Security update for postgresql94 SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2016:0482-1 Final 1 1 2016-02-16T17:31:39Z current 2016-02-16T17:31:39Z 2016-02-16T17:31:39Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for postgresql94 This update of postgresql94 to 9.4.5 fixes the following issues: * CVE-2015-5289: json or jsonb input values constructed from arbitrary user input could have crashed the PostgreSQL server and caused a denial of service (bsc#949670) * CVE-2015-5288: crypt() (pgCrypto extension) couldi potentially be exploited to read a few additional bytes of memory (bsc#949669) Also contains all changes and bugfixes in the upstream 9.4.5 release: http://www.postgresql.org/docs/current/static/release-9-4-5.html The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). sdksp3-postgreqsql94-20160120-12409,sdksp4-postgreqsql94-20160120-12409,sledsp3-postgreqsql94-20160120-12409,sledsp4-postgreqsql94-20160120-12409,sleman21-postgreqsql94-20160120-12409,slessp3-postgreqsql94-20160120-12409,slessp4-postgreqsql94-20160120-12409 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2016/suse-su-20160482-1/ Link for SUSE-SU-2016:0482-1 https://lists.suse.com/pipermail/sle-security-updates/2016-February/001887.html E-Mail link for SUSE-SU-2016:0482-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/949669 SUSE Bug 949669 https://bugzilla.suse.com/949670 SUSE Bug 949670 https://www.suse.com/security/cve/CVE-2015-5288/ SUSE CVE CVE-2015-5288 page https://www.suse.com/security/cve/CVE-2015-5289/ SUSE CVE CVE-2015-5289 page SUSE Linux Enterprise Desktop 11 SP3 SUSE Linux Enterprise Desktop 11 SP4 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA SUSE Linux Enterprise Server 11 SP4 SUSE Linux Enterprise Server for SAP Applications 11 SP3 SUSE Linux Enterprise Server for SAP Applications 11 SP4 SUSE Linux Enterprise Software Development Kit 11 SP3 SUSE Linux Enterprise Software Development Kit 11 SP4 SUSE Manager 2.1 postgresql94-devel-9.4.5-0.8.3 libecpg6-9.4.5-0.8.3 libpq5-9.4.5-0.8.3 libpq5-32bit-9.4.5-0.8.3 postgresql94-9.4.5-0.8.3 postgresql94-docs-9.4.5-0.8.3 postgresql94-pltcl-9.4.5-0.8.3 postgresql94-contrib-9.4.5-0.8.3 postgresql94-server-9.4.5-0.8.3 libecpg6-9.4.5-0.8.3 as a component of SUSE Linux Enterprise Desktop 11 SP3 libpq5-9.4.5-0.8.3 as a component of SUSE Linux Enterprise Desktop 11 SP3 libpq5-32bit-9.4.5-0.8.3 as a component of SUSE Linux Enterprise Desktop 11 SP3 postgresql94-9.4.5-0.8.3 as a component of SUSE Linux Enterprise Desktop 11 SP3 postgresql94-docs-9.4.5-0.8.3 as a component of SUSE Linux Enterprise Desktop 11 SP3 libecpg6-9.4.5-0.8.3 as a component of SUSE Linux Enterprise Desktop 11 SP4 libpq5-9.4.5-0.8.3 as a component of SUSE Linux Enterprise Desktop 11 SP4 libpq5-32bit-9.4.5-0.8.3 as a component of SUSE Linux Enterprise Desktop 11 SP4 postgresql94-9.4.5-0.8.3 as a component of SUSE Linux Enterprise Desktop 11 SP4 postgresql94-docs-9.4.5-0.8.3 as a component of SUSE Linux Enterprise Desktop 11 SP4 libecpg6-9.4.5-0.8.3 as a component of SUSE Linux Enterprise Server 11 SP3 libpq5-9.4.5-0.8.3 as a component of SUSE Linux Enterprise Server 11 SP3 libpq5-32bit-9.4.5-0.8.3 as a component of SUSE Linux Enterprise Server 11 SP3 postgresql94-9.4.5-0.8.3 as a component of SUSE Linux Enterprise Server 11 SP3 postgresql94-contrib-9.4.5-0.8.3 as a component of SUSE Linux Enterprise Server 11 SP3 postgresql94-docs-9.4.5-0.8.3 as a component of SUSE Linux Enterprise Server 11 SP3 postgresql94-server-9.4.5-0.8.3 as a component of SUSE Linux Enterprise Server 11 SP3 libecpg6-9.4.5-0.8.3 as a component of SUSE Linux Enterprise Server 11 SP3-TERADATA libpq5-9.4.5-0.8.3 as a component of SUSE Linux Enterprise Server 11 SP3-TERADATA libpq5-32bit-9.4.5-0.8.3 as a component of SUSE Linux Enterprise Server 11 SP3-TERADATA postgresql94-9.4.5-0.8.3 as a component of SUSE Linux Enterprise Server 11 SP3-TERADATA postgresql94-contrib-9.4.5-0.8.3 as a component of SUSE Linux Enterprise Server 11 SP3-TERADATA postgresql94-docs-9.4.5-0.8.3 as a component of SUSE Linux Enterprise Server 11 SP3-TERADATA postgresql94-server-9.4.5-0.8.3 as a component of SUSE Linux Enterprise Server 11 SP3-TERADATA libecpg6-9.4.5-0.8.3 as a component of SUSE Linux Enterprise Server 11 SP4 libpq5-9.4.5-0.8.3 as a component of SUSE Linux Enterprise Server 11 SP4 libpq5-32bit-9.4.5-0.8.3 as a component of SUSE Linux Enterprise Server 11 SP4 postgresql94-9.4.5-0.8.3 as a component of SUSE Linux Enterprise Server 11 SP4 postgresql94-contrib-9.4.5-0.8.3 as a component of SUSE Linux Enterprise Server 11 SP4 postgresql94-docs-9.4.5-0.8.3 as a component of SUSE Linux Enterprise Server 11 SP4 postgresql94-server-9.4.5-0.8.3 as a component of SUSE Linux Enterprise Server 11 SP4 libecpg6-9.4.5-0.8.3 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP3 libpq5-9.4.5-0.8.3 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP3 libpq5-32bit-9.4.5-0.8.3 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP3 postgresql94-9.4.5-0.8.3 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP3 postgresql94-contrib-9.4.5-0.8.3 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP3 postgresql94-docs-9.4.5-0.8.3 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP3 postgresql94-server-9.4.5-0.8.3 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP3 libecpg6-9.4.5-0.8.3 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 libpq5-9.4.5-0.8.3 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 libpq5-32bit-9.4.5-0.8.3 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 postgresql94-9.4.5-0.8.3 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 postgresql94-contrib-9.4.5-0.8.3 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 postgresql94-docs-9.4.5-0.8.3 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 postgresql94-server-9.4.5-0.8.3 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 postgresql94-devel-9.4.5-0.8.3 as a component of SUSE Linux Enterprise Software Development Kit 11 SP3 postgresql94-devel-9.4.5-0.8.3 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 postgresql94-pltcl-9.4.5-0.8.3 as a component of SUSE Manager 2.1 The crypt function in contrib/pgcrypto in PostgreSQL before 9.0.23, 9.1.x before 9.1.19, 9.2.x before 9.2.14, 9.3.x before 9.3.10, and 9.4.x before 9.4.5 allows attackers to cause a denial of service (server crash) or read arbitrary server memory via a "too-short" salt. CVE-2015-5288 SUSE Linux Enterprise Desktop 11 SP3:libecpg6-9.4.5-0.8.3 SUSE Linux Enterprise Desktop 11 SP3:libpq5-32bit-9.4.5-0.8.3 SUSE Linux Enterprise Desktop 11 SP3:libpq5-9.4.5-0.8.3 SUSE Linux Enterprise Desktop 11 SP3:postgresql94-9.4.5-0.8.3 SUSE Linux Enterprise Desktop 11 SP3:postgresql94-docs-9.4.5-0.8.3 SUSE Linux Enterprise Desktop 11 SP4:libecpg6-9.4.5-0.8.3 SUSE Linux Enterprise Desktop 11 SP4:libpq5-32bit-9.4.5-0.8.3 SUSE Linux Enterprise Desktop 11 SP4:libpq5-9.4.5-0.8.3 SUSE Linux Enterprise Desktop 11 SP4:postgresql94-9.4.5-0.8.3 SUSE Linux Enterprise Desktop 11 SP4:postgresql94-docs-9.4.5-0.8.3 SUSE Linux Enterprise Server 11 SP3-TERADATA:libecpg6-9.4.5-0.8.3 SUSE Linux Enterprise Server 11 SP3-TERADATA:libpq5-32bit-9.4.5-0.8.3 SUSE Linux Enterprise Server 11 SP3-TERADATA:libpq5-9.4.5-0.8.3 SUSE Linux Enterprise Server 11 SP3-TERADATA:postgresql94-9.4.5-0.8.3 SUSE Linux Enterprise Server 11 SP3-TERADATA:postgresql94-contrib-9.4.5-0.8.3 SUSE Linux Enterprise Server 11 SP3-TERADATA:postgresql94-docs-9.4.5-0.8.3 SUSE Linux Enterprise Server 11 SP3-TERADATA:postgresql94-server-9.4.5-0.8.3 SUSE Linux Enterprise Server 11 SP3:libecpg6-9.4.5-0.8.3 SUSE Linux Enterprise Server 11 SP3:libpq5-32bit-9.4.5-0.8.3 SUSE Linux Enterprise Server 11 SP3:libpq5-9.4.5-0.8.3 SUSE Linux Enterprise Server 11 SP3:postgresql94-9.4.5-0.8.3 SUSE Linux Enterprise Server 11 SP3:postgresql94-contrib-9.4.5-0.8.3 SUSE Linux Enterprise Server 11 SP3:postgresql94-docs-9.4.5-0.8.3 SUSE Linux Enterprise Server 11 SP3:postgresql94-server-9.4.5-0.8.3 SUSE Linux Enterprise Server 11 SP4:libecpg6-9.4.5-0.8.3 SUSE Linux Enterprise Server 11 SP4:libpq5-32bit-9.4.5-0.8.3 SUSE Linux Enterprise Server 11 SP4:libpq5-9.4.5-0.8.3 SUSE Linux Enterprise Server 11 SP4:postgresql94-9.4.5-0.8.3 SUSE Linux Enterprise Server 11 SP4:postgresql94-contrib-9.4.5-0.8.3 SUSE Linux Enterprise Server 11 SP4:postgresql94-docs-9.4.5-0.8.3 SUSE Linux Enterprise Server 11 SP4:postgresql94-server-9.4.5-0.8.3 SUSE Linux Enterprise Server for SAP Applications 11 SP3:libecpg6-9.4.5-0.8.3 SUSE Linux Enterprise Server for SAP Applications 11 SP3:libpq5-32bit-9.4.5-0.8.3 SUSE Linux Enterprise Server for SAP Applications 11 SP3:libpq5-9.4.5-0.8.3 SUSE Linux Enterprise Server for SAP Applications 11 SP3:postgresql94-9.4.5-0.8.3 SUSE Linux Enterprise Server for SAP Applications 11 SP3:postgresql94-contrib-9.4.5-0.8.3 SUSE Linux Enterprise Server for SAP Applications 11 SP3:postgresql94-docs-9.4.5-0.8.3 SUSE Linux Enterprise Server for SAP Applications 11 SP3:postgresql94-server-9.4.5-0.8.3 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libecpg6-9.4.5-0.8.3 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libpq5-32bit-9.4.5-0.8.3 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libpq5-9.4.5-0.8.3 SUSE Linux Enterprise Server for SAP Applications 11 SP4:postgresql94-9.4.5-0.8.3 SUSE Linux Enterprise Server for SAP Applications 11 SP4:postgresql94-contrib-9.4.5-0.8.3 SUSE Linux Enterprise Server for SAP Applications 11 SP4:postgresql94-docs-9.4.5-0.8.3 SUSE Linux Enterprise Server for SAP Applications 11 SP4:postgresql94-server-9.4.5-0.8.3 SUSE Linux Enterprise Software Development Kit 11 SP3:postgresql94-devel-9.4.5-0.8.3 SUSE Linux Enterprise Software Development Kit 11 SP4:postgresql94-devel-9.4.5-0.8.3 SUSE Manager 2.1:postgresql94-pltcl-9.4.5-0.8.3 low 4 AV:N/AC:L/Au:S/C:N/I:N/A:P 6.4 AV:N/AC:L/Au:N/C:P/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20160482-1/ https://www.suse.com/security/cve/CVE-2015-5288.html CVE-2015-5288 https://bugzilla.suse.com/949669 SUSE Bug 949669 https://bugzilla.suse.com/949670 SUSE Bug 949670 Multiple stack-based buffer overflows in json parsing in PostgreSQL before 9.3.x before 9.3.10 and 9.4.x before 9.4.5 allow attackers to cause a denial of service (server crash) via unspecified vectors, which are not properly handled in (1) json or (2) jsonb values. CVE-2015-5289 SUSE Linux Enterprise Desktop 11 SP3:libecpg6-9.4.5-0.8.3 SUSE Linux Enterprise Desktop 11 SP3:libpq5-32bit-9.4.5-0.8.3 SUSE Linux Enterprise Desktop 11 SP3:libpq5-9.4.5-0.8.3 SUSE Linux Enterprise Desktop 11 SP3:postgresql94-9.4.5-0.8.3 SUSE Linux Enterprise Desktop 11 SP3:postgresql94-docs-9.4.5-0.8.3 SUSE Linux Enterprise Desktop 11 SP4:libecpg6-9.4.5-0.8.3 SUSE Linux Enterprise Desktop 11 SP4:libpq5-32bit-9.4.5-0.8.3 SUSE Linux Enterprise Desktop 11 SP4:libpq5-9.4.5-0.8.3 SUSE Linux Enterprise Desktop 11 SP4:postgresql94-9.4.5-0.8.3 SUSE Linux Enterprise Desktop 11 SP4:postgresql94-docs-9.4.5-0.8.3 SUSE Linux Enterprise Server 11 SP3-TERADATA:libecpg6-9.4.5-0.8.3 SUSE Linux Enterprise Server 11 SP3-TERADATA:libpq5-32bit-9.4.5-0.8.3 SUSE Linux Enterprise Server 11 SP3-TERADATA:libpq5-9.4.5-0.8.3 SUSE Linux Enterprise Server 11 SP3-TERADATA:postgresql94-9.4.5-0.8.3 SUSE Linux Enterprise Server 11 SP3-TERADATA:postgresql94-contrib-9.4.5-0.8.3 SUSE Linux Enterprise Server 11 SP3-TERADATA:postgresql94-docs-9.4.5-0.8.3 SUSE Linux Enterprise Server 11 SP3-TERADATA:postgresql94-server-9.4.5-0.8.3 SUSE Linux Enterprise Server 11 SP3:libecpg6-9.4.5-0.8.3 SUSE Linux Enterprise Server 11 SP3:libpq5-32bit-9.4.5-0.8.3 SUSE Linux Enterprise Server 11 SP3:libpq5-9.4.5-0.8.3 SUSE Linux Enterprise Server 11 SP3:postgresql94-9.4.5-0.8.3 SUSE Linux Enterprise Server 11 SP3:postgresql94-contrib-9.4.5-0.8.3 SUSE Linux Enterprise Server 11 SP3:postgresql94-docs-9.4.5-0.8.3 SUSE Linux Enterprise Server 11 SP3:postgresql94-server-9.4.5-0.8.3 SUSE Linux Enterprise Server 11 SP4:libecpg6-9.4.5-0.8.3 SUSE Linux Enterprise Server 11 SP4:libpq5-32bit-9.4.5-0.8.3 SUSE Linux Enterprise Server 11 SP4:libpq5-9.4.5-0.8.3 SUSE Linux Enterprise Server 11 SP4:postgresql94-9.4.5-0.8.3 SUSE Linux Enterprise Server 11 SP4:postgresql94-contrib-9.4.5-0.8.3 SUSE Linux Enterprise Server 11 SP4:postgresql94-docs-9.4.5-0.8.3 SUSE Linux Enterprise Server 11 SP4:postgresql94-server-9.4.5-0.8.3 SUSE Linux Enterprise Server for SAP Applications 11 SP3:libecpg6-9.4.5-0.8.3 SUSE Linux Enterprise Server for SAP Applications 11 SP3:libpq5-32bit-9.4.5-0.8.3 SUSE Linux Enterprise Server for SAP Applications 11 SP3:libpq5-9.4.5-0.8.3 SUSE Linux Enterprise Server for SAP Applications 11 SP3:postgresql94-9.4.5-0.8.3 SUSE Linux Enterprise Server for SAP Applications 11 SP3:postgresql94-contrib-9.4.5-0.8.3 SUSE Linux Enterprise Server for SAP Applications 11 SP3:postgresql94-docs-9.4.5-0.8.3 SUSE Linux Enterprise Server for SAP Applications 11 SP3:postgresql94-server-9.4.5-0.8.3 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libecpg6-9.4.5-0.8.3 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libpq5-32bit-9.4.5-0.8.3 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libpq5-9.4.5-0.8.3 SUSE Linux Enterprise Server for SAP Applications 11 SP4:postgresql94-9.4.5-0.8.3 SUSE Linux Enterprise Server for SAP Applications 11 SP4:postgresql94-contrib-9.4.5-0.8.3 SUSE Linux Enterprise Server for SAP Applications 11 SP4:postgresql94-docs-9.4.5-0.8.3 SUSE Linux Enterprise Server for SAP Applications 11 SP4:postgresql94-server-9.4.5-0.8.3 SUSE Linux Enterprise Software Development Kit 11 SP3:postgresql94-devel-9.4.5-0.8.3 SUSE Linux Enterprise Software Development Kit 11 SP4:postgresql94-devel-9.4.5-0.8.3 SUSE Manager 2.1:postgresql94-pltcl-9.4.5-0.8.3 moderate 6.4 AV:N/AC:L/Au:N/C:P/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20160482-1/ https://www.suse.com/security/cve/CVE-2015-5289.html CVE-2015-5289 https://bugzilla.suse.com/949669 SUSE Bug 949669 https://bugzilla.suse.com/949670 SUSE Bug 949670