SUSE-SU-2012:1336-1: moderate: Security update for PostgreSQL

[sle-security-updates at lists.suse.com]

   SUSE Security Update: Security update for PostgreSQL
______________________________________________________________________________

Announcement ID:    SUSE-SU-2012:1336-1
Rating:             moderate
References:         #700876 #765069 #770193 #776523 
Cross-References:   CVE-2012-3488 CVE-2012-3489
Affected Products:
                    SUSE Linux Enterprise Server 10 SP4
                    SUSE Linux Enterprise Desktop 10 SP4
                    SLE SDK 10 SP4
______________________________________________________________________________

   An update that solves two vulnerabilities and has two fixes
   is now available. It includes one version update.

Description:


   PostgreSQL was updated to the latest stable release 8.1.23,
   fixing various  bugs and security issues.

   The following security issues have been fixed:

   * CVE-2012-3488: This update fixes arbitrary read and
   write of files via XSL functionality.
   * CVE-2012-2655: postgresql: denial of service (stack
   exhaustion) via specially-crafted SQL.
   * CVE-2011-2483: crypt_blowfish was mishandling 8 bit
   characters.

   Security Issue references:

   * CVE-2012-3488
   <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3488
   >
   * CVE-2012-3489
   <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3489
   >



Package List:

   - SUSE Linux Enterprise Server 10 SP4 (i586 ia64 ppc ppc64 s390x x86_64) [New Version: 8.1.23]:

      postgresql-8.1.23-0.11.1

   - SUSE Linux Enterprise Server 10 SP4 (i586 ia64 ppc s390x x86_64) [New Version: 8.1.23]:

      postgresql-contrib-8.1.23-0.11.1
      postgresql-devel-8.1.23-0.11.1
      postgresql-docs-8.1.23-0.11.1
      postgresql-libs-8.1.23-0.11.1
      postgresql-pl-8.1.23-0.11.1
      postgresql-server-8.1.23-0.11.1

   - SUSE Linux Enterprise Server 10 SP4 (s390x x86_64) [New Version: 8.1.23]:

      postgresql-libs-32bit-8.1.23-0.11.1

   - SUSE Linux Enterprise Server 10 SP4 (ia64) [New Version: 8.1.23]:

      postgresql-libs-x86-8.1.23-0.11.1

   - SUSE Linux Enterprise Server 10 SP4 (ppc) [New Version: 8.1.23]:

      postgresql-libs-64bit-8.1.23-0.11.1

   - SUSE Linux Enterprise Desktop 10 SP4 (i586 x86_64) [New Version: 8.1.23]:

      postgresql-devel-8.1.23-0.11.1
      postgresql-libs-8.1.23-0.11.1

   - SUSE Linux Enterprise Desktop 10 SP4 (x86_64) [New Version: 8.1.23]:

      postgresql-libs-32bit-8.1.23-0.11.1

   - SLE SDK 10 SP4 (i586 ia64 ppc ppc64 s390x x86_64) [New Version: 8.1.23]:

      postgresql-8.1.23-0.11.1

   - SLE SDK 10 SP4 (i586 ia64 ppc s390x x86_64) [New Version: 8.1.23]:

      postgresql-contrib-8.1.23-0.11.1
      postgresql-devel-8.1.23-0.11.1
      postgresql-docs-8.1.23-0.11.1
      postgresql-pl-8.1.23-0.11.1
      postgresql-server-8.1.23-0.11.1


References:

   http://support.novell.com/security/cve/CVE-2012-3488.html
   http://support.novell.com/security/cve/CVE-2012-3489.html
   https://bugzilla.novell.com/700876
   https://bugzilla.novell.com/765069
   https://bugzilla.novell.com/770193
   https://bugzilla.novell.com/776523
   http://download.novell.com/patch/finder/?keywords=ee84db0d1f4471abd4ab51536636eb1e