Errata overview
Errata ID 329
Date 2016-11-23
Source package postgresql-9.1
Fixed in version 9.1.24-0.12.201611161707
Description
Debian updated postgresql-9.1 to the new version 9.1.24, which addresses
a couple of stability and security issues:
* Attackers may cause denial of service (server crash) or read arbitrary
  server memory via "too-short" crypt salts (CVE-2015-5288)
* Privilege escalation vulnerability for users of PL/Java (CVE-2016-0766)
* Denial of service and potential execution of arbitrary code due to
  buffer overrun in PL/Java regular expression processing (CVE-2016-0773)
* possible mis-evaluation of nested CASE-WHEN expressions (CVE-2016-5423)
* Fix client programs' handling of special characters in database and
  role names (CVE-2016-5424)
For other changes, see:
* <https://www.postgresql.org/docs/9.1/static/release-9-1-17.html>
* <https://www.postgresql.org/docs/9.1/static/release-9-1-18.html>
* <https://www.postgresql.org/docs/9.1/static/release-9-1-19.html>
* <https://www.postgresql.org/docs/9.1/static/release-9-1-20.html>
* <https://www.postgresql.org/docs/9.1/static/release-9-1-21.html>
* <https://www.postgresql.org/docs/9.1/static/release-9-1-22.html>
* <https://www.postgresql.org/docs/9.1/static/release-9-1-23.html>
* <https://www.postgresql.org/docs/9.1/static/release-9-1-24.html>
Additional notes
CVE ID CVE-2015-5288
CVE-2016-0766
CVE-2016-0773
CVE-2016-5423
CVE-2016-5424
UCS Bug number #40717