Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2017:2356-1

Опубликовано: 05 сент. 2017
Источник: suse-cvrf

Описание

Security update for postgresql96

This update for postgresql96 fixes the following issues:

  • CVE-2017-7547: Further restrict visibility of pg_user_mappings.umoptions, to protect passwords stored as user mapping options. (bsc#1051685)
  • CVE-2017-7546: Disallow empty passwords in all password-based authentication methods. (bsc#1051684)
  • CVE-2017-7548: lo_put() function ignores ACLs. (bsc#1053259)

The changelog for this release is here: https://www.postgresql.org/docs/9.6/static/release-9-6-4.html

Список пакетов

SUSE Linux Enterprise Desktop 12 SP2
libecpg6-9.6.4-3.6.1
libpq5-9.6.4-3.6.1
libpq5-32bit-9.6.4-3.6.1
postgresql96-9.6.4-3.6.1
SUSE Linux Enterprise Desktop 12 SP3
libecpg6-9.6.4-3.6.1
libpq5-9.6.4-3.6.1
libpq5-32bit-9.6.4-3.6.1
postgresql96-9.6.4-3.6.1
SUSE Linux Enterprise Server 12 SP1-LTSS
libecpg6-9.6.4-3.6.1
libpq5-9.6.4-3.6.1
libpq5-32bit-9.6.4-3.6.1
postgresql96-9.6.4-3.6.1
postgresql96-contrib-9.6.4-3.6.1
postgresql96-docs-9.6.4-3.6.1
postgresql96-server-9.6.4-3.6.1
SUSE Linux Enterprise Server 12 SP2
libecpg6-9.6.4-3.6.1
libpq5-9.6.4-3.6.1
libpq5-32bit-9.6.4-3.6.1
postgresql96-9.6.4-3.6.1
postgresql96-contrib-9.6.4-3.6.1
postgresql96-docs-9.6.4-3.6.1
postgresql96-server-9.6.4-3.6.1
SUSE Linux Enterprise Server 12 SP3
libecpg6-9.6.4-3.6.1
libpq5-9.6.4-3.6.1
libpq5-32bit-9.6.4-3.6.1
postgresql96-9.6.4-3.6.1
postgresql96-contrib-9.6.4-3.6.1
postgresql96-docs-9.6.4-3.6.1
postgresql96-server-9.6.4-3.6.1
SUSE Linux Enterprise Server 12-LTSS
libecpg6-9.6.4-3.6.1
libpq5-9.6.4-3.6.1
libpq5-32bit-9.6.4-3.6.1
postgresql96-9.6.4-3.6.1
postgresql96-contrib-9.6.4-3.6.1
postgresql96-docs-9.6.4-3.6.1
postgresql96-server-9.6.4-3.6.1
SUSE Linux Enterprise Server for Raspberry Pi 12 SP2
libecpg6-9.6.4-3.6.1
libpq5-9.6.4-3.6.1
postgresql96-9.6.4-3.6.1
postgresql96-contrib-9.6.4-3.6.1
postgresql96-docs-9.6.4-3.6.1
postgresql96-server-9.6.4-3.6.1
SUSE Linux Enterprise Server for SAP Applications 12
libecpg6-9.6.4-3.6.1
libpq5-9.6.4-3.6.1
libpq5-32bit-9.6.4-3.6.1
postgresql96-9.6.4-3.6.1
postgresql96-contrib-9.6.4-3.6.1
postgresql96-docs-9.6.4-3.6.1
postgresql96-server-9.6.4-3.6.1
SUSE Linux Enterprise Server for SAP Applications 12 SP1
libecpg6-9.6.4-3.6.1
libpq5-9.6.4-3.6.1
libpq5-32bit-9.6.4-3.6.1
postgresql96-9.6.4-3.6.1
postgresql96-contrib-9.6.4-3.6.1
postgresql96-docs-9.6.4-3.6.1
postgresql96-server-9.6.4-3.6.1
SUSE Linux Enterprise Server for SAP Applications 12 SP2
libecpg6-9.6.4-3.6.1
libpq5-9.6.4-3.6.1
libpq5-32bit-9.6.4-3.6.1
postgresql96-9.6.4-3.6.1
postgresql96-contrib-9.6.4-3.6.1
postgresql96-docs-9.6.4-3.6.1
postgresql96-server-9.6.4-3.6.1
SUSE Linux Enterprise Server for SAP Applications 12 SP3
libecpg6-9.6.4-3.6.1
libpq5-9.6.4-3.6.1
libpq5-32bit-9.6.4-3.6.1
postgresql96-9.6.4-3.6.1
postgresql96-contrib-9.6.4-3.6.1
postgresql96-docs-9.6.4-3.6.1
postgresql96-server-9.6.4-3.6.1
SUSE Linux Enterprise Software Development Kit 12 SP2
postgresql96-devel-9.6.4-3.6.1
SUSE Linux Enterprise Software Development Kit 12 SP3
postgresql96-devel-9.6.4-3.6.1
SUSE OpenStack Cloud 6
libecpg6-9.6.4-3.6.1
libpq5-9.6.4-3.6.1
libpq5-32bit-9.6.4-3.6.1
postgresql96-9.6.4-3.6.1
postgresql96-contrib-9.6.4-3.6.1
postgresql96-docs-9.6.4-3.6.1
postgresql96-server-9.6.4-3.6.1

Ссылки

Описание

PostgreSQL versions before 9.2.22, 9.3.18, 9.4.13, 9.5.8 and 9.6.4 are vulnerable to incorrect authentication flaw allowing remote attackers to gain access to database accounts with an empty password.

Затронутые продукты
SUSE Linux Enterprise Desktop 12 SP2:libecpg6-9.6.4-3.6.1
SUSE Linux Enterprise Desktop 12 SP2:libpq5-32bit-9.6.4-3.6.1
SUSE Linux Enterprise Desktop 12 SP2:libpq5-9.6.4-3.6.1
SUSE Linux Enterprise Desktop 12 SP2:postgresql96-9.6.4-3.6.1
Ссылки

Описание

PostgreSQL versions before 9.2.22, 9.3.18, 9.4.13, 9.5.8 and 9.6.4 are vulnerable to authorization flaw allowing remote authenticated attackers to retrieve passwords from the user mappings defined by the foreign server owners without actually having the privileges to do so.

Затронутые продукты
SUSE Linux Enterprise Desktop 12 SP2:libecpg6-9.6.4-3.6.1
SUSE Linux Enterprise Desktop 12 SP2:libpq5-32bit-9.6.4-3.6.1
SUSE Linux Enterprise Desktop 12 SP2:libpq5-9.6.4-3.6.1
SUSE Linux Enterprise Desktop 12 SP2:postgresql96-9.6.4-3.6.1
Ссылки

Описание

PostgreSQL versions before 9.4.13, 9.5.8 and 9.6.4 are vulnerable to authorization flaw allowing remote authenticated attackers with no privileges on a large object to overwrite the entire contents of the object, resulting in a denial of service.

Затронутые продукты
SUSE Linux Enterprise Desktop 12 SP2:libecpg6-9.6.4-3.6.1
SUSE Linux Enterprise Desktop 12 SP2:libpq5-32bit-9.6.4-3.6.1
SUSE Linux Enterprise Desktop 12 SP2:libpq5-9.6.4-3.6.1
SUSE Linux Enterprise Desktop 12 SP2:postgresql96-9.6.4-3.6.1
Ссылки
Уязвимость SUSE-SU-2017:2356-1