Package        : postgresql-9.1
Vulnerability  : several
Problem type   : remote
Debian-specific: no
CVE ID         : CVE-2013-1899 CVE-2013-1900 CVE-2013-1901
Debian Bug     : 704479 

Several vulnerabilities were discovered in PostgreSQL database server.

CVE-2013-1899

    Mitsumasa Kondo and Kyotaro Horiguchi of NTT Open Source Software Center
    discovered that it was possible for a connection request containing a
    database name that begins with "-" to be crafted that can damage or destroy
    files within a server's data directory. Anyone with access to the port the
    PostgreSQL server listens on can initiate this request.

CVE-2013-1900

    Random numbers generated by contrib/pgcrypto functions may be easy for
    another database user to guess.

CVE-2013-1901

    An unprivileged user could run commands that could interfere with
    in-progress backups

For backports for the stable distribution (squeeze-backports), these
problems have been fixed in version 9.1.9-1~bpo60+1.

For the stable dist

The postgresql-9.0 package on backports.debian.org is no longer
maintained, and was finally removed from the archive now.
postgresql-9.0 will not be part of the next Debian release, and hence
was removed from Debian/testing and unstable. Backports is now
following this move.

There are two options for users of postgresql-9.0:

* Upgrade to postgresql-9.1 which will be shipped with wheezy. This
package is part of backports.debian.org.
* Switch to the PostgreSQL APT archive at apt.postgresql.org, as
detailed in https://wiki.postgresql.org/wiki/Apt. This archive
provides compatible 9.0 packages. (And 9.1 and 9.2.)

postgresql-9.0 is affected by the upcoming security update:
http://www.postgresql.org/about/news/1454/

Please move away from the backports.debian.org version of
postgresql-9.0 as soon as possible.

Christoph