SUSE-OU-2015:1847-1: moderate: Optional update for postgresql94

[sle-updates at lists.suse.com]

   SUSE Optional Update: Optional update for postgresql94
______________________________________________________________________________

Announcement ID:    SUSE-OU-2015:1847-1
Rating:             moderate
References:         #941886 #945706 #949669 #949670 #950486 
Affected Products:
                    SUSE Linux Enterprise Software Development Kit 12
                    SUSE Linux Enterprise Server 12
                    SUSE Linux Enterprise Desktop 12
______________________________________________________________________________

   An update that solves two vulnerabilities and has three
   fixes is now available.

Description:


   This update delivers PostgreSQL 9.4.5 to the SUSE Linux Enterprise 12
   codebase.

   Major enhancements:

   * Security and bugfix release 9.4.5:
     * CVE-2015-5289, bsc#949670: json or jsonb input values constructed from
       arbitrary user input can crash the PostgreSQL server and cause a
       denial of service.
     * CVE-2015-5288, bsc#949669: The crypt() function included with the
       optional pgCrypto extension could be exploited to read a few
       additional bytes of memory. No working exploit for this issue has been
       developed.

   * Add jsonb, a more capable and efficient data type for storing JSON data
   * Add new SQL command ALTER SYSTEM for changing postgresql.conf
     configuration file entries
   * Reduce lock strength for some ALTER TABLE commands
   * Allow materialized views to be refreshed without blocking concurrent
     reads
   * Add support for logical decoding of WAL data, to allow database changes
     to be streamed out in a customizable format
   * Allow background worker processes to be dynamically registered, started
     and terminated
   * For the full release notse, see:
     http://www.postgresql.org/docs/current/static/release-9-4-5.html
   * Move systemd related stuff and user creation to postgresql-init
     (bsc#950486)
   * Remove some obsolete %suse_version conditionals
   * Adjust build time dependencies.
   * Fix some more rpmlint warnings.
   * Relax dependency on libpq to major version.
   * Make sure that plpgsql.h gets installed, because pldebugger needs it.
   * Move ~postgres/.bash_profile to postgresql-server to avoid a file
     conflict between the versioned server packages.

   Full release notes can be found here:
   http://www.postgresql.org/docs/9.4/static/release-9-4.html


   The existing client libraries libecpg6 and libpq5 are now taken from the
   postgresql94 build instgead
   of the postgresql93 build.


Patch Instructions:

   To install this SUSE Optional Update use YaST online_update.
   Alternatively you can run the command listed for your product:

   - SUSE Linux Enterprise Software Development Kit 12:

      zypper in -t patch SUSE-SLE-SDK-12-2015-767=1

   - SUSE Linux Enterprise Server 12:

      zypper in -t patch SUSE-SLE-SERVER-12-2015-767=1

   - SUSE Linux Enterprise Desktop 12:

      zypper in -t patch SUSE-SLE-DESKTOP-12-2015-767=1

   To bring your system up-to-date, use "zypper patch".


Package List:

   - SUSE Linux Enterprise Software Development Kit 12 (ppc64le s390x x86_64):

      postgresql94-devel-9.4.5-4.1
      postgresql94-devel-debuginfo-9.4.5-4.1
      postgresql94-libs-debugsource-9.4.5-4.1

   - SUSE Linux Enterprise Server 12 (ppc64le s390x x86_64):

      libecpg6-9.4.5-4.1
      libecpg6-debuginfo-9.4.5-4.1
      libpq5-9.4.5-4.1
      libpq5-debuginfo-9.4.5-4.1
      postgresql94-9.4.5-4.5
      postgresql94-contrib-9.4.5-4.5
      postgresql94-contrib-debuginfo-9.4.5-4.5
      postgresql94-debuginfo-9.4.5-4.5
      postgresql94-debugsource-9.4.5-4.5
      postgresql94-libs-debugsource-9.4.5-4.1
      postgresql94-server-9.4.5-4.5
      postgresql94-server-debuginfo-9.4.5-4.5

   - SUSE Linux Enterprise Server 12 (s390x x86_64):

      libpq5-32bit-9.4.5-4.1
      libpq5-debuginfo-32bit-9.4.5-4.1

   - SUSE Linux Enterprise Server 12 (noarch):

      postgresql-init-9.4-17.8.1
      postgresql94-docs-9.4.5-4.5

   - SUSE Linux Enterprise Desktop 12 (x86_64):

      libecpg6-9.4.5-4.1
      libecpg6-debuginfo-9.4.5-4.1
      libpq5-32bit-9.4.5-4.1
      libpq5-9.4.5-4.1
      libpq5-debuginfo-32bit-9.4.5-4.1
      libpq5-debuginfo-9.4.5-4.1
      postgresql94-9.4.5-4.5
      postgresql94-debuginfo-9.4.5-4.5
      postgresql94-debugsource-9.4.5-4.5
      postgresql94-libs-debugsource-9.4.5-4.1


References:

   https://www.suse.com/security/cve/CVE-2015-5288.html
   https://www.suse.com/security/cve/CVE-2015-5289.html
   https://bugzilla.suse.com/941886
   https://bugzilla.suse.com/945706
   https://bugzilla.suse.com/949669
   https://bugzilla.suse.com/949670
   https://bugzilla.suse.com/950486