ea28815591
A major security issue fixed in this release, CVE-2013-1899, makes it possible for a connection request containing a database name that begins with "-" to be crafted that can damage or destroy files within a server's data directory. Anyone with access to the port the PostgreSQL server listens on can initiate this request. Two lesser security fixes are also included in this release: CVE-2013-1900, wherein random numbers generated by contrib/pgcrypto functions may be easy for another database user to guess, and CVE-2013-1901, which mistakenly allows an unprivileged user to run commands that could interfere with in-progress backups. Finally, this release fixes two security issues with the graphical installers for Linux and Mac OS X: insecure passing of superuser passwords to a script, CVE-2013-1903 and the use of predictable filenames in /tmp CVE-2013-1902.
13 lines
433 B
C
13 lines
433 B
C
$NetBSD: patch-contrib_dblink_dblink.c,v 1.2 2013/04/04 21:08:36 adam Exp $
|
|
|
|
--- contrib/dblink/dblink.c.orig 2013-04-01 18:20:36.000000000 +0000
|
|
+++ contrib/dblink/dblink.c
|
|
@@ -46,7 +46,7 @@
|
|
#include "parser/scansup.h"
|
|
#include "utils/acl.h"
|
|
#include "utils/builtins.h"
|
|
-#include "utils/fmgroids.h"
|
|
+#include "postgresql/server/utils/fmgroids.h"
|
|
#include "utils/guc.h"
|
|
#include "utils/lsyscache.h"
|
|
#include "utils/memutils.h"
|