[SECURITY] [DLA-152-1] postgresql-8.4 update

2015-02-1211:10:32

lists.debian.org

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.005 Low

EPSS

Percentile

76.2%

JSON

Package : postgresql-8.4
Version : 8.4.22lts1-0+deb6u1
CVE ID : CVE-2014-8161 CVE-2015-0241 CVE-2015-0243 CVE-2015-0244

Several vulnerabilities were discovered in PostgreSQL, a relational
database server system. The 8.4 branch is EOLed upstream, but still
present in Debian squeeze. This new LTS minor version contains the
fixes that were applied upstream to the 9.0.19 version, backported to
8.4.22 which was the last version officially released by the PostgreSQL
developers. This LTS effort for squeeze-lts is a community project
sponsored by credativ GmbH.

CVE-2014-8161: Information leak
A user with limited clearance on a table might have access to information
in columns without SELECT rights on through server error messages.

CVE-2015-0241: Out of boundaries read/write
The function to_char() might read/write past the end of a buffer. This
might crash the server when a formatting template is processed.

CVE-2015-0243: Buffer overruns in contrib/pgcrypto
The pgcrypto module is vulnerable to stack buffer overrun that might
crash the server.

CVE-2015-0244: SQL command injection
Emil Lenngren reported that an attacker can inject SQL commands when the
synchronization between client and server is lost.

OSVersionArchitecturePackageVersionFilename
Debian7mipsellibpgtypes3< 9.1.15-0+deb7u1libpgtypes3_9.1.15-0+deb7u1_mipsel.deb
Debian7ia64postgresql-9.1< 9.1.15-0+deb7u1postgresql-9.1_9.1.15-0+deb7u1_ia64.deb
Debian7armhfpostgresql-pltcl-9.1< 9.1.15-0+deb7u1postgresql-pltcl-9.1_9.1.15-0+deb7u1_armhf.deb
Debian6amd64postgresql-contrib-8.4< 8.4.22lts1-0+deb6u1postgresql-contrib-8.4_8.4.22lts1-0+deb6u1_amd64.deb
Debian7armelpostgresql-client-9.1< 9.1.15-0+deb7u1postgresql-client-9.1_9.1.15-0+deb7u1_armel.deb
Debian7mipsellibpq5< 9.1.15-0+deb7u1libpq5_9.1.15-0+deb7u1_mipsel.deb
Debian7i386postgresql-plpython-9.1< 9.1.15-0+deb7u1postgresql-plpython-9.1_9.1.15-0+deb7u1_i386.deb
Debian7amd64libpq5< 9.1.15-0+deb7u1libpq5_9.1.15-0+deb7u1_amd64.deb
Debian7armhflibpq-dev< 9.1.15-0+deb7u1libpq-dev_9.1.15-0+deb7u1_armhf.deb
Debian7mipslibpq5< 9.1.15-0+deb7u1libpq5_9.1.15-0+deb7u1_mips.deb

OS	Version	Architecture	Package	Version	Filename
Debian	7	mipsel	libpgtypes3	< 9.1.15-0+deb7u1	libpgtypes3_9.1.15-0+deb7u1_mipsel.deb
Debian	7	ia64	postgresql-9.1	< 9.1.15-0+deb7u1	postgresql-9.1_9.1.15-0+deb7u1_ia64.deb
Debian	7	armhf	postgresql-pltcl-9.1	< 9.1.15-0+deb7u1	postgresql-pltcl-9.1_9.1.15-0+deb7u1_armhf.deb
Debian	6	amd64	postgresql-contrib-8.4	< 8.4.22lts1-0+deb6u1	postgresql-contrib-8.4_8.4.22lts1-0+deb6u1_amd64.deb
Debian	7	armel	postgresql-client-9.1	< 9.1.15-0+deb7u1	postgresql-client-9.1_9.1.15-0+deb7u1_armel.deb
Debian	7	mipsel	libpq5	< 9.1.15-0+deb7u1	libpq5_9.1.15-0+deb7u1_mipsel.deb
Debian	7	i386	postgresql-plpython-9.1	< 9.1.15-0+deb7u1	postgresql-plpython-9.1_9.1.15-0+deb7u1_i386.deb
Debian	7	amd64	libpq5	< 9.1.15-0+deb7u1	libpq5_9.1.15-0+deb7u1_amd64.deb
Debian	7	armhf	libpq-dev	< 9.1.15-0+deb7u1	libpq-dev_9.1.15-0+deb7u1_armhf.deb
Debian	7	mips	libpq5	< 9.1.15-0+deb7u1	libpq5_9.1.15-0+deb7u1_mips.deb