Package "postgresql-pltcl-9.1"

  postgresql-9.1 (9.1.12-0ubuntu0.12.04) precise-security; urgency=medium

  * New upstream security/bugfix release. (LP: #1282677)
    - Shore up GRANT ... WITH ADMIN OPTION restrictions.
      Granting a role without ADMIN OPTION is supposed to prevent the grantee
      from adding or removing members from the granted role, but this
      restriction was easily bypassed by doing SET ROLE first. The security
      impact is mostly that a role member can revoke the access of others,
      contrary to the wishes of his grantor. Unapproved role member additions
      are a lesser concern, since an uncooperative role member could provide
      most of his rights to others anyway by creating views or SECURITY
      DEFINER functions. (CVE-2014-0060)
    - Prevent privilege escalation via manual calls to PL validator functions.
      The primary role of PL validator functions is to be called implicitly
      during CREATE FUNCTION, but they are also normal SQL functions that a
      user can call explicitly. Calling a validator on a function actually
      written in some other language was not checked for and could be
      exploited for privilege-escalation purposes. The fix involves adding a
      call to a privilege-checking function in each validator function.
      Non-core procedural languages will also need to make this change to
      their own validator functions, if any. (CVE-2014-0061)
    - Avoid multiple name lookups during table and index DDL.
      If the name lookups come to different conclusions due to concurrent
      activity, we might perform some parts of the DDL on a different table
      than other parts. At least in the case of CREATE INDEX, this can be used
      to cause the permissions checks to be performed against a different
      table than the index creation, allowing for a privilege escalation
      attack. (CVE-2014-0062)
    - Prevent buffer overrun with long datetime strings.
      The MAXDATELEN constant was too small for the longest possible value of
      type interval, allowing a buffer overrun in interval_out(). Although the
      datetime input functions were more careful about avoiding buffer
      overrun, the limit was short enough to cause them to reject some valid
      inputs, such as input containing a very long timezone name. The ecpg
      library contained these vulnerabilities along with some of its own.
      (CVE-2014-0063)
    - Prevent buffer overrun due to integer overflow in size calculations.
      Several functions, mostly type input functions, calculated an allocation
      size without checking for overflow. If overflow did occur, a too-small
      buffer would be allocated and then written past. (CVE-2014-0064)
    - Prevent overruns of fixed-size buffers.
      Use strlcpy() and related functions to provide a clear guarantee that
      fixed-size buffers are not overrun. Unlike the preceding items, it is
      unclear whether these cases really represent live issues, since in most
      cases there appear to be previous constraints on the size of the input
      string. Nonetheless it seems prudent to silence all Coverity warnings of
      this type. (CVE-2014-0065)
    - Avoid crashing if crypt() returns NULL.
      There are relatively few scenarios in which crypt() could return NULL,
      but contrib/chkpass would crash if it did. One practical case in which
      this could be an issue is if libc is configured to refuse to execute
      unapproved hashing algorithms (e.g., "FIPS mode"). (CVE-2014-0066)
    - Document risks of make check in the regression testing instructions
      Since the temporary server started by make check uses "trust"
      authentication, another user on the same machine could connect to it as
      database superuser, and then potentially exploit the privileges of the
      operating-system user who started the tests. A future release will
      probably incorporate changes in the testing procedure to prevent this
      risk, but some public discussion is needed first. So for the moment,
      just warn people against using make check when there are untrusted users
      on the same machine. (CVE-2014-0067)
  * The upstream tarballs no longer contain a plain HISTORY file, but point to
    the html documentation. Add 70-history.patch to note the location of these
    files in our changelog.gz file.
 -- Martin Pitt <email address hidden> Thu, 20 Feb 2014 11:35:10 -0800

  postgresql-9.1 (9.1.9-0ubuntu12.04) precise-security; urgency=low

  * New upstream security/bug fix release: (LP: #1163184)
    - Fix insecure parsing of server command-line switches.
      A connection request containing a database name that begins with
      "-" could be crafted to damage or destroy files within the server's
      data directory, even if the request is eventually rejected.
      [CVE-2013-1899]
    - Reset OpenSSL randomness state in each postmaster child process.
      This avoids a scenario wherein random numbers generated by
      "contrib/pgcrypto" functions might be relatively easy for another
      database user to guess. The risk is only significant when the
      postmaster is configured with ssl = on but most connections don't
      use SSL encryption. [CVE-2013-1900]
    - Make REPLICATION privilege checks test current user not
      authenticated user.
      An unprivileged database user could exploit this mistake to call
      pg_start_backup() or pg_stop_backup(), thus possibly interfering
      with creation of routine backups. [CVE-2013-1901]
    - Fix GiST indexes to not use "fuzzy" geometric comparisons when it's
      not appropriate to do so.
      The core geometric types perform comparisons using "fuzzy"
      equality, but gist_box_same must do exact comparisons, else GiST
      indexes using it might become inconsistent. After installing this
      update, users should "REINDEX" any GiST indexes on box, polygon,
      circle, or point columns, since all of these use gist_box_same.
    - Fix erroneous range-union and penalty logic in GiST indexes that
      use "contrib/btree_gist" for variable-width data types, that is
      text, bytea, bit, and numeric columns.
      These errors could result in inconsistent indexes in which some
      keys that are present would not be found by searches, and also in
      useless index bloat. Users are advised to "REINDEX" such indexes
      after installing this update.
    - Fix bugs in GiST page splitting code for multi-column indexes.
      These errors could result in inconsistent indexes in which some
      keys that are present would not be found by searches, and also in
      indexes that are unnecessarily inefficient to search. Users are
      advised to "REINDEX" multi-column GiST indexes after installing
      this update.
    - See HISTORY/changelog.gz for details about the other bug fixes.
 -- Martin Pitt <email address hidden> Tue, 02 Apr 2013 11:59:41 +0200

  postgresql-9.1 (9.1.8-0ubuntu12.04) precise-security; urgency=low

  * New upstream security/bug fix release: (LP: #1116336)
    - Prevent execution of enum_recv from SQL
      The function was misdeclared, allowing a simple SQL command to crash the
      server. In principle an attacker might be able to use it to examine the
      contents of server memory. Our thanks to Sumit Soni (via Secunia SVCRP)
      for reporting this issue. (CVE-2013-0255)
    - See HISTORY/changelog.gz for the other bug fixes.
 -- Martin Pitt <email address hidden> Tue, 05 Feb 2013 16:19:31 +0100

  postgresql-9.1 (9.1.5-0ubuntu12.04) precise-security; urgency=low

  * New upstream bug fix/security release:
   - Prevent access to external files/URLs via XML entity references
     (Noah Misch, Tom Lane)
     xml_parse() would attempt to fetch external files or URLs as needed
     to resolve DTD and entity references in an XML value, thus allowing
     unprivileged database users to attempt to fetch data with the
     privileges of the database server. While the external data wouldn't
     get returned directly to the user, portions of it could be exposed
     in error messages if the data didn't parse as valid XML; and in any
     case the mere ability to check existence of a file might be useful
     to an attacker. (CVE-2012-3489)
   - Prevent access to external files/URLs via "contrib/xml2"'s
     xslt_process() (Peter Eisentraut)
     libxslt offers the ability to read and write both files and URLs
     through stylesheet commands, thus allowing unprivileged database
     users to both read and write data with the privileges of the
     database server. Disable that through proper use of libxslt's
     security options. (CVE-2012-3488)
     Also, remove xslt_process()'s ability to fetch documents and
     stylesheets from external files/URLs. While this was a documented
     "feature", it was long regarded as a bad idea. The fix for
     CVE-2012-3489 broke that capability, and rather than expend effort
     on trying to fix it, we're just going to summarily remove it.
   - Prevent too-early recycling of btree index pages (Noah Misch)
     When we allowed read-only transactions to skip assigning XIDs, we
     introduced the possibility that a deleted btree page could be
     recycled while a read-only transaction was still in flight to it.
     This would result in incorrect index search results. The
     probability of such an error occurring in the field seems very low
     because of the timing requirements, but nonetheless it should be
     fixed.
   - Fix crash-safety bug with newly-created-or-reset sequences (Tom
     Lane)
     If "ALTER SEQUENCE" was executed on a freshly created or reset
     sequence, and then precisely one nextval() call was made on it, and
     then the server crashed, WAL replay would restore the sequence to a
     state in which it appeared that no nextval() had been done, thus
     allowing the first sequence value to be returned again by the next
     nextval() call. In particular this could manifest for serial
     columns, since creation of a serial column's sequence includes an
     "ALTER SEQUENCE OWNED BY" step.
   - Fix race condition in enum-type value comparisons (Robert Haas, Tom
     Lane)
     Comparisons could fail when encountering an enum value added since
     the current query started.
   - Fix txid_current() to report the correct epoch when not in hot
     standby (Heikki Linnakangas)
     This fixes a regression introduced in the previous minor release.
   - Prevent selection of unsuitable replication connections as the
     synchronous standby (Fujii Masao)
     The master might improperly choose pseudo-servers such as
     pg_receivexlog or pg_basebackup as the synchronous standby, and
     then wait indefinitely for them.
   - Fix bug in startup of Hot Standby when a master transaction has
     many subtransactions (Andres Freund)
     This mistake led to failures reported as "out-of-order XID
     insertion in KnownAssignedXids".
   - Ensure the "backup_label" file is fsync'd after pg_start_backup()
     (Dave Kerr)
   - Fix timeout handling in walsender processes (Tom Lane)
     WAL sender background processes neglected to establish a SIGALRM
     handler, meaning they would wait forever in some corner cases where
     a timeout ought to happen.
   - Wake walsenders after each background flush by walwriter (Andres
     Freund, Simon Riggs)
     This greatly reduces replication delay when the workload contains
     only asynchronously-committed transactions.
   - Fix LISTEN/NOTIFY to cope better with I/O problems, such as out of
     disk space (Tom Lane)
     After a write failure, all subsequent attempts to send more NOTIFY
     messages would fail with messages like "Could not read from file
     "pg_notify/nnnn" at offset nnnnn: Success".
   - Only allow autovacuum to be auto-canceled by a directly blocked
     process (Tom Lane)
     The original coding could allow inconsistent behavior in some
     cases; in particular, an autovacuum could get canceled after less
     than deadlock_timeout grace period.
   - Improve logging of autovacuum cancels (Robert Haas)
   - Fix log collector so that log_truncate_on_rotation works during the
     very first log rotation after server start (Tom Lane)
   - Fix WITH attached to a nested set operation
     (UNION/INTERSECT/EXCEPT) (Tom Lane)
   - Ensure that a whole-row reference to a subquery doesn't include any
     extra GROUP BY or ORDER BY columns (Tom Lane)
   - Fix dependencies generated during ALTER TABLE ... ADD CONSTRAINT
     USING INDEX (Tom Lane)
     This command left behind a redundant pg_depend entry for the index,
     which could confuse later operations, notably ALTER TABLE ... ALTER
     COLUMN TYPE on one of the indexed columns.
   - Fix "REASSIGN OWNED" to work on extensions (Alvaro Herrera)
   - Disallow copying whole-row references in CHECK constraints and
     index definitions during "CREATE TABLE" (Tom Lane)
     This situation can arise in "CREATE TABLE" with LIKE or INHERITS.
     The copied whole-row variable was incorrectly labeled with the row
     type of the original table not the new one. Rejecting the case
     seems reasonable for LIKE, since the row types might well diverge
     later. For INHERITS we should ideally allow it, with an implicit
     coercion to the parent table's row type; but that will require more
     work than seems safe to back-patch.
   - Fix memory leak in ARRAY(SELECT ...) subqueries (Heikki
     Linnakangas, Tom Lane)
   

  postgresql-9.1 (9.1.4-0ubuntu12.04) precise-security; urgency=low

  * New upstream bug fix/security release: (LP: #1008317)
    - Fix incorrect password transformation in "contrib/pgcrypto"'s DES
      crypt() function.
      If a password string contained the byte value 0x80, the remainder
      of the password was ignored, causing the password to be much weaker
      than it appeared. With this fix, the rest of the string is properly
      included in the DES hash. Any stored password values that are
      affected by this bug will thus no longer match, so the stored
      values may need to be updated. (CVE-2012-2143)
    - Ignore SECURITY DEFINER and SET attributes for a procedural
      language's call handler. Applying such attributes to a call handler
      could crash the server. (CVE-2012-2655)
    - Make "contrib/citext"'s upgrade script fix collations of citext
      arrays and domains over citext.
      Release 9.1.2 provided a fix for collations of citext columns and
      indexes in databases upgraded or reloaded from pre-9.1
      installations, but that fix was incomplete: it neglected to handle
      arrays and domains over citext. This release extends the module's
      upgrade script to handle these cases. As before, if you have
      already run the upgrade script, you'll need to run the collation
      update commands by hand instead. See the 9.1.2 release notes for
      more information about doing this.
    - Allow numeric timezone offsets in timestamp input to be up to 16
      hours away from UTC. Some historical time zones have offsets larger than
      15 hours, the previous limit. This could result in dumped data values
      being rejected during reload.
    - Fix timestamp conversion to cope when the given time is exactly the
      last DST transition time for the current timezone.
      This oversight has been there a long time, but was not noticed
      previously because most DST-using zones are presumed to have an
      indefinite sequence of future DST transitions.
    - Fix text to name and char to name casts to perform string
      truncation correctly in multibyte encodings.
    - Fix memory copying bug in to_tsquery().
    - Ensure txid_current() reports the correct epoch when executed in
      hot standby.
    - Fix planner's handling of outer PlaceHolderVars within subqueries.
      This bug concerns sub-SELECTs that reference variables coming from
      the nullable side of an outer join of the surrounding query. In
      9.1, queries affected by this bug would fail with "ERROR:
      Upper-level PlaceHolderVar found where not expected". But in 9.0
      and 8.4, you'd silently get possibly-wrong answers, since the value
      transmitted into the subquery wouldn't go to null when it should.
    - Fix planning of UNION ALL subqueries with output columns that are
      not simple variables.
      Planning of such cases got noticeably worse in 9.1 as a result of a
      misguided fix for "MergeAppend child's targetlist doesn't match
      MergeAppend" errors. Revert that fix and do it another way.
    - Fix slow session startup when pg_attribute is very large.
      If pg_attribute exceeds one-fourth of shared_buffers, cache
      rebuilding code that is sometimes needed during session start would
      trigger the synchronized-scan logic, causing it to take many times
      longer than normal. The problem was particularly acute if many new
      sessions were starting at once.
    - Ensure sequential scans check for query cancel reasonably often.
      A scan encountering many consecutive pages that contain no live
      tuples would not respond to interrupts meanwhile.
    - Ensure the Windows implementation of PGSemaphoreLock() clears
      ImmediateInterruptOK before returning.
      This oversight meant that a query-cancel interrupt received later
      in the same query could be accepted at an unsafe time, with
      unpredictable but not good consequences.
    - Show whole-row variables safely when printing views or rules.
      Corner cases involving ambiguous names (that is, the name could be
      either a table or column name of the query) were printed in an
      ambiguous way, risking that the view or rule would be interpreted
      differently after dump and reload. Avoid the ambiguous case by
      attaching a no-op cast.
    - Fix "COPY FROM" to properly handle null marker strings that
      correspond to invalid encoding.
      A null marker string such as E'\\0' should work, and did work in
      the past, but the case got broken in 8.4.
    - Fix "EXPLAIN VERBOSE" for writable CTEs containing RETURNING
      clauses.
    - Fix "PREPARE TRANSACTION" to work correctly in the presence of
      advisory locks.
      Historically, "PREPARE TRANSACTION" has simply ignored any
      session-level advisory locks the session holds, but this case was
      accidentally broken in 9.1.
    - Fix truncation of unlogged tables.
    - Ignore missing schemas during non-interactive assignments of
      search_path.
      This re-aligns 9.1's behavior with that of older branches.
      Previously 9.1 would throw an error for nonexistent schemas
      mentioned in search_path settings obtained from places such as
      "ALTER DATABASE SET".
    - Fix bugs with temporary or transient tables used in extension
      scripts.
      This includes cases such as a rewriting "ALTER TABLE" within an
      extension update script, since that uses a transient table behind
      the scenes.
    - Ensure autovacuum worker processes perform stack depth checking
      properly.
      Previously, infinite recursion in a function invoked by
      auto-"ANALYZE" could crash worker processes.
    - Fix logging collector to not lose log coherency under high load.
      The collector previously could fail to reassemble large messages if
      it got too busy.
    - Fix logging collector to ensure it will restart file rotation after
      receiving SIGHUP.
    - Fix