FreshPorts -- The Place For Ports If you buy from Amazon USA, please support us by using this link.
Follow us
Blog
Twitter

I am looking for an LTO tape library. Do you have one to spare?
Commit found by message id
Thu, 4 Apr 2013
[ 13:21:23 girgen ] Original commit   Revision:315718
postgresql83-client databases  Deleted Deprecated Expired files touched by this commit  An older version of this port was marked as vulnerable. PostgreSQL database (client)
postgresql83-contrib databases  Deleted Deprecated Expired files touched by this commit The contrib utilities from the PostgreSQL distribution
postgresql83-server databases  Deleted Deprecated Expired files touched by this commit  This port version is marked as vulnerable. The most advanced open-source database available anywhere
postgresql84-server databases files touched by this commit  An older version of this port was marked as vulnerable. The most advanced open-source database available anywhere
postgresql90-server databases files touched by this commit  An older version of this port was marked as vulnerable. The most advanced open-source database available anywhere
postgresql91-server databases files touched by this commit  An older version of this port was marked as vulnerable. The most advanced open-source database available anywhere
postgresql92-server databases files touched by this commit  An older version of this port was marked as vulnerable. The most advanced open-source database available anywhere
vuxml security files touched by this commit Vulnerability and eXposure Markup Language DTD
The PostgreSQL Global Development Group has released a security
update to all current versions of the PostgreSQL database system,
including versions 9.2.4, 9.1.9, 9.0.13, and 8.4.17. This update
fixes a high-exposure security vulnerability in versions 9.0 and
later. All users of the affected versions are strongly urged to apply
the update *immediately*.

A major security issue (for versions 9.x only) fixed in this release,
[CVE-2013-1899](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1899),
makes it possible for a connection request containing a database name
that begins with "-" to be crafted that can damage or destroy files
within a server's data directory. Anyone with access to the port the
PostgreSQL server listens on can initiate this request. This issue was
discovered by Mitsumasa Kondo and Kyotaro Horiguchi of NTT Open Source
Software Center.

Two lesser security fixes are also included in this release:
[CVE-2013-1900](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1900),
wherein random numbers generated by contrib/pgcrypto functions may be
easy for another database user to guess (all versions), and
[CVE-2013-1901](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1901),
which mistakenly allows an unprivileged user to run commands that
could interfere with in-progress backups (for versions 9.x only).

Approved by:	portmgr (bdrewery)
URL:		http://www.postgresql.org/about/news/1456/
Security:	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1899
Security:	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1900
Security:	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1901

Number of ports [& non-ports] in this commit: 8

Showing files for just one port: databases/postgresql83-server

show all files

hide all files


2 files found
ActionRevisionLinksFile
modify 315718 View diff View revision /ports/head/databases/postgresql83-server/Makefile
import 315718 View revision /ports/head/databases/postgresql83-server/files/patch-ssl-init-state
Login
User Login
Create account

Servers and bandwidth provided by
New York Internet, SuperNews, and RootBSD

This site
What is FreshPorts?
About the authors
FAQ
How big is it?
The latest upgrade!
Privacy
Forums
Blog
Contact

Search
Enter Keywords:
 
more...

Latest Vulnerabilities
curlApr 11
dbus-glibApr 11
libaudiofileApr 11
linux-f10-curlApr 11
linux-f10-dbus-glibApr 11
linux-f10-libaudiofileApr 11
linux-f10-nas-libsApr 11
linux-f10-openldapApr 11
mingw32-openssl*Apr 11
mingw32-opensslApr 11
nasApr 11
openssl*Apr 11
opensslApr 11
linux-f10-openssl*Apr 10
linux-f10-openssl*Apr 10

13 vulnerabilities affecting 34 ports have been reported in the past 14 days

* - modified, not new

All vulnerabilities


Ports
Home
Categories
Deleted ports
Sanity Test Failures
Newsfeeds


Statistics
Graphs
NEW Graphs (Javascript)
Traffic

Calculated hourly:
Port count 24391
Broken 175
Deprecated 120
Ignore 527
Forbidden 4
Restricted 266
No CDROM 108
Vulnerable 27
Expired 8
Set to expire 105
Interactive 22
new 24 hours 2
new 48 hours4
new 7 days16
new fortnight39
new month150


Servers and bandwidth provided by
New York Internet, SuperNews, and RootBSD
Valid HTML, CSS, and RSS.
Copyright © 2000-2014 Dan Langille. All rights reserved.