PostgreSQL is prone to a security-bypass vulnerability because the application fails to properly validate the domain name in a signed CA certificate, allowing attackers to substitute malicious SSL certificates for trusted ones. Successfully exploiting this issue allows attackers to perform man-in-the- middle attacks or impersonate trusted servers, which will aid in further attacks. PostgreSQL is also prone to a local privilege-escalation vulnerability. Exploiting this issue allows local attackers to gain elevated privileges. PostgreSQL versions prior to 8.4.2, 8.3.9, 8.2.15, 8.1.19, 8.0.23, and 7.4.27 are vulnerable to this issue.

Updates are available. Please see the references for more information.

• http://www.postgresql.org
• http://www.postgresql.org/about/news.1170
• http://www.postgresql.org/support/security
• http://www.securityfocus.com/bid/37333
• http://www.securityfocus.com/bid/37334

---

Updated on 2015-03-25