SUSE-SU-2015:1091-1: moderate: Security update for postgresql91

[sle-security-updates at lists.suse.com]

   SUSE Security Update: Security update for postgresql91
______________________________________________________________________________

Announcement ID:    SUSE-SU-2015:1091-1
Rating:             moderate
References:         #907651 #931972 #931973 #931974 #932040 
Cross-References:   CVE-2015-3165 CVE-2015-3166 CVE-2015-3167
                   
Affected Products:
                    SUSE Manager Server
                    SUSE Linux Enterprise Software Development Kit 11 SP3
                    SUSE Linux Enterprise Server 11 SP3 for VMware
                    SUSE Linux Enterprise Server 11 SP3
                    SUSE Linux Enterprise Desktop 11 SP3
______________________________________________________________________________

   An update that solves three vulnerabilities and has two
   fixes is now available. It includes one version update.

Description:


   This update provides PostgreSQL 9.1.18, which brings fixes for security
   issues and other enhancements.

   The following vulnerabilities have been fixed:

       * CVE-2015-3165: Avoid possible crash when client disconnects.
         (bsc#931972)
       * CVE-2015-3166: Consistently check for failure of the *printf().
         (bsc#931973)
       * CVE-2015-3167: In contrib/pgcrypto, uniformly report decryption
         failures. (bsc#931974)

   For a comprehensive list of changes, please refer to
   http://www.postgresql.org/docs/9.1/static/release-9-1-18.html
   <http://www.postgresql.org/docs/9.1/static/release-9-1-18.html> .

   This update also includes changes in PostgreSQL's packaging to prepare for
   the migration to the new major version 9.4. (FATE#316970, bsc#907651)

   Security Issues:

       * CVE-2015-3165
         <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3165>
       * CVE-2015-3166
         <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3166>
       * CVE-2015-3167
         <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3167>


Patch Instructions:

   To install this SUSE Security Update use YaST online_update.
   Alternatively you can run the command listed for your product:

   - SUSE Manager Server:

      zypper in -t patch sleman21-postgresql91-201505=10760

   - SUSE Linux Enterprise Software Development Kit 11 SP3:

      zypper in -t patch sdksp3-postgresql91-201505=10760

   - SUSE Linux Enterprise Server 11 SP3 for VMware:

      zypper in -t patch slessp3-postgresql91-201505=10760

   - SUSE Linux Enterprise Server 11 SP3:

      zypper in -t patch slessp3-postgresql91-201505=10760

   - SUSE Linux Enterprise Desktop 11 SP3:

      zypper in -t patch sledsp3-postgresql91-201505=10760

   To bring your system up-to-date, use "zypper patch".


Package List:

   - SUSE Manager Server (s390x x86_64) [New Version: 9.1.18]:

      postgresql91-pltcl-9.1.18-0.3.1

   - SUSE Linux Enterprise Software Development Kit 11 SP3 (i586 ia64 ppc64 s390x x86_64) [New Version: 9.1.18]:

      postgresql91-devel-9.1.18-0.3.1

   - SUSE Linux Enterprise Server 11 SP3 for VMware (i586 x86_64) [New Version: 9.1.18]:

      postgresql91-9.1.18-0.3.1
      postgresql91-contrib-9.1.18-0.3.1
      postgresql91-docs-9.1.18-0.3.1
      postgresql91-server-9.1.18-0.3.1

   - SUSE Linux Enterprise Server 11 SP3 (i586 ia64 ppc64 s390x x86_64) [New Version: 9.1.18]:

      postgresql91-9.1.18-0.3.1
      postgresql91-contrib-9.1.18-0.3.1
      postgresql91-docs-9.1.18-0.3.1
      postgresql91-server-9.1.18-0.3.1

   - SUSE Linux Enterprise Desktop 11 SP3 (i586 x86_64) [New Version: 9.1.18]:

      postgresql91-9.1.18-0.3.1
      postgresql91-docs-9.1.18-0.3.1


References:

   https://www.suse.com/security/cve/CVE-2015-3165.html
   https://www.suse.com/security/cve/CVE-2015-3166.html
   https://www.suse.com/security/cve/CVE-2015-3167.html
   https://bugzilla.suse.com/907651
   https://bugzilla.suse.com/931972
   https://bugzilla.suse.com/931973
   https://bugzilla.suse.com/931974
   https://bugzilla.suse.com/932040
   https://download.suse.com/patch/finder/?keywords=00fcb88ab431584bc7bf32ba75396dee