2013-07-12 12:45:05 by Jonathan Perkin | Files touched by this commit (181) |
Log message:
Bump PKGREVISION of all packages which create users, to pick up change of
sysutils/user_* packages.
|
2013-04-04 23:08:38 by Adam Ciarcinski | Files touched by this commit (66) | |
Log message:
The PostgreSQL Global Development Group has released a security update to all \
current versions of the PostgreSQL database system, including versions 9.2.4, \
9.1.9, 9.0.13, and 8.4.17. This update fixes a high-exposure security \
vulnerability in versions 9.0 and later. All users of the affected versions are \
strongly urged to apply the update immediately.
A major security issue fixed in this release, CVE-2013-1899, makes it possible \
for a connection request containing a database name that begins with \
"-" to be crafted that can damage or destroy files within a server's \
data directory. Anyone with access to the port the PostgreSQL server listens on \
can initiate this request.
Two lesser security fixes are also included in this release: CVE-2013-1900, \
wherein random numbers generated by contrib/pgcrypto functions may be easy for \
another database user to guess, and CVE-2013-1901, which mistakenly allows an \
unprivileged user to run commands that could interfere with in-progress backups. \
Finally, this release fixes two security issues with the graphical installers \
for Linux and Mac OS X: insecure passing of superuser passwords to a script, \
CVE-2013-1903 and the use of predictable filenames in /tmp CVE-2013-1902.
|
2013-02-09 12:19:19 by Adam Ciarcinski | Files touched by this commit (86) | |
Log message:
The PostgreSQL Global Development Group has released a security update to all \
current versions of the PostgreSQL database system, including versions 9.2.3, \
9.1.8, 9.0.12, 8.4.16, and 8.3.23. This update fixes a denial-of-service (DOS) \
vulnerability. All users should update their PostgreSQL installations as soon as \
possible.
The security issue fixed in this release, CVE-2013-0255, allows a previously \
authenticated user to crash the server by calling an internal function with \
invalid arguments. This issue was discovered by independent security researcher \
Sumit Soni this week and reported via Secunia SVCRP, and we are grateful for \
their efforts in making PostgreSQL more secure.
Today's update also fixes a performance regression which caused a decrease in \
throughput when using dynamic queries in stored procedures in version 9.2. \
Applications which use PL/pgSQL's EXECUTE are strongly affected by this \
regression and should be updated. Additionally, we have fixed intermittent \
crashes caused by CREATE/DROP INDEX CONCURRENTLY, and multiple minor issues with \
replication.
This release is expected to be the final update for version 8.3, which is now \
End-of-Life (EOL). Users of version 8.3 should plan to upgrade to a later \
version of PostgreSQL immediately. For more information, see our Versioning \
Policy.
This update release also contains fixes for many minor issues discovered and \
patched by the PostgreSQL community in the last two months, including:
* Prevent unnecessary table scans during vacuuming
* Prevent spurious cached plan error in PL/pgSQL
* Allow sub-SELECTs to be subscripted
* Prevent DROP OWNED from dropping databases or tablespaces
* Make ECPG use translated messages
* Allow PL/Python to use multi-table trigger functions (again) in 9.1 and 9.2
* Fix several activity log management issues on Windows
* Prevent autovacuum file truncation from being cancelled by deadlock_timeout
* Make extensions build with the .exe suffix automatically on Windows
* Fix concurrency issues with CREATE/DROP DATABASE
* Reject out-of-range values in to_date() conversion function
* Revert cost estimation for large indexes back to pre-9.2 behavior
* Make pg_basebackup tolerate timeline switches
* Cleanup leftover temp table entries during crash recovery
* Prevent infinite loop when COPY inserts a large tuple into a table with a \
large fillfactor
* Prevent integer overflow in dynahash creation
* Make pg_upgrade work with INVALID indexes
* Fix bugs in TYPE privileges
* Allow Contrib installchecks to run in their own databases
* Many documentation updates
* Add new timezone "FET".
|
2013-02-07 00:24:19 by Jonathan Perkin | Files touched by this commit (1351) | |
Log message:
PKGREVISION bumps for the security/openssl 1.0.1d update.
|
2012-10-02 23:25:56 by Aleksej Saushev | Files touched by this commit (323) |
Log message:
Drop superfluous PKG_DESTDIR_SUPPORT, "user-destdir" is default these days.
|
2012-07-01 21:49:26 by Daniel Horecki | Files touched by this commit (19) | |
Log message:
Security update to version 9.1.4.
Changes:
* Fix incorrect password transformation in contrib/pgcrypto's DES crypt()
function (Solar Designer)
* Ignore SECURITY DEFINER and SET attributes for a procedural language's call
handler (Tom Lane)
* Make contrib/citext's upgrade script fix collations of citext arrays and
domains over citext (Tom Lane)
* Allow numeric timezone offsets in timestamp input to be up to 16 hours away
from UTC (Tom Lane)
* Fix timestamp conversion to cope when the given time is exactly the last DST
transition time for the current timezone (Tom Lane)
* Fix text to name and char to name casts to perform string truncation
correctly in multibyte encodings (Karl Schnaitter)
* Fix memory copying bug in to_tsquery() (Heikki Linnakangas)
* Ensure txid_current() reports the correct epoch when executed in hot standby
(Simon Riggs)
* Fix planner's handling of outer PlaceHolderVars within subqueries (Tom Lane)
* Fix planning of UNION ALL subqueries with output columns that are not simple
variables (Tom Lane)
* Fix slow session startup when pg_attribute is very large (Tom Lane)
* Ensure sequential scans check for query cancel reasonably often (Merlin
Moncure)
* Ensure the Windows implementation of PGSemaphoreLock() clears
ImmediateInterruptOK before returning (Tom Lane)
* Show whole-row variables safely when printing views or rules (Abbas Butt, Tom
Lane)
* Fix COPY FROM to properly handle null marker strings that correspond to
invalid encoding (Tom Lane)
* Fix EXPLAIN VERBOSE for writable CTEs containing RETURNING clauses (Tom Lane)
* Fix PREPARE TRANSACTION to work correctly in the presence of advisory locks
(Tom Lane)
* Fix truncation of unlogged tables (Robert Haas)
* Ignore missing schemas during non-interactive assignments of search_path (Tom
Lane)
* Fix bugs with temporary or transient tables used in extension scripts (Tom
Lane)
* Ensure autovacuum worker processes perform stack depth checking properly
(Heikki Linnakangas)
* Fix logging collector to not lose log coherency under high load (Andrew
Dunstan)
* Fix logging collector to ensure it will restart file rotation after receiving
SIGHUP (Tom Lane)
* Fix "too many LWLocks taken" failure in GiST indexes (Heikki Linnakangas)
* Fix WAL replay logic for GIN indexes to not fail if the index was
subsequently dropped (Tom Lane)
* Correctly detect SSI conflicts of prepared transactions after a crash (Dan
Ports)
* Avoid synchronous replication delay when committing a transaction that only
modified temporary tables (Heikki Linnakangas)
* Fix error handling in pg_basebackup (Thomas Ogrisegg, Fujii Masao)
* Fix walsender to not go into a busy loop if connection is terminated (Fujii
Masao)
* Fix memory leak in PL/pgSQL's RETURN NEXT command (Joe Conway)
* Fix PL/pgSQL's GET DIAGNOSTICS command when the target is the function's
first variable (Tom Lane)
* Ensure that PL/Perl package-qualifies the _TD variable (Alex Hunsaker)
* Fix PL/Python functions returning composite types to accept a string for
their result value (Jan Urbanski)
* Fix potential access off the end of memory in psql's expanded display (\x)
mode (Peter Eisentraut)
* Fix several performance problems in pg_dump when the database contains many
objects (Jeff Janes, Tom Lane)
* Fix memory and file descriptor leaks in pg_restore when reading a
directory-format archive (Peter Eisentraut)
* Fix pg_upgrade for the case that a database stored in a non-default
tablespace contains a table in the cluster's default tablespace (Bruce Momjian)
* In ecpg, fix rare memory leaks and possible overwrite of one byte after the
sqlca_t structure (Peter Eisentraut)
* Fix contrib/dblink's dblink_exec() to not leak temporary database connections
upon error (Tom Lane)
* Fix contrib/dblink to report the correct connection name in error messages
(Kyotaro Horiguchi)
* Fix contrib/vacuumlo to use multiple transactions when dropping many large
objects (Tim Lewis, Robert Haas, Tom Lane)
* Update time zone data files to tzdata release 2012c for DST law changes in
Antarctica, Armenia, Chile, Cuba, Falkland Islands, Gaza, Haiti, Hebron,
Morocco, Syria, and Tokelau Islands;
|
2012-06-14 09:45:42 by Steven Drake | Files touched by this commit (1202) |
Log message:
Recursive PKGREVISION bump for libxml2 buildlink addition.
|
2012-03-03 15:01:13 by Adam Ciarcinski | Files touched by this commit (17) |
Log message:
Changes:
* Fix btree index corruption from insertions concurrent with vacuuming
* Recover from errors occurring during WAL replay of DROP TABLESPACE
* Fix transient zeroing of shared buffers during WAL replay
* Fix postmaster to attempt restart after a hot-standby crash
* Fix corner case in SSI transaction cleanup
* Update per-column permissions, not only per-table permissions, when changing
table owner
* Fix handling of data-modifying WITH subplans in READ COMMITTED rechecking
* Fix for "could not find plan for CTE" failures
* Fix unsupported node type error caused by COLLATE in an INSERT expression
* Avoid crashing when we have problems deleting table files post-commit
* Fix recently-introduced memory leak in processing of inet/cidr
* Fix GIN cost estimation to handle column IN (...) index conditions
* Fix I/O-conversion-related memory leaks in plpgsql
* Teach pg_upgrade to handle renaming of plpython's shared library (affecting
upgrades to 9.1)
|
2011-12-06 21:37:33 by Adam Ciarcinski | Files touched by this commit (6) |
Log message:
Changes 9.1.2:
* Fix bugs in information_schema.referential_constraints view
* Correct collations for citext columns and indexes
* Prevent possible crash when joining to a scalar function
* Prevent transitory data corruption of GIN indexes after a crash
* Prevent data corruption on TOAST columns when copying data
* Fix failures during hot standby startup
* Correct another "variable not found in subplan target list" bug
* Fix bug with sorting on aggregate expressions in windowing functions
* Multiple bug fixes for pg_upgrade
* Change Foreign Key creation order to better support self-referential keys
* Multiple bug fixes to CREATE EXTENSION
* Ensure that function return type and data returned from PL/perl agree
* Ensure that PL/perl strings are always UTF-8
* Assorted bug fixes for various Extensions
* Updates to the time zone database, particularly to CST6
|
2011-09-27 13:04:50 by Adam Ciarcinski | Files touched by this commit (5) |
Log message:
Changes 9.1.1:
* Make pg_options_to_table return NULL for an option with no value
* Fix memory leak at end of a GiST index scan
* Fix explicit reference to pg_temp schema in "CREATE TEMPORARY TABLE"
|