Stay Secure with the Latest Linux Advisories

security advisorysecurity updatecritical

SUSE: 2016:2414-1 Critical: Postgresql93 Untrusted Pointer Issue

An update that solves two vulnerabilities and has one An update that solves two vulnerabilities and has one An update that solves two vulnerabilities and has one errata is now available. errata is now available.. SUSE Security Update: Security update for postgresql93 ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:2414-1 Rating: important References: #973660 #993453 #993454 Cross-References: CVE-2016-5423 CVE-2016-5424 Affected Products: SUSE Linux Enterprise Server for SAP 12 SUSE Linux Enterprise Server 12-LTSS ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: This update for postgresql93 to version 9.3.14 fixes the several issues. These security issues were fixed: - CVE-2016-5423: CASE/WHEN with inlining can cause untrusted pointer dereference (bsc#993454). - CVE-2016-5424: Fix client programs' handling of special characters in database and role names (bsc#993453). This non-security issue was fixed: - bsc#973660: Added "Requires: timezone" to Service Pack For additional non-security issues please refer to - https://www.postgresql.org/docs/9.3/release-9-3-14.html - https://www.postgresql.org/docs/9.3/release-9-3-13.html - https://www.postgresql.org/docs/9.3/release-9-3-12.html Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server for SAP 12: zypper in -t patch SUSE-SLE-SAP-12-2016-1407=1 - SUSE Linux Enterprise Server 12-LTSS: zypper in -t patch SUSE-SLE-SERVER-12-2016-1407=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server for SAP 12 (noarch): postgresql93-docs-9.3.14-19.2 - SUSE LinuxEnterprise Server for SAP 12 (x86_64): postgresql93-9.3.14-19.2 postgresql93-contrib-9.3.14-19.2 postgresql93-contrib-debuginfo-9.3.14-19.2 postgresql93-debuginfo-9.3.14-19.2 postgresql93-debugsource-9.3.14-19.2 postgresql93-server-9.3.14-19.2 postgresql93-server-debuginfo-9.3.14-19.2 - SUSE Linux Enterprise Server 12-LTSS (ppc64le s390x x86_64): postgresql93-9.3.14-19.2 postgresql93-contrib-9.3.14-19.2 postgresql93-contrib-debuginfo-9.3.14-19.2 postgresql93-debuginfo-9.3.14-19.2 postgresql93-debugsource-9.3.14-19.2 postgresql93-server-9.3.14-19.2 postgresql93-server-debuginfo-9.3.14-19.2 - SUSE Linux Enterprise Server 12-LTSS (noarch): postgresql93-docs-9.3.14-19.2 References: https://www.suse.com/security/cve/CVE-2016-5423.html https://www.suse.com/security/cve/CVE-2016-5424.html https://bugzilla.suse.com/973660 https://bugzilla.suse.com/993453 https://bugzilla.suse.com/993454 . SUSE Security Patch resolves critical vulnerabilities in postgresql94, particularly focusing on unvalidated pointers and the management of non-standard characters.. SUSE Security Update, postgresql security, character handling. . Severity: Important. LinuxSecurity.com Team

Sep 29, 2016 •Important SuSE