diff --git a/doc/src/sgml/release-9.0.sgml b/doc/src/sgml/release-9.0.sgml index 93198931f8..ef8eb1c9ad 100644 --- a/doc/src/sgml/release-9.0.sgml +++ b/doc/src/sgml/release-9.0.sgml @@ -40,6 +40,20 @@ + + + Fix contrib/pgcrypto to detect and report + too-short crypt() salts (Josh Kupershmidt) + + + + Certain invalid salt arguments crashed the server or disclosed a few + bytes of server memory. We have not ruled out the viability of + attacks that arrange for presence of confidential information in the + disclosed bytes, but they seem unlikely. (CVE-2015-5288) + + + Fix subtransaction cleanup after a portal (cursor) belonging to an @@ -124,6 +138,14 @@ + + + Guard against hard-to-reach stack overflows involving record types, + range types, json, jsonb, tsquery, + ltxtquery and query_int (Noah Misch) + + + Fix handling of DOW and DOY in datetime input diff --git a/doc/src/sgml/release-9.1.sgml b/doc/src/sgml/release-9.1.sgml index afffb43969..fde6b61bce 100644 --- a/doc/src/sgml/release-9.1.sgml +++ b/doc/src/sgml/release-9.1.sgml @@ -34,6 +34,20 @@ + + + Fix contrib/pgcrypto to detect and report + too-short crypt() salts (Josh Kupershmidt) + + + + Certain invalid salt arguments crashed the server or disclosed a few + bytes of server memory. We have not ruled out the viability of + attacks that arrange for presence of confidential information in the + disclosed bytes, but they seem unlikely. (CVE-2015-5288) + + + Fix subtransaction cleanup after a portal (cursor) belonging to an @@ -130,6 +144,14 @@ + + + Guard against hard-to-reach stack overflows involving record types, + range types, json, jsonb, tsquery, + ltxtquery and query_int (Noah Misch) + + + Fix handling of DOW and DOY in datetime input diff --git a/doc/src/sgml/release-9.2.sgml b/doc/src/sgml/release-9.2.sgml index 676b6554e5..4bfede5bc0 100644 --- a/doc/src/sgml/release-9.2.sgml +++ b/doc/src/sgml/release-9.2.sgml @@ -34,6 +34,20 @@ + + + Fix contrib/pgcrypto to detect and report + too-short crypt() salts (Josh Kupershmidt) + + + + Certain invalid salt arguments crashed the server or disclosed a few + bytes of server memory. We have not ruled out the viability of + attacks that arrange for presence of confidential information in the + disclosed bytes, but they seem unlikely. (CVE-2015-5288) + + + Fix subtransaction cleanup after a portal (cursor) belonging to an @@ -136,6 +150,14 @@ Branch: REL9_1_STABLE [9b1b9446f] 2015-08-27 12:22:10 -0400 + + + Guard against hard-to-reach stack overflows involving record types, + range types, json, jsonb, tsquery, + ltxtquery and query_int (Noah Misch) + + + Fix handling of DOW and DOY in datetime input diff --git a/doc/src/sgml/release-9.3.sgml b/doc/src/sgml/release-9.3.sgml index c0fd1b3b79..1ac6abe632 100644 --- a/doc/src/sgml/release-9.3.sgml +++ b/doc/src/sgml/release-9.3.sgml @@ -34,6 +34,34 @@ + + + Guard against stack overflows in json parsing + (Oskari Saarenmaa) + + + + If an application constructs PostgreSQL json + or jsonb values from arbitrary user input, the application's + users can reliably crash the PostgreSQL server, causing momentary + denial of service. (CVE-2015-5289) + + + + + + Fix contrib/pgcrypto to detect and report + too-short crypt() salts (Josh Kupershmidt) + + + + Certain invalid salt arguments crashed the server or disclosed a few + bytes of server memory. We have not ruled out the viability of + attacks that arrange for presence of confidential information in the + disclosed bytes, but they seem unlikely. (CVE-2015-5288) + + + Fix subtransaction cleanup after a portal (cursor) belonging to an @@ -146,6 +174,14 @@ + + + Guard against hard-to-reach stack overflows involving record types, + range types, json, jsonb, tsquery, + ltxtquery and query_int (Noah Misch) + + + Fix handling of DOW and DOY in datetime input diff --git a/doc/src/sgml/release-9.4.sgml b/doc/src/sgml/release-9.4.sgml index 361e757097..4fd1feb6fa 100644 --- a/doc/src/sgml/release-9.4.sgml +++ b/doc/src/sgml/release-9.4.sgml @@ -33,6 +33,53 @@ + + + + + Guard against stack overflows in json parsing + (Oskari Saarenmaa) + + + + If an application constructs PostgreSQL json + or jsonb values from arbitrary user input, the application's + users can reliably crash the PostgreSQL server, causing momentary + denial of service. (CVE-2015-5289) + + + + + + + + Fix contrib/pgcrypto to detect and report + too-short crypt() salts (Josh Kupershmidt) + + + + Certain invalid salt arguments crashed the server or disclosed a few + bytes of server memory. We have not ruled out the viability of + attacks that arrange for presence of confidential information in the + disclosed bytes, but they seem unlikely. (CVE-2015-5288) + + + @@ -266,6 +320,33 @@ Branch: REL9_0_STABLE [a89781e34] 2015-09-21 12:12:16 -0400 + + + + + Guard against hard-to-reach stack overflows involving record types, + range types, json, jsonb, tsquery, + ltxtquery and query_int (Noah Misch) + + +