PostgreSQL 2013-02-07 Security Update Release

The PostgreSQL Global Development Group has released a security update
to all current versions of the PostgreSQL database system, including
versions 9.2.3, 9.1.8, 9.0.12, 8.4.16, and 8.3.23.  This update fixes a
denial-of-service (DOS) vulnerability.  All users should update their
PostgreSQL installations as soon as possible.

The security issue fixed in this release, CVE-2013-0255 (
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0255 ), allows a
previously authenticated user to crash the server by calling an internal
function with invalid arguments.  This issue was discovered by
independent security researcher Sumit Soni this week and reported via
Secunia SVCRP, and we are grateful for their efforts in making
PostgreSQL more secure.

Today's update also fixes a performance regression which caused a
decrease in throughput when using dynamic queries in stored procedures
in version 9.2.  Applications which use PL/pgSQL's EXECUTE are strongly
affected by this regression and should be updated.  Additionally, we
have fixed intermittent crashes caused by CREATE/DROP INDEX
CONCURRENTLY, and multiple minor issues with replication.

This release is expected to be the final update for version 8.3, which
is now End-of-Life (EOL).  Users of version 8.3 should plan to upgrade
to a later version of PostgreSQL immediately. For more information, see
our Versioning Policy ( http://www.postgresql.org/support/versioning/ ).

This update release also contains fixes for many minor issues
discovered and patched by the PostgreSQL community in the last two
months, including:

* Prevent unnecessary table scans during vacuuming
* Prevent spurious cached plan error in PL/pgSQL
* Allow sub-SELECTs to be subscripted
* Prevent DROP OWNED from dropping databases or tablespaces
* Make ECPG use translated messages
* Allow PL/Python to use multi-table trigger functions
   (again) in 9.1 and 9.2
* Fix several activity log management issues on Windows
* Prevent autovacuum file truncation from being
   canceled by deadlock_timeout
* Make extensions build with the .exe suffix automatically
   on Windows
* Fix concurrency issues with CREATE/DROP DATABASE
* Reject out-of-range values in to_date() conversion function
* Revert cost estimation for large indexes back to pre-9.2
   behavior
* Make pg_basebackup tolerate timeline switches
* Cleanup leftover temp table entries during crash recovery
* Prevent infinite loop when COPY inserts a large tuple into a
   table with a large fillfactor
* Prevent integer overflow in dynahash creation
* Make pg_upgrade work with INVALID indexes
* Fix bugs in TYPE privileges
* Allow Contrib installchecks to run in their own databases
* Many documentation updates
* Add new timezone "FET".

As with other minor releases, users are not required to dump and reload
their database or use pg_upgrade in order to apply this update release;
you may simply shut down PostgreSQL and update its binaries.  Users who
have skipped multiple update releases may need to perform additional,
post-update steps; see the Release Notes for details.

Links:
   * Download: http://postgresql.org/download
   * Release Notes:
http://www.postgresql.org/docs/current/static/release.html