Package        : postgresql-9.1
Vulnerability  : several
Problem type   : remote
Debian-specific: no
CVE ID         : CVE-2013-1899 CVE-2013-1900 CVE-2013-1901
Debian Bug     : 704479 

Several vulnerabilities were discovered in PostgreSQL database server.

CVE-2013-1899

    Mitsumasa Kondo and Kyotaro Horiguchi of NTT Open Source Software Center
    discovered that it was possible for a connection request containing a
    database name that begins with "-" to be crafted that can damage or destroy
    files within a server's data directory. Anyone with access to the port the
    PostgreSQL server listens on can initiate this request.

CVE-2013-1900

    Random numbers generated by contrib/pgcrypto functions may be easy for
    another database user to guess.

CVE-2013-1901

    An unprivileged user could run commands that could interfere with
    in-progress backups

For backports for the stable distribution (squeeze-backports), these
problems have been fixed in version 9.1.9-1~bpo60+1.

For the stable dist

The postgresql-9.0 package on backports.debian.org is no longer
maintained, and was finally removed from the archive now.
postgresql-9.0 will not be part of the next Debian release, and hence
was removed from Debian/testing and unstable. Backports is now
following this move.

There are two options for users of postgresql-9.0:

* Upgrade to postgresql-9.1 which will be shipped with wheezy. This
package is part of backports.debian.org.
* Switch to the PostgreSQL APT archive at apt.postgresql.org, as
detailed in https://wiki.postgresql.org/wiki/Apt. This archive
provides compatible 9.0 packages. (And 9.1 and 9.2.)

postgresql-9.0 is affected by the upcoming security update:
http://www.postgresql.org/about/news/1454/

Please move away from the backports.debian.org version of
postgresql-9.0 as soon as possible.

Christoph

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

      Dear users of the backports service!

 The Backports Team is pleased to announce the next important step
on getting backports more integrated.  People who are reading
debian-infrastructure-announce[1] will have seen that there was an
archive maintenance last weekend: starting with wheezy-backports the
packages will be accessible from the regular pool instead of a separate
one.


== For Users ==

 What exactly does that mean for you?  For users of wheezy, the
sources.list entry will be different, a simple substitute of squeeze
for wheezy won't work.  The new format is:

 deb http://ftp.debian.org/debian/ wheezy-backports main

 So it is debian instead of debian-backports, and offered through the
regular mirror network.  Feel invited to check your regular mirror if
it carries backports and pull from there.


== For Contributers ==

 Please read the mail to debian-devel-announce[5] instead. :)

 Just one thing mentioned here:  technically wheezy-backports a