The PostgreSQL Global Development Group has released an update to all supported versions of our database system, including 9.6.4, 9.5.8, 9.4.13, 9.3.18, and 9.2.22. This release fixes three security issues. It also patches over 50 other bugs reported over the last three months. Users who are affected by the below security issues should update as soon as possible. Users affected by CVE-2017-7547 will need to perform additional steps after upgrading to resolve the issue. Other users should plan to update at the next convenient downtime.

Three security vulnerabilities have been closed by this release:
* CVE-2017-7546: Empty password accepted in some authentication methods
* CVE-2017-7547: The "pg_user_mappings" catalog view discloses passwords to users lacking server privileges
* CVE-2017-7548: lo_put() function ignores ACLs

3 files changed, 16 insertions, 15 deletions

diff --git a/databases/postgresql92/Makefile.common b/databases/postgresql92/Makefile.common
index 1ba830346e3..87d1021cc6a 100644
--- a/databases/postgresql92/Makefile.common
+++ b/databases/postgresql92/Makefile.common
@@ -1,4 +1,4 @@
-# $NetBSD: Makefile.common,v 1.28 2017/05/12 19:37:54 adam Exp $
+# $NetBSD: Makefile.common,v 1.29 2017/08/13 19:25:17 adam Exp $
 #
 # This Makefile fragment is included by all PostgreSQL packages built from
 # the main sources of the PostgreSQL distribution except jdbc-postgresql.
@@ -16,7 +16,7 @@
 # used by databases/postgresql92-pltcl/Makefile
 # used by databases/postgresql92-server/Makefile
 
-DISTNAME=	postgresql-9.2.21
+DISTNAME=	postgresql-9.2.22
 CATEGORIES=	databases
 MASTER_SITES=	${MASTER_SITE_PGSQL:=source/v${PKGVERSION_NOREV}/}
 EXTRACT_SUFX=	.tar.bz2
diff --git a/databases/postgresql92/distinfo b/databases/postgresql92/distinfo
index 89a0c49e9ee..99ad59b5f00 100644
--- a/databases/postgresql92/distinfo
+++ b/databases/postgresql92/distinfo
@@ -1,9 +1,9 @@
-$NetBSD: distinfo,v 1.23 2017/05/12 19:37:54 adam Exp $
+$NetBSD: distinfo,v 1.24 2017/08/13 19:25:17 adam Exp $
 
-SHA1 (postgresql-9.2.21.tar.bz2) = 150f9dda7c03379933cc4f804f6e37d7c8518114
-RMD160 (postgresql-9.2.21.tar.bz2) = a861209168732ec5bef45f675fa3a7a535d8e210
-SHA512 (postgresql-9.2.21.tar.bz2) = c548cd1ba34ad71dd3f1acde5775ba2e71121f004324fac44dbe123a91d599ced0f1b8be675ed07b77712e8c23f376ff6221349385c19a88c4edbbb186f17861
-Size (postgresql-9.2.21.tar.bz2) = 16508040 bytes
+SHA1 (postgresql-9.2.22.tar.bz2) = 43c15380592adb2f34f1fa8b856b7cbff1ea79f7
+RMD160 (postgresql-9.2.22.tar.bz2) = aaef1dd1a38d8dba77d06f29bdc4ca2476ca7685
+SHA512 (postgresql-9.2.22.tar.bz2) = 3e5ab04c2be2719579b2ebbf64b220522acfd9ea74029dd2ed699f60230da224bdc99de4ee5529b513e5586de0377764c4e54deb3dd93d5c53c4d666dce2b6b7
+Size (postgresql-9.2.22.tar.bz2) = 16531224 bytes
 SHA1 (patch-config_missing) = c2d7d742922ba6861e7660c75b7b53f09e564813
 SHA1 (patch-config_perl.m4) = c7e5aaff1c47d2e33df7692a412ef984c77ffcc0
 SHA1 (patch-configure) = 21b27add570cff1a24c440201eb1ed49f8223747
@@ -15,4 +15,4 @@ SHA1 (patch-src_backend_utils_adt_datetime.c) = b220c39272bf8d2bda95119adcbab5b2
 SHA1 (patch-src_interfaces_ecpg_pgtypeslib_interval.c) = 20578ab950465db07dab757db2fae4c4570cbbe1
 SHA1 (patch-src_makefiles_Makefile.solaris) = 0168f5bc105ffc89d5db40907a08966d8465f5a0
 SHA1 (patch-src_pl_plperl_GNUmakefile) = 2b7448d6dd8550e2ea61f40728a2780068b93d07
-SHA1 (patch-src_pl_plperl_plperl.h) = bd663fa80a47f7b82ce689060750fa6e631fbc61
+SHA1 (patch-src_pl_plperl_plperl.h) = 0e7daec79a00d7378326e56525e50cfe61cfc174
diff --git a/databases/postgresql92/patches/patch-src_pl_plperl_plperl.h b/databases/postgresql92/patches/patch-src_pl_plperl_plperl.h
index 63d0749fc31..56d5cb59bf2 100644
--- a/databases/postgresql92/patches/patch-src_pl_plperl_plperl.h
+++ b/databases/postgresql92/patches/patch-src_pl_plperl_plperl.h
@@ -1,8 +1,8 @@
-$NetBSD: patch-src_pl_plperl_plperl.h,v 1.1 2012/10/05 21:03:10 adam Exp $
+$NetBSD: patch-src_pl_plperl_plperl.h,v 1.2 2017/08/13 19:25:17 adam Exp $
 
---- src/pl/plperl/plperl.h.orig	2011-09-22 23:57:57.000000000 +0200
-+++ src/pl/plperl/plperl.h	2011-10-12 20:36:11.783264869 +0200
-@@ -44,12 +44,21 @@
+--- src/pl/plperl/plperl.h.orig	2017-08-07 21:19:50.000000000 +0000
++++ src/pl/plperl/plperl.h
+@@ -44,6 +44,10 @@
  #undef vsnprintf
  #endif
  
@@ -11,10 +11,11 @@ $NetBSD: patch-src_pl_plperl_plperl.h,v 1.1 2012/10/05 21:03:10 adam Exp $
 +#define list_tail sun_list_tail
 +#endif
  
- /* required for perl API */
- #include "EXTERN.h"
- #include "perl.h"
+ /*
+  * Get the basic Perl API.  We use PERL_NO_GET_CONTEXT mode so that our code
+@@ -62,6 +66,11 @@
  #include "XSUB.h"
+ #endif
  
 +#ifdef __sun
 +#undef list_head