Last-minute updates for release notes.

Add entries for security and not-quite-security issues.

Security: CVE-2015-5288, CVE-2015-5289

diff --git a/doc/src/sgml/release-9.0.sgml b/doc/src/sgml/release-9.0.sgml
index 93198931f88bace1f00246d703681b3248e0b9a0..ef8eb1c9ad2d912a62e499641611c1e2c7c9e325 100644 (file)
--- a/doc/src/sgml/release-9.0.sgml
+++ b/doc/src/sgml/release-9.0.sgml
@@ -40,6 +40,20 @@
 
    
 
+    
+     
+      Fix contrib/pgcrypto to detect and report
+      too-short crypt() salts (Josh Kupershmidt)
+     
+
+     
+      Certain invalid salt arguments crashed the server or disclosed a few
+      bytes of server memory.  We have not ruled out the viability of
+      attacks that arrange for presence of confidential information in the
+      disclosed bytes, but they seem unlikely.  (CVE-2015-5288)
+     
+    
+
     
      
       Fix subtransaction cleanup after a portal (cursor) belonging to an
@@ -124,6 +138,14 @@
      
     
 
+    
+     
+      Guard against hard-to-reach stack overflows involving record types,
+      range types, json, jsonb, tsquery,
+      ltxtquery and query_int (Noah Misch)
+     
+    
+
     
      
       Fix handling of DOW and DOY in datetime input

diff --git a/doc/src/sgml/release-9.1.sgml b/doc/src/sgml/release-9.1.sgml
index afffb43969b580730b28771d2632ba55c7da6b2c..fde6b61bced0727d9803f3b83fe291819172cb0f 100644 (file)
--- a/doc/src/sgml/release-9.1.sgml
+++ b/doc/src/sgml/release-9.1.sgml
@@ -34,6 +34,20 @@
 
    
 
+    
+     
+      Fix contrib/pgcrypto to detect and report
+      too-short crypt() salts (Josh Kupershmidt)
+     
+
+     
+      Certain invalid salt arguments crashed the server or disclosed a few
+      bytes of server memory.  We have not ruled out the viability of
+      attacks that arrange for presence of confidential information in the
+      disclosed bytes, but they seem unlikely.  (CVE-2015-5288)
+     
+    
+
     
      
       Fix subtransaction cleanup after a portal (cursor) belonging to an
@@ -130,6 +144,14 @@
      
     
 
+    
+     
+      Guard against hard-to-reach stack overflows involving record types,
+      range types, json, jsonb, tsquery,
+      ltxtquery and query_int (Noah Misch)
+     
+    
+
     
      
       Fix handling of DOW and DOY in datetime input

diff --git a/doc/src/sgml/release-9.2.sgml b/doc/src/sgml/release-9.2.sgml
index 676b6554e5294688e5bc4fd4c513f1d10f0d5454..4bfede5bc0e60d0eec3988fbb3abf1779ef4f53e 100644 (file)
--- a/doc/src/sgml/release-9.2.sgml
+++ b/doc/src/sgml/release-9.2.sgml
@@ -34,6 +34,20 @@
 
    
 
+    
+     
+      Fix contrib/pgcrypto to detect and report
+      too-short crypt() salts (Josh Kupershmidt)
+     
+
+     
+      Certain invalid salt arguments crashed the server or disclosed a few
+      bytes of server memory.  We have not ruled out the viability of
+      attacks that arrange for presence of confidential information in the
+      disclosed bytes, but they seem unlikely.  (CVE-2015-5288)
+     
+    
+
     
      
       Fix subtransaction cleanup after a portal (cursor) belonging to an
@@ -136,6 +150,14 @@ Branch: REL9_1_STABLE [9b1b9446f] 2015-08-27 12:22:10 -0400
      
     
 
+    
+     
+      Guard against hard-to-reach stack overflows involving record types,
+      range types, json, jsonb, tsquery,
+      ltxtquery and query_int (Noah Misch)
+     
+    
+
     
      
       Fix handling of DOW and DOY in datetime input

diff --git a/doc/src/sgml/release-9.3.sgml b/doc/src/sgml/release-9.3.sgml
index c0fd1b3b79b93cd42be61890d6b80721943ba017..1ac6abe632a95ddc1dac829fd36ee364ed20ea32 100644 (file)
--- a/doc/src/sgml/release-9.3.sgml
+++ b/doc/src/sgml/release-9.3.sgml
@@ -34,6 +34,34 @@
 
    
 
+    
+     
+      Guard against stack overflows in json parsing
+      (Oskari Saarenmaa)
+     
+
+     
+      If an application constructs PostgreSQL json
+      or jsonb values from arbitrary user input, the application's
+      users can reliably crash the PostgreSQL server, causing momentary
+      denial of service.  (CVE-2015-5289)
+     
+    
+
+    
+     
+      Fix contrib/pgcrypto to detect and report
+      too-short crypt() salts (Josh Kupershmidt)
+     
+
+     
+      Certain invalid salt arguments crashed the server or disclosed a few
+      bytes of server memory.  We have not ruled out the viability of
+      attacks that arrange for presence of confidential information in the
+      disclosed bytes, but they seem unlikely.  (CVE-2015-5288)
+     
+    
+
     
      
       Fix subtransaction cleanup after a portal (cursor) belonging to an
@@ -146,6 +174,14 @@
      
     
 
+    
+     
+      Guard against hard-to-reach stack overflows involving record types,
+      range types, json, jsonb, tsquery,
+      ltxtquery and query_int (Noah Misch)
+     
+    
+
     
      
       Fix handling of DOW and DOY in datetime input

diff --git a/doc/src/sgml/release-9.4.sgml b/doc/src/sgml/release-9.4.sgml
index 361e75709767e5ca386ad58d3f4d48d89f926ad9..4fd1feb6fa9a22aa10e7ee2ea5761143833f6a2d 100644 (file)
--- a/doc/src/sgml/release-9.4.sgml
+++ b/doc/src/sgml/release-9.4.sgml
@@ -33,6 +33,53 @@
 
    
 
+
+
+    
+     
+      Guard against stack overflows in json parsing
+      (Oskari Saarenmaa)
+     
+
+     
+      If an application constructs PostgreSQL json
+      or jsonb values from arbitrary user input, the application's
+      users can reliably crash the PostgreSQL server, causing momentary
+      denial of service.  (CVE-2015-5289)
+     
+    
+
+
+
+    
+     
+      Fix contrib/pgcrypto to detect and report
+      too-short crypt() salts (Josh Kupershmidt)
+     
+
+     
+      Certain invalid salt arguments crashed the server or disclosed a few
+      bytes of server memory.  We have not ruled out the viability of
+      attacks that arrange for presence of confidential information in the
+      disclosed bytes, but they seem unlikely.  (CVE-2015-5288)
+     
+    
+
 
 
     
@@ -266,6 +320,33 @@ Branch: REL9_0_STABLE [a89781e34] 2015-09-21 12:12:16 -0400
      
     
 
+
+
+    
+     
+      Guard against hard-to-reach stack overflows involving record types,
+      range types, json, jsonb, tsquery,
+      ltxtquery and query_int (Noah Misch)
+     
+    
+