The PostgreSQL Global Development Group today released security updates for all active branches

of the PostgreSQL database system, including versions 9.1.5, 9.0.9, 8.4.13 and 8.3.20. This
update patches security holes associated with libxml2 and libxslt, similar to those affecting
other open source projects. All users are urged to update their installations at the first
available opportunity.

This security release fixes a vulnerability in the built-in XML functionality, and a vulnerability
in the XSLT functionality supplied by the optional XML2 extension. Both vulnerabilities allow
reading of arbitrary files by any authenticated database user, and the XSLT vulnerability
allows writing files as well. The fixes cause limited backwards compatibility issues.
These issues correspond to the following two vulnerabilities:

CVE-2012-3488: PostgreSQL insecure use of libxslt
CVE-2012-3489: PostgreSQL insecure use of libxml2
This release also contains several fixes to version 9.1, and a smaller number of fixes to older versions, including:

Updates and corrections to time zone data
Multiple documentation updates and corrections
Add limit on max_wal_senders
Fix dependencies generated during ALTER TABLE ADD CONSTRAINT USING INDEX.
Correct behavior of unicode conversions for PL/Python
Fix WITH attached to a nested set operation (UNION/INTERSECT/EXCEPT).
Fix syslogger so that log_truncate_on_rotation works in the first rotation.
Only allow autovacuum to be auto-canceled by a directly blocked process.
Improve fsync request queue operation
Prevent corner-case core dump in rfree().
Fix Walsender so that it responds correctly to timeouts and deadlocks
Several PL/Perl fixes for encoding-related issues
Make selectivity operators use the correct collation
Prevent unsuitable slaves from being selected for synchronous replication
Make REASSIGN OWNED work on extensions as well
Fix race condition with ENUM comparisons
Make NOTIFY cope with out-of-disk-space
Fix memory leak in ARRAY subselect queries
Reduce data loss at replication failover
Fix behavior of subtransactions with Hot Standby

4 files changed, 11 insertions, 3 deletions

diff --git a/databases/postgresql84-server/Makefile b/databases/postgresql84-server/Makefile
index fe71d32a04a7..8f1932419e52 100644
--- a/databases/postgresql84-server/Makefile
+++ b/databases/postgresql84-server/Makefile
@@ -6,7 +6,7 @@
 #
 
 PORTNAME?=	postgresql
-DISTVERSION?=	8.4.12
+DISTVERSION?=	8.4.13
 PORTREVISION?=	0
 CATEGORIES?=	databases
 MASTER_SITES=	${MASTER_SITE_PGSQL}
diff --git a/databases/postgresql84-server/distinfo b/databases/postgresql84-server/distinfo
index 03b93cae580f..27ffbcf371c7 100644
--- a/databases/postgresql84-server/distinfo
+++ b/databases/postgresql84-server/distinfo
@@ -1,4 +1,4 @@
-SHA256 (postgresql/postgresql-8.4.12.tar.bz2) = 99b7b330ec183828988c7e8ec1b675393f24b10017a2e1d03b8ff48c4dfc0f77
-SIZE (postgresql/postgresql-8.4.12.tar.bz2) = 14509007
+SHA256 (postgresql/postgresql-8.4.13.tar.bz2) = 20dd3442a3fa3a4fb1813b58f969ce4bbc54d73194fd4fe20d6f1313edc48cb9
+SIZE (postgresql/postgresql-8.4.13.tar.bz2) = 14666613
 SHA256 (postgresql/pg-840-icu-2009-09-15.diff.gz) = c09d3b59340a3bb6ea754e985739d4fbb47f730d1e48a357c5585825034fc72e
 SIZE (postgresql/pg-840-icu-2009-09-15.diff.gz) = 4321
diff --git a/databases/postgresql84-server/pkg-plist-client b/databases/postgresql84-server/pkg-plist-client
index 2e927c11d771..d1e1d7cd7c27 100644
--- a/databases/postgresql84-server/pkg-plist-client
+++ b/databases/postgresql84-server/pkg-plist-client
@@ -614,8 +614,13 @@ share/postgresql/psqlrc.sample
 %%GETTEXT%%share/locale/pt_BR/LC_MESSAGES/psql-8.4.mo
 %%GETTEXT%%share/locale/ro/LC_MESSAGES/pg_config-8.4.mo
 %%GETTEXT%%share/locale/ro/LC_MESSAGES/pgscripts-8.4.mo
+%%GETTEXT%%share/locale/ru/LC_MESSAGES/ecpg-8.4.mo
+%%GETTEXT%%share/locale/ru/LC_MESSAGES/ecpglib6-8.4.mo
 %%GETTEXT%%share/locale/ru/LC_MESSAGES/libpq5-8.4.mo
 %%GETTEXT%%share/locale/ru/LC_MESSAGES/pg_config-8.4.mo
+%%GETTEXT%%share/locale/ru/LC_MESSAGES/pg_dump-8.4.mo
+%%GETTEXT%%share/locale/ru/LC_MESSAGES/pgscripts-8.4.mo
+%%GETTEXT%%share/locale/ru/LC_MESSAGES/psql-8.4.mo
 %%GETTEXT%%share/locale/sv/LC_MESSAGES/libpq5-8.4.mo
 %%GETTEXT%%share/locale/sv/LC_MESSAGES/pg_config-8.4.mo
 %%GETTEXT%%share/locale/sv/LC_MESSAGES/pg_dump-8.4.mo
diff --git a/databases/postgresql84-server/pkg-plist-server b/databases/postgresql84-server/pkg-plist-server
index ab8330ece20f..66a9d39a8edb 100644
--- a/databases/postgresql84-server/pkg-plist-server
+++ b/databases/postgresql84-server/pkg-plist-server
@@ -96,8 +96,11 @@ share/postgresql/system_views.sql
 %%GETTEXT%%share/locale/ro/LC_MESSAGES/pg_resetxlog-8.4.mo
 %%GETTEXT%%share/locale/ro/LC_MESSAGES/plpgsql-8.4.mo
 %%GETTEXT%%share/locale/ru/LC_MESSAGES/initdb-8.4.mo
+%%GETTEXT%%share/locale/ru/LC_MESSAGES/pg_controldata-8.4.mo
 %%GETTEXT%%share/locale/ru/LC_MESSAGES/pg_ctl-8.4.mo
 %%GETTEXT%%share/locale/ru/LC_MESSAGES/pg_resetxlog-8.4.mo
+%%GETTEXT%%share/locale/ru/LC_MESSAGES/plpgsql-8.4.mo
+%%GETTEXT%%share/locale/ru/LC_MESSAGES/postgres-8.4.mo
 %%GETTEXT%%share/locale/sv/LC_MESSAGES/initdb-8.4.mo
 %%GETTEXT%%share/locale/sv/LC_MESSAGES/pg_controldata-8.4.mo
 %%GETTEXT%%share/locale/sv/LC_MESSAGES/pg_ctl-8.4.mo