Two vulnerabilities have been reported in PostgreSQL, which can be exploited by malicious people to disclose certain sensitive information and compromise a user's system.

1) An error within the "xml_parse()" function when parsing DTD data within XML documents can be exploited to read arbitrary files.

2) An error within the "xslt_process()" function when parsing XSLT style sheets can be exploited to e.g. create or overwrite arbitrary files.

The vulnerabilities are reported in versions prior to 9.1.5, 9.0.9, 8.4.13, and 8.3.20.

Solution
Update to version 9.1.5, 9.0.9, 8.4.13, or 8.3.20.

Provided and/or discovered by
Reported by the vendor.

Original Advisory
http://www.postgresql.org/about/news/1407/
http://www.postgresql.org/support/security/

Deep Links
Links available to Secunia VIM customers