The PostgreSQL Global Development Group has released a security update to all current versions of the PostgreSQL database system, including versions 9.2.3, 9.1.8, 9.0.12, 8.4.16, and 8.3.23. This update fixes a denial-of-service (DOS) vulnerability. All users should update their PostgreSQL installations as soon as possible.

The security issue fixed in this release, CVE-2013-0255, allows a previously authenticated user to crash the server by calling an internal function with invalid arguments. This issue was discovered by independent security researcher Sumit Soni this week and reported via Secunia SVCRP, and we are grateful for their efforts in making PostgreSQL more secure.

Today's update also fixes a performance regression which caused a decrease in throughput when using dynamic queries in stored procedures in version 9.2. Applications which use PL/pgSQL's EXECUTE are strongly affected by this regression and should be updated. Additionally, we have fixed intermittent crashes caused by CREATE/DROP INDEX CONCURRENTLY, and multiple minor issues with replication.

This release is expected to be the final update for version 8.3, which is now End-of-Life (EOL). Users of version 8.3 should plan to upgrade to a later version of PostgreSQL immediately. For more information, see our Versioning Policy.

This update release also contains fixes for many minor issues discovered and patched by the PostgreSQL community in the last two months, including:

* Prevent unnecessary table scans during vacuuming
* Prevent spurious cached plan error in PL/pgSQL
* Allow sub-SELECTs to be subscripted
* Prevent DROP OWNED from dropping databases or tablespaces
* Make ECPG use translated messages
* Allow PL/Python to use multi-table trigger functions (again) in 9.1 and 9.2
* Fix several activity log management issues on Windows
* Prevent autovacuum file truncation from being cancelled by deadlock_timeout
* Make extensions build with the .exe suffix automatically on Windows
* Fix concurrency issues with CREATE/DROP DATABASE
* Reject out-of-range values in to_date() conversion function
* Revert cost estimation for large indexes back to pre-9.2 behavior
* Make pg_basebackup tolerate timeline switches
* Cleanup leftover temp table entries during crash recovery
* Prevent infinite loop when COPY inserts a large tuple into a table with a large fillfactor
* Prevent integer overflow in dynahash creation
* Make pg_upgrade work with INVALID indexes
* Fix bugs in TYPE privileges
* Allow Contrib installchecks to run in their own databases
* Many documentation updates
* Add new timezone "FET".

2 files changed, 7 insertions, 7 deletions

diff --git a/databases/postgresql91/Makefile.common b/databases/postgresql91/Makefile.common
index 7d260565d78..6bc8795a140 100644
--- a/databases/postgresql91/Makefile.common
+++ b/databases/postgresql91/Makefile.common
@@ -1,4 +1,4 @@
-# $NetBSD: Makefile.common,v 1.12 2012/12/07 21:19:50 adam Exp $
+# $NetBSD: Makefile.common,v 1.13 2013/02/09 11:19:14 adam Exp $
 #
 # used by databases/postgresql91-adminpack/Makefile
 # used by databases/postgresql91-client/Makefile
@@ -21,7 +21,7 @@
 #	<lang>-postgresql	client-side interface to PostgreSQL
 #	postgresql-<lang>	server-side module for PostgreSQL backend
 
-DISTNAME=	postgresql-9.1.7
+DISTNAME=	postgresql-9.1.8
 CATEGORIES=	databases
 MASTER_SITES=	${MASTER_SITE_PGSQL:=source/v${PKGVERSION_NOREV}/}
 EXTRACT_SUFX=	.tar.bz2
@@ -64,8 +64,8 @@ PG_ETC_DIR=		${PKG_SYSCONFDIR}
 GNU_CONFIGURE=		yes
 CONFIGURE_ARGS+=	--sysconfdir=${PG_ETC_DIR}
 CONFIGURE_ARGS+=	--datadir=${PG_DATA_DIR}
+CONFIGURE_ARGS+=	--docdir=${PG_DOC_DIR}
 CONFIGURE_ARGS+=	--localedir=${PG_LOCALE_DIR}
-CONFIGURE_ARGS+=	--with-docdir=${PG_DOC_DIR}
 CONFIGURE_ARGS+=	--with-template=${PG_TEMPLATE.${OPSYS}}
 
 CONFIGURE_ARGS+=	--enable-nls
diff --git a/databases/postgresql91/distinfo b/databases/postgresql91/distinfo
index cf909f6651c..9af41551d0c 100644
--- a/databases/postgresql91/distinfo
+++ b/databases/postgresql91/distinfo
@@ -1,8 +1,8 @@
-$NetBSD: distinfo,v 1.12 2012/12/07 21:19:50 adam Exp $
+$NetBSD: distinfo,v 1.13 2013/02/09 11:19:14 adam Exp $
 
-SHA1 (postgresql-9.1.7.tar.bz2) = a1936b5ba69aa63aae1971459d3b5bb036fea428
-RMD160 (postgresql-9.1.7.tar.bz2) = c1a9ba97bcfc62075be89c40fe1b9ddf925dd652
-Size (postgresql-9.1.7.tar.bz2) = 15688516 bytes
+SHA1 (postgresql-9.1.8.tar.bz2) = da932f51ffe8a578b5694c74867ce634ce847827
+RMD160 (postgresql-9.1.8.tar.bz2) = f37021b17f3de4a8d8f6482f7e340b6d31f08222
+Size (postgresql-9.1.8.tar.bz2) = 15815313 bytes
 SHA1 (patch-config_perl.m4) = c7e5aaff1c47d2e33df7692a412ef984c77ffcc0
 SHA1 (patch-configure) = dab79533dac06a79a5aa8439d6b15830d8d2fba7
 SHA1 (patch-contrib_dblink_Makefile) = 4960ad57d42465fae203870548e4c53f8a32ce04