FreeBSD: VID-62DA9702-B4CC-11EB-B9C9-6CC21735F730: PostgreSQL server -- two security issues

Description

The PostgreSQL project reports:

Memory disclosure in INSERT ... ON CONFLICT ... DO UPDATE

Using an INSERT ... ON CONFLICT ... DO UPDATE command on a

purpose-crafted table, an attacker can read arbitrary bytes of

server memory. In the default configuration, any authenticated

database user can create prerequisite objects and complete this

attack at will. A user lacking the CREATE and TEMPORARY privileges

on all databases and the CREATE privilege on all schemas cannot use

this attack at will..

Buffer overrun from integer overflow in array subscripting

calculations

While modifying certain SQL array values, missing bounds checks let

authenticated database users write arbitrary bytes to a wide area of

server memory.