Two vulnerabilities have been reported in PostgreSQL, which can be exploited by malicious users to gain escalated privileges and by malicious people to conduct spoofing attacks.

1) A vulnerability is caused due to an error when processing SSL certificates containing NULL characters embedded in certain certificate fields and can be exploited to spoof certificates for legitimate domains.

2) A vulnerability is caused due to an error when handling session state changes in an index function, which can be exploited to gain escalated privileges.

This is related to:
SA28359
SA36660

The vulnerabilities are reported in versions 7.4, 8.0, 8.1, 8.2, 8.3, and 8.4.

Solution
Update to version 7.4.27, 8.0.23, 8.1.19, 8.2.15, 8.3.9, and 8.4.2.
Further details available in Customer Area

Provided and/or discovered by
Reported by the vendor.

Original Advisory
http://www.postgresql.org/support/security

Other references
Further details available in Customer Area

Deep Links
Links available in Customer Area