The PostgreSQL Global Development Group has released an update to all supported versions of our database system, including 9.6.4, 9.5.8, 9.4.13, 9.3.18, and 9.2.22. This release fixes three security issues. It also patches over 50 other bugs reported over the last three months. Users who are affected by the below security issues should update as soon as possible. Users affected by CVE-2017-7547 will need to perform additional steps after upgrading to resolve the issue. Other users should plan to update at the next convenient downtime.

Three security vulnerabilities have been closed by this release:
* CVE-2017-7546: Empty password accepted in some authentication methods
* CVE-2017-7547: The "pg_user_mappings" catalog view discloses passwords to users lacking server privileges
* CVE-2017-7548: lo_put() function ignores ACLs

3 files changed, 16 insertions, 15 deletions

diff --git a/databases/postgresql96/Makefile.common b/databases/postgresql96/Makefile.common
index b896f4d990e..0b61e4d2600 100644
--- a/databases/postgresql96/Makefile.common
+++ b/databases/postgresql96/Makefile.common
@@ -1,4 +1,4 @@
-# $NetBSD: Makefile.common,v 1.3 2017/05/12 19:37:55 adam Exp $
+# $NetBSD: Makefile.common,v 1.4 2017/08/13 19:25:18 adam Exp $
 #
 # This Makefile fragment is included by all PostgreSQL packages built from
 # the main sources of the PostgreSQL distribution except jdbc-postgresql.
@@ -16,7 +16,7 @@
 # used by databases/postgresql96-pltcl/Makefile
 # used by databases/postgresql96-server/Makefile
 
-DISTNAME=	postgresql-9.6.3
+DISTNAME=	postgresql-9.6.4
 CATEGORIES=	databases
 MASTER_SITES=	${MASTER_SITE_PGSQL:=source/v${PKGVERSION_NOREV}/}
 EXTRACT_SUFX=	.tar.bz2
diff --git a/databases/postgresql96/distinfo b/databases/postgresql96/distinfo
index 02c03785d73..1000329edee 100644
--- a/databases/postgresql96/distinfo
+++ b/databases/postgresql96/distinfo
@@ -1,9 +1,9 @@
-$NetBSD: distinfo,v 1.4 2017/05/12 19:37:55 adam Exp $
+$NetBSD: distinfo,v 1.5 2017/08/13 19:25:18 adam Exp $
 
-SHA1 (postgresql-9.6.3.tar.bz2) = 5131272f6f22b38eafee8b090fff8d6b6fe1cff7
-RMD160 (postgresql-9.6.3.tar.bz2) = 48f792f6846a48980d021871df4b4fc45b5bf3ee
-SHA512 (postgresql-9.6.3.tar.bz2) = 97141972e154e6b0e756ee6a4e20f26e82022a9fd4c56305314a3a5567a79ece638e4ac3d513b46138737ae6bd27a098f30013a94767db151181aac9c01290a1
-Size (postgresql-9.6.3.tar.bz2) = 19534323 bytes
+SHA1 (postgresql-9.6.4.tar.bz2) = f10e2e5c09e041616e25bd41a9ea91be98534d9d
+RMD160 (postgresql-9.6.4.tar.bz2) = 1e4b8ed5c1d3b97bbcb269cd379fd83248801d8c
+SHA512 (postgresql-9.6.4.tar.bz2) = b0527efacce6efc09340b68c8c56483cd884676e01cb6bfb4f9ce63226a394bdb0bcf3d832f84e4dff5ceecf09ef4cf93e9fbd0ac453ec85efb11ac50a7dff39
+Size (postgresql-9.6.4.tar.bz2) = 19566875 bytes
 SHA1 (patch-config_missing) = c2d7d742922ba6861e7660c75b7b53f09e564813
 SHA1 (patch-config_perl.m4) = e035132b1c281a75752d570ac5e29a11176c25c5
 SHA1 (patch-configure) = 59fe9a768caf8a5d308acac60c28bc6bb2c40632
@@ -16,4 +16,4 @@ SHA1 (patch-src_interfaces_ecpg_pgtypeslib_interval.c) = a15012ae34d4ecd1eb2bc29
 SHA1 (patch-src_interfaces_libpq_Makefile) = 61bcf84eb69b6ec9faabab0b61913766f4b20f8c
 SHA1 (patch-src_makefiles_Makefile.solaris) = 0168f5bc105ffc89d5db40907a08966d8465f5a0
 SHA1 (patch-src_pl_plperl_GNUmakefile) = 6ee3e431f46ce5c2a94df499504b2b8bd458bbef
-SHA1 (patch-src_pl_plperl_plperl.h) = bd663fa80a47f7b82ce689060750fa6e631fbc61
+SHA1 (patch-src_pl_plperl_plperl.h) = 0e7daec79a00d7378326e56525e50cfe61cfc174
diff --git a/databases/postgresql96/patches/patch-src_pl_plperl_plperl.h b/databases/postgresql96/patches/patch-src_pl_plperl_plperl.h
index 23875264422..3747378f2be 100644
--- a/databases/postgresql96/patches/patch-src_pl_plperl_plperl.h
+++ b/databases/postgresql96/patches/patch-src_pl_plperl_plperl.h
@@ -1,8 +1,8 @@
-$NetBSD: patch-src_pl_plperl_plperl.h,v 1.1 2016/10/29 19:41:55 adam Exp $
+$NetBSD: patch-src_pl_plperl_plperl.h,v 1.2 2017/08/13 19:25:18 adam Exp $
 
---- src/pl/plperl/plperl.h.orig	2011-09-22 23:57:57.000000000 +0200
-+++ src/pl/plperl/plperl.h	2011-10-12 20:36:11.783264869 +0200
-@@ -44,12 +44,21 @@
+--- src/pl/plperl/plperl.h.orig	2017-08-07 21:19:50.000000000 +0000
++++ src/pl/plperl/plperl.h
+@@ -44,6 +44,10 @@
  #undef vsnprintf
  #endif
  
@@ -11,10 +11,11 @@ $NetBSD: patch-src_pl_plperl_plperl.h,v 1.1 2016/10/29 19:41:55 adam Exp $
 +#define list_tail sun_list_tail
 +#endif
  
- /* required for perl API */
- #include "EXTERN.h"
- #include "perl.h"
+ /*
+  * Get the basic Perl API.  We use PERL_NO_GET_CONTEXT mode so that our code
+@@ -62,6 +66,11 @@
  #include "XSUB.h"
+ #endif
  
 +#ifdef __sun
 +#undef list_head