Release Notes
Release 7.4.8
Release date: 2005-05-09
This release contains a variety of fixes from 7.4.7, including several
security-related issues.
__________________________________________________________________
Migration to version 7.4.8
A dump/restore is not required for those running 7.4.X. However, it is
one possible way of handling two significant security problems that
have been found in the initial contents of 7.4.X system catalogs. A
dump/initdb/reload sequence using 7.4.8's initdb will automatically
correct these problems.
The larger security problem is that the built-in character set encoding
conversion functions can be invoked from SQL commands by unprivileged
users, but the functions were not designed for such use and are not
secure against malicious choices of arguments. The fix involves
changing the declared parameter list of these functions so that they
can no longer be invoked from SQL commands. (This does not affect their
normal use by the encoding conversion machinery.)
The lesser problem is that the "contrib/tsearch2" module creates
several functions that are misdeclared to return internal when they do
not accept internal arguments. This breaks type safety for all
functions using internal arguments.
It is strongly recommended that all installations repair these errors,
either by initdb or by following the manual repair procedures given
below. The errors at least allow unprivileged database users to crash
their server process, and may allow unprivileged users to gain the
privileges of a database superuser.
While here, fix postgresql74-client package installation on 2.0
(broken -X), and avoid the need for gtar in tcl-postgresql74.
Dump/restore is not necessary for 7.4.x users.
Changes in 7.4.5:
* Repair possible crash during concurrent btree index insertions
This patch fixes a rare case in which concurrent insertions into a
btree index could result in a server panic. No permanent damage
would result, but it's still worth a re-release. The bug does not
exist in pre-7.4 releases.
Changes in 7.4.4:
* Prevent possible loss of committed transactions during crash
Due to insufficient interlocking between transaction commit and
checkpointing, it was possible for transactions committed just
before the most recent checkpoint to be lost, in whole or in part,
following a database crash and restart. This is a serious bug that
has existed since PostgreSQL 7.1.
* Check HAVING restriction before evaluating result list of an
aggregate plan
* Avoid crash when session's current userID is deleted
* Fix hashed crosstab for zero-rows case (Joe)
* Force cache update after renaming a column in a foreign key
* Pretty-print UNION queries correctly
* Make psql handle \r\n newlines properly in COPY IN
* pg_dump handled ACLs with grant options incorrectly
* Fix thread support for OS X and Solaris
* Updated JDBC driver (build 215) with various fixes
* ECPG fixes
* Translation updates (various contributors)
in the process. (More information on tech-pkg.)
Bump PKGREVISION and BUILDLINK_DEPENDS of all packages using libtool and
installing .la files.
Bump PKGREVISION (only) of all packages depending directly on the above
via a buildlink3 include.
changes:
* Fix temporary memory leak when using non-hashed aggregates (Tom)
* ECPG fixes, including some for Informix compatibility (Michael)
* Fixes for compiling with thread-safety, particularly Solaris (Bruce)
* Fix error in COPY IN termination when using the old network
protocol (ljb)
* Several important fixes in pg_autovacuum (Matthew T. O'Connor)
* Fix problem with reading tar-format dumps on NetBSD and BSD/OS (Bruce)
* Several JDBC fixes
* Fix ALTER SEQUENCE RESTART where last_value equals the restart
value (Tom)
* Repair failure to recalculate nested sub-selects (Tom)
* Fix problems with non-constant expressions in LIMIT/OFFSET
* Support FULL JOIN with no join clause, such as X FULL JOIN Y ON
TRUE (Tom)
* Fix another zero-column table bug (Tom)
* Improve handling of non-qualified identifiers in GROUP BY clauses
in sub-selects (Tom)
* Do not generate "NATURAL CROSS JOIN" when decompiling rules (Tom)
* Add checks for invalid field length in binary COPY (Tom)
* Avoid locking conflict between ANALYZE and LISTEN/NOTIFY
* Numerous translation updates (various contributors)
Client programs.
PostgreSQL is a robust, next-generation, Object-Relational DBMS (ORDBMS),
derived from the Berkeley Postgres database management system. While
PostgreSQL retains the powerful object-relational data model, rich data types
and easy extensibility of Postgres, it replaces the PostQuel query language
with an extended subset of SQL.
PostgreSQL is free and the complete source is available.
This package contains the database client programs.
