postgres.git / summary / log / commit / refs
commit b8f0a57d13fce3c61f99f07077e07ccba0848e71
Author: Tom Lane <tgl@sss.pgh.pa.us>
Date: Mon Feb 02 16:24:08 2015 +0000
First released in: 9.5.0, 9.0.19, 9.1.15, 9.2.10, 9.3.6, 9.4.1
Last-minute updates for release notes.
Add entries for security issues.
Security: CVE-2015-0241 through CVE-2015-0244
doc/src/sgml/release-9.0.sgml | 85 +++++++++++++++++++++++++++++++++++++++++++
doc/src/sgml/release-9.1.sgml | 85 +++++++++++++++++++++++++++++++++++++++++++
doc/src/sgml/release-9.2.sgml | 85 +++++++++++++++++++++++++++++++++++++++++++
3 files changed, 255 insertions(+)
diff --git a/doc/src/sgml/release-9.0.sgml b/doc/src/sgml/release-9.0.sgml
index 3efe91d2d97..90339a5eaed 100644
--- a/doc/src/sgml/release-9.0.sgml
+++ b/doc/src/sgml/release-9.0.sgml
@@ -34,6 +34,91 @@
<itemizedlist>
+ <listitem>
+ <para>
+ Fix buffer overruns in <function>to_char()</>
+ (Bruce Momjian)
+ </para>
+
+ <para>
+ When <function>to_char()</> processes a numeric formatting template
+ calling for a large number of digits, <productname>PostgreSQL</>
+ would read past the end of a buffer. When processing a crafted
+ timestamp formatting template, <productname>PostgreSQL</> would write
+ past the end of a buffer. Either case could crash the server.
+ We have not ruled out the possibility of attacks that lead to
+ privilege escalation, though they seem unlikely.
+ (CVE-2015-0241)
+ </para>
+ </listitem>
+
+ <listitem>
+ <para>
+ Fix buffer overrun in replacement <function>*printf()</> functions
+ (Tom Lane)
+ </para>
+
+ <para>
+ <productname>PostgreSQL</> includes a replacement implementation
+ of <function>printf</> and related functions. This code will overrun
+ a stack buffer when formatting a floating point number (conversion
+ specifiers <literal>e</>, <literal>E</>, <literal>f</>, <literal>F</>,
+ <literal>g</> or <literal>G</>) with requested precision greater than
+ about 500. This will crash the server, and we have not ruled out the
+ possibility of attacks that lead to privilege escalation.
+ A database user can trigger such a buffer overrun through
+ the <function>to_char()</> SQL function. While that is the only
+ affected core <productname>PostgreSQL</> functionality, extension
+ modules that use printf-family functions may be at risk as well.
+ </para>
+
+ <para>
+ This issue primarily affects <productname>PostgreSQL</> on Windows.
+ <productname>PostgreSQL</> uses the system implementation of these
+ functions where adequate, which it is on other modern platforms.
+ (CVE-2015-0242)
+ </para>
+ </listitem>
+
+ <listitem>
+ <para>
+ Fix buffer overruns in <filename>contrib/pgcrypto</>
+ (Marko Tiikkaja, Noah Misch)
+ </para>
+
+ <para>
+ Errors in memory size tracking within the <filename>pgcrypto</>
+ module permitted stack buffer overruns and improper dependence on the
+ contents of uninitialized memory. The buffer overrun cases can
+ crash the server, and we have not ruled out the possibility of
+ attacks that lead to privilege escalation.
+ (CVE-2015-0243)
+ </para>
+ </listitem>
+
+ <listitem>
+ <para>
+ Fix possible loss of frontend/backend protocol synchronization after
+ an error
+ (Heikki Linnakangas)
+ </para>
+
+ <para>
+ If any error occurred while the server was in the middle of reading a
+ protocol message from the client, it could lose synchronization and
+ incorrectly try to interpret part of the message's data as a new
+ protocol message. An attacker able to submit crafted binary data
+ within a command parameter might succeed in injecting his own SQL
+ commands this way. Statement timeout and query cancellation are the
+ most likely sources of errors triggering this scenario. Particularly
+ vulnerable are applications that use a timeout and also submit
+ arbitrary user-crafted data as binary query parameters. Disabling
+ statement timeout will reduce, but not eliminate, the risk of
+ exploit. Our thanks to Emil Lenngren for reporting this issue.
+ (CVE-2015-0244)
+ </para>
+ </listitem>
+
<listitem>
<para>
Fix information leak via constraint-violation error messages
diff --git a/doc/src/sgml/release-9.1.sgml b/doc/src/sgml/release-9.1.sgml
index 6a0230b885d..eed8a365a1b 100644
--- a/doc/src/sgml/release-9.1.sgml
+++ b/doc/src/sgml/release-9.1.sgml
@@ -34,6 +34,91 @@
<itemizedlist>
+ <listitem>
+ <para>
+ Fix buffer overruns in <function>to_char()</>
+ (Bruce Momjian)
+ </para>
+
+ <para>
+ When <function>to_char()</> processes a numeric formatting template
+ calling for a large number of digits, <productname>PostgreSQL</>
+ would read past the end of a buffer. When processing a crafted
+ timestamp formatting template, <productname>PostgreSQL</> would write
+ past the end of a buffer. Either case could crash the server.
+ We have not ruled out the possibility of attacks that lead to
+ privilege escalation, though they seem unlikely.
+ (CVE-2015-0241)
+ </para>
+ </listitem>
+
+ <listitem>
+ <para>
+ Fix buffer overrun in replacement <function>*printf()</> functions
+ (Tom Lane)
+ </para>
+
+ <para>
+ <productname>PostgreSQL</> includes a replacement implementation
+ of <function>printf</> and related functions. This code will overrun
+ a stack buffer when formatting a floating point number (conversion
+ specifiers <literal>e</>, <literal>E</>, <literal>f</>, <literal>F</>,
+ <literal>g</> or <literal>G</>) with requested precision greater than
+ about 500. This will crash the server, and we have not ruled out the
+ possibility of attacks that lead to privilege escalation.
+ A database user can trigger such a buffer overrun through
+ the <function>to_char()</> SQL function. While that is the only
+ affected core <productname>PostgreSQL</> functionality, extension
+ modules that use printf-family functions may be at risk as well.
+ </para>
+
+ <para>
+ This issue primarily affects <productname>PostgreSQL</> on Windows.
+ <productname>PostgreSQL</> uses the system implementation of these
+ functions where adequate, which it is on other modern platforms.
+ (CVE-2015-0242)
+ </para>
+ </listitem>
+
+ <listitem>
+ <para>
+ Fix buffer overruns in <filename>contrib/pgcrypto</>
+ (Marko Tiikkaja, Noah Misch)
+ </para>
+
+ <para>
+ Errors in memory size tracking within the <filename>pgcrypto</>
+ module permitted stack buffer overruns and improper dependence on the
+ contents of uninitialized memory. The buffer overrun cases can
+ crash the server, and we have not ruled out the possibility of
+ attacks that lead to privilege escalation.
+ (CVE-2015-0243)
+ </para>
+ </listitem>
+
+ <listitem>
+ <para>
+ Fix possible loss of frontend/backend protocol synchronization after
+ an error
+ (Heikki Linnakangas)
+ </para>
+
+ <para>
+ If any error occurred while the server was in the middle of reading a
+ protocol message from the client, it could lose synchronization and
+ incorrectly try to interpret part of the message's data as a new
+ protocol message. An attacker able to submit crafted binary data
+ within a command parameter might succeed in injecting his own SQL
+ commands this way. Statement timeout and query cancellation are the
+ most likely sources of errors triggering this scenario. Particularly
+ vulnerable are applications that use a timeout and also submit
+ arbitrary user-crafted data as binary query parameters. Disabling
+ statement timeout will reduce, but not eliminate, the risk of
+ exploit. Our thanks to Emil Lenngren for reporting this issue.
+ (CVE-2015-0244)
+ </para>
+ </listitem>
+
<listitem>
<para>
Fix information leak via constraint-violation error messages
diff --git a/doc/src/sgml/release-9.2.sgml b/doc/src/sgml/release-9.2.sgml
index 132f68712ee..7bdbd89ae9e 100644
--- a/doc/src/sgml/release-9.2.sgml
+++ b/doc/src/sgml/release-9.2.sgml
@@ -43,6 +43,91 @@
<itemizedlist>
+ <listitem>
+ <para>
+ Fix buffer overruns in <function>to_char()</>
+ (Bruce Momjian)
+ </para>
+
+ <para>
+ When <function>to_char()</> processes a numeric formatting template
+ calling for a large number of digits, <productname>PostgreSQL</>
+ would read past the end of a buffer. When processing a crafted
+ timestamp formatting template, <productname>PostgreSQL</> would write
+ past the end of a buffer. Either case could crash the server.
+ We have not ruled out the possibility of attacks that lead to
+ privilege escalation, though they seem unlikely.
+ (CVE-2015-0241)
+ </para>
+ </listitem>
+
+ <listitem>
+ <para>
+ Fix buffer overrun in replacement <function>*printf()</> functions
+ (Tom Lane)
+ </para>
+
+ <para>
+ <productname>PostgreSQL</> includes a replacement implementation
+ of <function>printf</> and related functions. This code will overrun
+ a stack buffer when formatting a floating point number (conversion
+ specifiers <literal>e</>, <literal>E</>, <literal>f</>, <literal>F</>,
+ <literal>g</> or <literal>G</>) with requested precision greater than
+ about 500. This will crash the server, and we have not ruled out the
+ possibility of attacks that lead to privilege escalation.
+ A database user can trigger such a buffer overrun through
+ the <function>to_char()</> SQL function. While that is the only
+ affected core <productname>PostgreSQL</> functionality, extension
+ modules that use printf-family functions may be at risk as well.
+ </para>
+
+ <para>
+ This issue primarily affects <productname>PostgreSQL</> on Windows.
+ <productname>PostgreSQL</> uses the system implementation of these
+ functions where adequate, which it is on other modern platforms.
+ (CVE-2015-0242)
+ </para>
+ </listitem>
+
+ <listitem>
+ <para>
+ Fix buffer overruns in <filename>contrib/pgcrypto</>
+ (Marko Tiikkaja, Noah Misch)
+ </para>
+
+ <para>
+ Errors in memory size tracking within the <filename>pgcrypto</>
+ module permitted stack buffer overruns and improper dependence on the
+ contents of uninitialized memory. The buffer overrun cases can
+ crash the server, and we have not ruled out the possibility of
+ attacks that lead to privilege escalation.
+ (CVE-2015-0243)
+ </para>
+ </listitem>
+
+ <listitem>
+ <para>
+ Fix possible loss of frontend/backend protocol synchronization after
+ an error
+ (Heikki Linnakangas)
+ </para>
+
+ <para>
+ If any error occurred while the server was in the middle of reading a
+ protocol message from the client, it could lose synchronization and
+ incorrectly try to interpret part of the message's data as a new
+ protocol message. An attacker able to submit crafted binary data
+ within a command parameter might succeed in injecting his own SQL
+ commands this way. Statement timeout and query cancellation are the
+ most likely sources of errors triggering this scenario. Particularly
+ vulnerable are applications that use a timeout and also submit
+ arbitrary user-crafted data as binary query parameters. Disabling
+ statement timeout will reduce, but not eliminate, the risk of
+ exploit. Our thanks to Emil Lenngren for reporting this issue.
+ (CVE-2015-0244)
+ </para>
+ </listitem>
+
<listitem>
<para>
Fix information leak via constraint-violation error messages
[parent: 289592b23eef]