Mageia alert MGASA-2016-0085 (postgresql)

From:
    	     
 
Mageia Updates <buildsystem-daemon@mageia.org> 
To:
    	     
 
updates-announce@ml.mageia.org 
Subject:
    	     
 
[updates-announce] MGASA-2016-0085: Updated postgresql packages fix security vulnerabilities 
Date:
    	     
 
Wed, 2 Mar 2016 19:29:17 +0100
Message-ID:
    	     
 
<20160302182917.551339F698@duvel.mageia.org>
MGASA-2016-0085 - Updated postgresql packages fix security vulnerabilities

Publication date: 02 Mar 2016
URL: http://advisories.mageia.org/MGASA-2016-0085.html
Type: security
Affected Mageia releases: 5
CVE: CVE-2016-0766,
     CVE-2016-0773

Description:
Updated postgresql packages fix security vulnerabilities:

PostgreSQL 9.3.x before 9.3.11 and 9.4.x before 9.4.6 does not properly
restrict access to unspecified custom configuration settings (GUCS) for
PL/Java, which allows attackers to gain privileges via unspecified vectors
(CVE-2016-0766).

PostgreSQL 9.3.x before 9.3.11 and 9.4.x before 9.4.6 allows remote attackers
to cause a denial of service (infinite loop or buffer overflow and crash) via
a large Unicode character range in a regular expression (CVE-2016-0773).

References:
- https://bugs.mageia.org/show_bug.cgi?id=17744
- http://www.ubuntu.com/usn/usn-2894-1/
- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0766
- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0773

SRPMS:
- 5/core/postgresql9.3-9.3.11-1.mga5
- 5/core/postgresql9.4-9.4.6-1.mga5