Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 524
Alerts This Week
Warning Icon 1 524

Ubuntu 15.04: USN-2772-1 Critical: PostgreSQL DoS and Data Exposure

ubuntu
Calendar Grey October 16, 2015
Scroller Ubuntu
Ubuntu Security Announcement USN-2773-1 addresses vulnerabilities in OpenSSL that are vital for maintaining secure communications, outlining essential patches.
PostgreSQL could be made to crash or expose private information if ithandled specially crafted data.

Summary

PostgreSQL could be made to crash or expose private information if it

handled specially crafted data.

Software Description:

- postgresql-9.4: Object-relational SQL database

- postgresql-9.3: Object-relational SQL database

- postgresql-9.1: Object-relational SQL database

Details:

Josh Kupershmidt discovered the pgCrypto extension could expose

several bytes of server memory if the crypt() function was provided a

too-short salt. An attacker could use this flaw to read private data.

(CVE-2015-5288)

Oskari Saarenmaa discovered that the json and jsonb handlers could exhaust

available stack space. An attacker could use this flaw to perform a denial

of service attack. This issue only affected Ubuntu 14.04 LTS and Ubuntu

15.04. (CVE-2015-5289)

Topics%20covered

Topics Covered

security advisory critical DoS Ubuntu PostgreSQL data exposure

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 15.04:
  postgresql-9.4                  9.4.5-0ubuntu0.15.04

Ubuntu 14.04 LTS:
  postgresql-9.3                  9.3.10-0ubuntu0.14.04

Ubuntu 12.04 LTS:
  postgresql-9.1                  9.1.19-0ubuntu0.12.04

This update uses a new upstream release, which includes additional bug
fixes. After a standard system update you need to restart PostgreSQL to
make all the necessary changes.

References

https://ubuntu.com/security/notices/USN-2772-1

CVE-2015-5288, CVE-2015-5289

Severity
critical
Lowest
Low
Medium
High
Critical

October 16, 2015

Topics%20covered

Topics Covered

security advisory critical DoS Ubuntu PostgreSQL data exposure

Package Information

https://launchpad.net/ubuntu/+source/postgresql-9.4/9.4.5-0ubuntu0.15.04
https://launchpad.net/ubuntu/+source/postgresql-9.3/9.3.10-0ubuntu0.14.04
https://launchpad.net/ubuntu/+source/postgresql-9.1/9.1.19-0ubuntu0.12.04

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.