Red Hat Bugzilla – Bug 1221539
CVE-2015-3166 postgresql: unanticipated errors from the standard library
Last modified: 2015-11-25 05:34:37 EST
The PostgreSQL project reports the following issue: The server regularly ignores the return value of certain standard library functions, such as sprintf() and putenv(), which can fail under memory exhaustion. This could, in principle, have a variety of security-relevant effects. For example, an unnoticed sprintf() error could permit disclosure of prior buffer contents. A particular putenv() failure could cause GSSAPI authentication to consult the wrong keytab file. Reducing such exploits to practice is expected to be impossible in most configurations, given the requirement for such an intricate coincidence of system state. This flaw is fixed in upstream versions 9.4.2, 9.3.7, 9.2.11, 9.1.16, and 9.0.20 of PostgreSQL. Acknowledgements: Red Hat would like to thank the PostgreSQL project for reporting this issue. Upstream acknowledges Noah Misch as the original reporter.
Public via: http://www.postgresql.org/about/news/1587/
Patch: http://git.postgresql.org/gitweb/?p=postgresql.git;a=commit;h=0c071936e94c6859afb2ec8d2c8dddf7bcdab7ee
All related upstream commit: http://git.postgresql.org/gitweb/?p=postgresql.git;a=commitdiff;h=16304a013432931e61e623c8d85e9fe24709d9ba http://git.postgresql.org/gitweb/?p=postgresql.git;a=commitdiff;h=fd97bd411d1da45b79e63c2124741f8e82cc5a5c http://git.postgresql.org/gitweb/?p=postgresql.git;a=commitdiff;h=0c071936e94c6859afb2ec8d2c8dddf7bcdab7ee
This issue has been addressed in the following products: Red Hat Software Collections for Red Hat Enterprise Linux 7 Red Hat Software Collections for Red Hat Enterprise Linux 7.1 EUS Red Hat Software Collections for Red Hat Enterprise Linux 6.6 EUS Red Hat Software Collections for Red Hat Enterprise Linux 6.5 EUS Red Hat Software Collections for Red Hat Enterprise Linux 6 Via RHSA-2015:1196 https://rhn.redhat.com/errata/RHSA-2015-1196.html
This issue has been addressed in the following products: Red Hat Software Collections for Red Hat Enterprise Linux 7 Red Hat Software Collections for Red Hat Enterprise Linux 7.1 EUS Red Hat Software Collections for Red Hat Enterprise Linux 6.6 EUS Red Hat Software Collections for Red Hat Enterprise Linux 6.5 EUS Red Hat Software Collections for Red Hat Enterprise Linux 6 Via RHSA-2015:1195 https://rhn.redhat.com/errata/RHSA-2015-1195.html
This issue has been addressed in the following products: Red Hat Enterprise Linux 6 Red Hat Enterprise Linux 7 Via RHSA-2015:1194 https://rhn.redhat.com/errata/RHSA-2015-1194.html
Statement: Red Hat Enterprise Linux 5 is now in Production 3 Phase of the support and maintenance life cycle. This flaw has been rated as having Low security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.