 CEST
Upstream Debian package version 9.1.16-0+deb7u2 fixes a regression:

Comment 2 Janek Walkenhorst univentionstaff 2015-09-17 18:49:06 CEST
Tests (i386): OK
Advisory: 2015-09-17-postgresql-9.1.yaml
Comment 3 Philipp Hahn univentionstaff 2015-10-02 13:31:42 CEST
OK: DEBIAN_FRONTEND=noninteractive aptitude -y install '?source-package(postgresql-9.1)?not(?name(udeb))~i'
OK: DEBIAN_FRONTEND=noninteractive aptitude -y install '?source-package(postgresql-9.1)?not(?name(udeb))'
OK: zless /usr/share/doc/postgresql-client-9.1/changelog.Debian.gz
OK: univention-pkgdb

OK: 2015-09-17-postgresql-9.1.yaml
OK: errata-announce -V 2015-09-17-postgresql-9.1.yaml
OK: CVE-2015-3165
OK: CVE-2015-3166
OK: CVE-2015-3167
Comment 4 Janek Walkenhorst univentionstaff 2015-10-14 14:56:57 CEST