FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

databases/postgresql*-server -- multiple vulnerabilities

Affected packages
8.3.* < postgresql-server < 8.3.20
8.4.* < postgresql-server < 8.4.13
9.0.* < postgresql-server < 9.0.9
9.1.* < postgresql-server < 9.1.5

Details

VuXML ID 07234e78-e899-11e1-b38d-0023ae8e59f0
Discovery 2012-08-17
Entry 2012-08-17

The PostgreSQL Global Development Group reports:

The PostgreSQL Global Development Group today released security updates for all active branches of the PostgreSQL database system, including versions 9.1.5, 9.0.9, 8.4.13 and 8.3.20. This update patches security holes associated with libxml2 and libxslt, similar to those affecting other open source projects. All users are urged to update their installations at the first available opportunity

Users who are relying on the built-in XML functionality to validate external DTDs will need to implement a workaround, as this security patch disables that functionality. Users who are using xslt_process() to fetch documents or stylesheets from external URLs will no longer be able to do so. The PostgreSQL project regrets the need to disable both of these features in order to maintain our security standards. These security issues with XML are substantially similar to issues patched recently by the Webkit (CVE-2011-1774), XMLsec (CVE-2011-1425) and PHP5 (CVE-2012-0057) projects.

References

CVE Name CVE-2012-3488
CVE Name CVE-2012-3489
URL http://www.postgresql.org/about/news/1407/