|
Release Notes
Release 7.4.8
Release date: 2005-05-09
This release contains a variety of fixes from 7.4.7, including several
security-related issues.
__________________________________________________________________
Migration to version 7.4.8
A dump/restore is not required for those running 7.4.X. However, it is
one possible way of handling two significant security problems that
have been found in the initial contents of 7.4.X system catalogs. A
dump/initdb/reload sequence using 7.4.8's initdb will automatically
correct these problems.
The larger security problem is that the built-in character set encoding
conversion functions can be invoked from SQL commands by unprivileged
users, but the functions were not designed for such use and are not
secure against malicious choices of arguments. The fix involves
changing the declared parameter list of these functions so that they
can no longer be invoked from SQL commands. (This does not affect their
normal use by the encoding conversion machinery.)
The lesser problem is that the "contrib/tsearch2" module creates
several functions that are misdeclared to return internal when they do
not accept internal arguments. This breaks type safety for all
functions using internal arguments.
It is strongly recommended that all installations repair these errors,
either by initdb or by following the manual repair procedures given
below. The errors at least allow unprivileged database users to crash
their server process, and may allow unprivileged users to gain the
privileges of a database superuser.
While here, fix postgresql74-client package installation on 2.0
(broken -X), and avoid the need for gtar in tcl-postgresql74.
|
