Date: Thu, 11 Aug 2016 14:51:44 +0000 (UTC) From: Palle Girgensohn <girgen@FreeBSD.org> To: ports-committers@freebsd.org, svn-ports-all@freebsd.org, svn-ports-head@freebsd.org Subject: svn commit: r420076 - head/security/vuxml Message-ID: <201608111451.u7BEpiVQ040767@repo.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: girgen Date: Thu Aug 11 14:51:44 2016 New Revision: 420076 URL: https://svnweb.freebsd.org/changeset/ports/420076 Log: Add security info for upcoming PostgreSQL updates. Security: CVE-2016-5424, CVE-2016-5423 Modified: head/security/vuxml/vuln.xml Modified: head/security/vuxml/vuln.xml ============================================================================== --- head/security/vuxml/vuln.xml Thu Aug 11 14:43:29 2016 (r420075) +++ head/security/vuxml/vuln.xml Thu Aug 11 14:51:44 2016 (r420076) @@ -58,6 +58,60 @@ Notes: * Do not forget port variants (linux-f10-libxml2, libxml2, etc.) --> <vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">; + <vuln vid="ca16fd0b-5fd1-11e6-a6f2-6cc21735f730"> + <topic>PostgreSQL -- minor security problems</topic> + <affects> + <package> + <name>postgresql91-server</name> + <range><ge>9.1.0</ge><lt>9.1.23</lt></range> + </package> + <package> + <name>postgresql92-server</name> + <range><ge>9.2.0</ge><lt>9.2.18</lt></range> + </package> + <package> + <name>postgresql93-server</name> + <range><ge>9.3.0</ge><lt>9.3.11</lt></range> + </package> + <package> + <name>postgresql94-server</name> + <range><ge>9.4.0</ge><lt>9.4.9</lt></range> + </package> + <package> + <name>postgresql95-server</name> + <range><ge>9.5.0</ge><lt>9.5.4</lt></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml">; + <p>PostgreSQL project reports:</p> + <blockquote cite="http://www.postgresql.org/about/news/1688/">; + <p> + Security Fixes nested CASE expressions + + database and role names with embedded special characters + </p> + <ul> + <li>CVE-2016-5423: certain nested CASE expressions can cause the + server to crash. + </li> + <li>CVE-2016-5424: database and role names with embedded special + characters can allow code injection during administrative operations + like pg_dumpall. + </li> + </ul> + </blockquote> + </body> + </description> + <references> + <cvename>CVE-2016-5423</cvename> + <cvename>CVE-2016-5424</cvename> + </references> + <dates> + <discovery>2016-08-11</discovery> + <entry>2016-08-11</entry> + </dates> + </vuln> + <vuln vid="28bf62ef-5e2c-11e6-a15f-00248c0c745d"> <topic>piwik -- XSS vulnerability</topic> <affects>
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201608111451.u7BEpiVQ040767>