| Age | Commit message (Collapse) | Author | Files | Lines |
|---|
|
supported versions of our database system, including 9.5.4, 9.4.9, 9.3.14, 9.2.18 and 9.1.23. This release fixes two security issues. It also patches a number of other bugs reported over the last three months. Users who rely on security isolation between database users should update as soon as possible. Other users should plan to update at the next convenient downtime.
Security Issues
---------------
Two security holes have been closed by this release:
CVE-2016-5423: certain nested CASE expressions can cause the server to crash.
CVE-2016-5424: database and role names with embedded special characters can allow code injection during administrative operations like pg_dumpall.
The fix for the second issue also adds an option, -reuse-previous, to psql's \connect command. pg_dumpall will also refuse to handle database and role names containing line breaks after the update. For more information on these issues and how they affect backwards-compatibility, see the Release Notes.
Bug Fixes and Improvements
--------------------------
This update also fixes a number of bugs reported in the last few months. Some of these issues affect only version 9.5, but many affect all supported versions:
Fix misbehaviors of IS NULL/IS NOT NULL with composite values
Fix three areas where INSERT ... ON CONFLICT failed to work properly with other SQL features.
Make INET and CIDR data types properly reject bad IPv6 values
Prevent crash in "point ## lseg" operator for NaN input
Avoid possible crash in pg_get_expr()
Fix several one-byte buffer over-reads in to_number()
Don't needlessly plan query if WITH NO DATA is specified
Avoid crash-unsafe state in expensive heap_update() paths
Fix hint bit update during WAL replay of row locking operations
Avoid unnecessary "could not serialize access" with FOR KEY SHARE
Avoid crash in postgres -C when the specified variable is a null string
Fix two issues with logical decoding and subtransactions
Ensure that backends see up-to-date statistics for shared catalogs
Prevent possible failure when vacuuming multixact IDs in an upgraded database
When a manual ANALYZE specifies columns, don't reset changes_since_analyze
Fix ANALYZE's overestimation of n_distinct for columns with nulls
Fix bug in b-tree mark/restore processing
Fix building of large (bigger than shared_buffers) hash indexes
Prevent infinite loop in GiST index build with NaN values
Fix possible crash during a nearest-neighbor indexscan
Fix "PANIC: failed to add BRIN tuple" error
Prevent possible crash during background worker shutdown
Many fixes for issues in parallel pg_dump and pg_restore
Make pg_basebackup accept -Z 0 as no compression
Make regression tests safe for Danish and Welsh locales
|
|
months. Most database administrators should plan to upgrade at the next available downtime, unless they have been affected directly by the fixed issues.
|
|
|
|
supported version of the database system, including versions 9.3.5, 9.2.9, 9.1.14, 9.0.18, and 8.4.22. This minor release fixes a number of issues discovered and reported by users over the last four months, including some data corruption issues, and is the last update of version 8.4. Users of version 9.3 will want to update at the earliest opportunity; users of version 8.4 will want to schedule an upgrade to a supported PostgreSQL version.
|
|
all supported versions of the PostgreSQL database system, which includes minor versions 9.3.2, 9.2.6, 9.1.11, 9.0.15, and 8.4.19. This update fixes three serious data-loss bugs affecting replication and database maintenance. All users are urged to update their installations at the earliest opportunity.
The replication issue affects some users of PostgreSQL binary replication, and can cause minor data loss between the master and the standby. While not all users are affected, it is difficult to predict when the bug will occur, so we urge all users of replication and continuous backup (PITR) to update immediately. Additionally, users who had replication running under PostgreSQL minor versions 9.3.0, 9.3.1, 9.2.5, 9.1.10, or 9.0.14 should plan to take a fresh base backup of each standby after update, in order to ensure no prior data corruption already exists.
This release also fixes two timing issues with VACUUM, which can cause old, overwritten or deleted rows to re-appear at a later date under some circumstances. Users with very high transaction rates, particularly those who experience "transaction ID wraparound" every few weeks or less, are the most at risk for this issue. Those users should set vacuum_freeze_table_age to 0, and run a database-wide VACUUM after the update. The second of the two VACUUM issues affects only 9.3, making it expecially important for 9.3 users to update.
|
|
all current versions of the PostgreSQL database system, including versions 9.2.4, 9.1.9, 9.0.13, and 8.4.17. This update fixes a high-exposure security vulnerability in versions 9.0 and later. All users of the affected versions are strongly urged to apply the update immediately.
A major security issue fixed in this release, CVE-2013-1899, makes it possible for a connection request containing a database name that begins with "-" to be crafted that can damage or destroy files within a server's data directory. Anyone with access to the port the PostgreSQL server listens on can initiate this request.
Two lesser security fixes are also included in this release: CVE-2013-1900, wherein random numbers generated by contrib/pgcrypto functions may be easy for another database user to guess, and CVE-2013-1901, which mistakenly allows an unprivileged user to run commands that could interfere with in-progress backups. Finally, this release fixes two security issues with the graphical installers for Linux and Mac OS X: insecure passing of superuser passwords to a script, CVE-2013-1903 and the use of predictable filenames in /tmp CVE-2013-1902.
|
|
release of the leader in open source databases. Since the beta release was announced in May, developers and vendors have praised it as a leap forward in performance, scalability and flexibility. Users are expected to switch to this version in record numbers.
PostgreSQL 9.2 will ship with native JSON support, covering indexes, replication and performance improvements, and many more features. We are eagerly awaiting this release and will make it available in Early Access as soon as it’s released by the PostgreSQL community," said Ines Sombra, Lead Data Engineer, Engine Yard.
|
