Scientific Linux: CVE-2010-3433 Moderate: PostgreSQL Security Update

Date: Tue, 5 Oct 2010 10:19:02 -0500
Reply-To: Troy Dawson 
Sender: Security Errata for Scientific Linux
 
From: Troy Dawson 
Subject: FASTBUGS for SL 5.x i386/x86_64
Comments: To: "This email address is being protected from spambots. You need JavaScript enabled to view it."
 

The following FASTBUGS have been uploaded to

 i386:
apr-util-1.2.7-11.el5_5.1.i386.rpm
apr-util-devel-1.2.7-11.el5_5.1.i386.rpm
apr-util-docs-1.2.7-11.el5_5.1.i386.rpm
apr-util-mysql-1.2.7-11.el5_5.1.i386.rpm
device-mapper-multipath-0.4.7-34.el5_5.6.i386.rpm
ghostscript-8.15.2-9.12.el5_5.i386.rpm
ghostscript-devel-8.15.2-9.12.el5_5.i386.rpm
ghostscript-gtk-8.15.2-9.12.el5_5.i386.rpm
gnome-session-2.16.0-8.el5.i386.rpm
iscsi-initiator-utils-6.2.0.871-0.20.el5_5.i386.rpm
kpartx-0.4.7-34.el5_5.6.i386.rpm
luci-0.12.2-12.el5_5.4.i386.rpm
mailman-2.1.9-6.el5.i386.rpm
openais-0.80.6-16.el5_5.9.i386.rpm
openais-devel-0.80.6-16.el5_5.9.i386.rpm
openCryptoki-2.2.4-22.el5_5.1.i386.rpm
openCryptoki-devel-2.2.4-22.el5_5.1.i386.rpm
perl-5.8.8-32.el5_5.2.i386.rpm
perl-suidperl-5.8.8-32.el5_5.2.i386.rpm
python-2.4.3-27.el5_5.2.i386.rpm
python-devel-2.4.3-27.el5_5.2.i386.rpm
python-tools-2.4.3-27.el5_5.2.i386.rpm
ricci-0.12.2-12.el5_5.4.i386.rpm
tkinter-2.4.3-27.el5_5.2.i386.rpm
xorg-x11-drv-ati-6.6.3-3.27.el5_5.1.i386.rpm
xorg-x11-server-sdk-1.1.1-48.76.el5_5.2.i386.rpm
xorg-x11-server-Xdmx-1.1.1-48.76.el5_5.2.i386.rpm
xorg-x11-server-Xephyr-1.1.1-48.76.el5_5.2.i386.rpm
xorg-x11-server-Xnest-1.1.1-48.76.el5_5.2.i386.rpm
xorg-x11-server-Xorg-1.1.1-48.76.el5_5.2.i386.rpm
xorg-x11-server-Xvfb-1.1.1-48.76.el5_5.2.i386.rpm
xorg-x11-server-Xvnc-source-1.1.1-48.76.el5_5.2.i386.rpm

 x86_64:
apr-util-1.2.7-11.el5_5.1.i386.rpm
apr-util-1.2.7-11.el5_5.1.x86_64.rpm
apr-util-devel-1.2.7-11.el5_5.1.i386.rpm
apr-util-devel-1.2.7-11.el5_5.1.x86_64.rpm
apr-util-docs-1.2.7-11.el5_5.1.x86_64.rpm
apr-util-mysql-1.2.7-11.el5_5.1.x86_64.rpm
device-mapper-multipath-0.4.7-34.el5_5.6.x86_64.rpm
ghostscript-8.15.2-9.12.el5_5.i386.rpm
ghostscript-8.15.2-9.12.el5_5.x86_64.rpm
ghostscript-devel-8.15.2-9.12.el5_5.i386.rpm
ghostscript-devel-8.15.2-9.12.el5_5.x86_64.rpm
ghostscript-gtk-8.15.2-9.12.el5_5.x86_64.rpm
gnome-session-2.16.0-8.el5.x86_64.rpm
iscsi-initiator-utils-6.2.0.871-0.20.el5_5.x86_64.rpm
kmod-kvm-83-164.el5_5.23.x86_64.rpm
kpartx-0.4.7-34.el5_5.6.x86_64.rpm
kvm-83-164.el5_5.23.x86_64.rpm
kvm-qemu-img-83-164.el5_5.23.x86_64.rpm
kvm-tools-83-164.el5_5.23.x86_64.rpm
luci-0.12.2-12.el5_5.4.x86_64.rpm
mailman-2.1.9-6.el5.x86_64.rpm
openais-0.80.6-16.el5_5.9.x86_64.rpm
openais-devel-0.80.6-16.el5_5.9.i386.rpm
openais-devel-0.80.6-16.el5_5.9.x86_64.rpm
openCryptoki-2.2.4-22.el5_5.1.i386.rpm
openCryptoki-2.2.4-22.el5_5.1.x86_64.rpm
openCryptoki-devel-2.2.4-22.el5_5.1.i386.rpm
openCryptoki-devel-2.2.4-22.el5_5.1.x86_64.rpm
perl-5.8.8-32.el5_5.2.x86_64.rpm
perl-suidperl-5.8.8-32.el5_5.2.x86_64.rpm
python-2.4.3-27.el5_5.2.x86_64.rpm
python-devel-2.4.3-27.el5_5.2.i386.rpm
python-devel-2.4.3-27.el5_5.2.x86_64.rpm
python-tools-2.4.3-27.el5_5.2.x86_64.rpm
ricci-0.12.2-12.el5_5.4.x86_64.rpm
tkinter-2.4.3-27.el5_5.2.x86_64.rpm
xorg-x11-drv-ati-6.6.3-3.27.el5_5.1.x86_64.rpm
xorg-x11-server-sdk-1.1.1-48.76.el5_5.2.x86_64.rpm
xorg-x11-server-Xdmx-1.1.1-48.76.el5_5.2.x86_64.rpm
xorg-x11-server-Xephyr-1.1.1-48.76.el5_5.2.x86_64.rpm
xorg-x11-server-Xnest-1.1.1-48.76.el5_5.2.x86_64.rpm
xorg-x11-server-Xorg-1.1.1-48.76.el5_5.2.x86_64.rpm
xorg-x11-server-Xvfb-1.1.1-48.76.el5_5.2.x86_64.rpm
xorg-x11-server-Xvnc-source-1.1.1-48.76.el5_5.2.x86_64.rpm

-Connie Sieh
-Troy Dawson
Date: Wed, 6 Oct 2010 13:23:04 -0500
Reply-To: Troy Dawson 
Sender: Security Errata for Scientific Linux
 
From: Troy Dawson 
Subject: Security ERRATA Moderate: postgresql and postgresql84 on SL4.x,
 SL5.x i386/x86_64
Comments: To: "This email address is being protected from spambots. You need JavaScript enabled to view it."
 

Synopsis:	Moderate: postgresql and postgresql84 security update
Issue date:	2010-10-06
CVE Names:	CVE-2010-3433

It was discovered that a user could utilize the features of the PL/Perl
and PL/Tcl languages to modify the behavior of a SECURITY DEFINER
function created by a different user. If the PL/Perl or PL/Tcl language
was used to implement a SECURITY DEFINER function, an authenticated
database user could use a PL/Perl or PL/Tcl script to modify the
behavior of that function during subsequent calls in the same session.
This would result in the modified or injected code also being executed
with the privileges of the user who created the SECURITY DEFINER
function, possibly leading to privilege escalation. (CVE-2010-3433)

For Scientific Linux 4, the updated postgresql packages upgrade
PostgreSQL to version 7.4.30.

For Scientific Linux 5, the updated postgresql packages upgrade
PostgreSQL to version 8.1.22, and the updated postgresql84 packages
upgrade PostgreSQL to version 8.4.5.

If the postgresql service is running, it will be automatically restarted
after installing this update.

SL 4.x

 SRPMS:
postgresql-7.4.30-1.el4_8.1.src.rpm
 i386:
postgresql-7.4.30-1.el4_8.1.i386.rpm
postgresql-contrib-7.4.30-1.el4_8.1.i386.rpm
postgresql-devel-7.4.30-1.el4_8.1.i386.rpm
postgresql-docs-7.4.30-1.el4_8.1.i386.rpm
postgresql-jdbc-7.4.30-1.el4_8.1.i386.rpm
postgresql-libs-7.4.30-1.el4_8.1.i386.rpm
postgresql-pl-7.4.30-1.el4_8.1.i386.rpm
postgresql-python-7.4.30-1.el4_8.1.i386.rpm
postgresql-server-7.4.30-1.el4_8.1.i386.rpm
postgresql-tcl-7.4.30-1.el4_8.1.i386.rpm
postgresql-test-7.4.30-1.el4_8.1.i386.rpm

 x86_64:
postgresql-7.4.30-1.el4_8.1.x86_64.rpm
postgresql-contrib-7.4.30-1.el4_8.1.x86_64.rpm
postgresql-devel-7.4.30-1.el4_8.1.x86_64.rpm
postgresql-docs-7.4.30-1.el4_8.1.x86_64.rpm
postgresql-jdbc-7.4.30-1.el4_8.1.x86_64.rpm
postgresql-libs-7.4.30-1.el4_8.1.i386.rpm
postgresql-libs-7.4.30-1.el4_8.1.x86_64.rpm
postgresql-pl-7.4.30-1.el4_8.1.x86_64.rpm
postgresql-python-7.4.30-1.el4_8.1.x86_64.rpm
postgresql-server-7.4.30-1.el4_8.1.x86_64.rpm
postgresql-tcl-7.4.30-1.el4_8.1.x86_64.rpm
postgresql-test-7.4.30-1.el4_8.1.x86_64.rpm

SL 5.x

 SRPMS:
postgresql-8.1.22-1.el5_5.1.src.rpm
postgresql84-8.4.5-1.el5_5.1.src.rpm
 i386:
postgresql-8.1.22-1.el5_5.1.i386.rpm
postgresql84-8.4.5-1.el5_5.1.i386.rpm
postgresql84-contrib-8.4.5-1.el5_5.1.i386.rpm
postgresql84-devel-8.4.5-1.el5_5.1.i386.rpm
postgresql84-docs-8.4.5-1.el5_5.1.i386.rpm
postgresql84-libs-8.4.5-1.el5_5.1.i386.rpm
postgresql84-plperl-8.4.5-1.el5_5.1.i386.rpm
postgresql84-plpython-8.4.5-1.el5_5.1.i386.rpm
postgresql84-pltcl-8.4.5-1.el5_5.1.i386.rpm
postgresql84-python-8.4.5-1.el5_5.1.i386.rpm
postgresql84-server-8.4.5-1.el5_5.1.i386.rpm
postgresql84-tcl-8.4.5-1.el5_5.1.i386.rpm
postgresql84-test-8.4.5-1.el5_5.1.i386.rpm
postgresql-contrib-8.1.22-1.el5_5.1.i386.rpm
postgresql-devel-8.1.22-1.el5_5.1.i386.rpm
postgresql-docs-8.1.22-1.el5_5.1.i386.rpm
postgresql-libs-8.1.22-1.el5_5.1.i386.rpm
postgresql-pl-8.1.22-1.el5_5.1.i386.rpm
postgresql-python-8.1.22-1.el5_5.1.i386.rpm
postgresql-server-8.1.22-1.el5_5.1.i386.rpm
postgresql-tcl-8.1.22-1.el5_5.1.i386.rpm
postgresql-test-8.1.22-1.el5_5.1.i386.rpm

 x86_64:
postgresql-8.1.22-1.el5_5.1.x86_64.rpm
postgresql84-8.4.5-1.el5_5.1.x86_64.rpm
postgresql84-contrib-8.4.5-1.el5_5.1.x86_64.rpm
postgresql84-devel-8.4.5-1.el5_5.1.i386.rpm
postgresql84-devel-8.4.5-1.el5_5.1.x86_64.rpm
postgresql84-docs-8.4.5-1.el5_5.1.x86_64.rpm
postgresql84-libs-8.4.5-1.el5_5.1.i386.rpm
postgresql84-libs-8.4.5-1.el5_5.1.x86_64.rpm
postgresql84-plperl-8.4.5-1.el5_5.1.x86_64.rpm
postgresql84-plpython-8.4.5-1.el5_5.1.x86_64.rpm
postgresql84-pltcl-8.4.5-1.el5_5.1.x86_64.rpm
postgresql84-python-8.4.5-1.el5_5.1.x86_64.rpm
postgresql84-server-8.4.5-1.el5_5.1.x86_64.rpm
postgresql84-tcl-8.4.5-1.el5_5.1.x86_64.rpm
postgresql84-test-8.4.5-1.el5_5.1.x86_64.rpm
postgresql-contrib-8.1.22-1.el5_5.1.x86_64.rpm
postgresql-devel-8.1.22-1.el5_5.1.i386.rpm
postgresql-devel-8.1.22-1.el5_5.1.x86_64.rpm
postgresql-docs-8.1.22-1.el5_5.1.x86_64.rpm
postgresql-libs-8.1.22-1.el5_5.1.i386.rpm
postgresql-libs-8.1.22-1.el5_5.1.x86_64.rpm
postgresql-pl-8.1.22-1.el5_5.1.x86_64.rpm
postgresql-python-8.1.22-1.el5_5.1.x86_64.rpm
postgresql-server-8.1.22-1.el5_5.1.x86_64.rpm
postgresql-tcl-8.1.22-1.el5_5.1.x86_64.rpm
postgresql-test-8.1.22-1.el5_5.1.x86_64.rpm

-Connie Sieh
-Troy Dawson