Synopsis: Moderate: postgresql security update Advisory ID: SLSA-2017:3402-1 Issue Date: 2017-12-19 CVE Numbers: CVE-2017-12172 CVE-2017-15097 -- Security Fix(es): * Privilege escalation flaws were found in the initialization scripts of PostgreSQL. An attacker with access to the postgres user account could use these flaws to obtain root access on the server machine. (CVE-2017-12172, CVE-2017-15097) Note: This patch drops the script privileges from root to the postgres user. Therefore, this update works properly only if the postgres user has write access to the postgres' home directory, such as the one in the default configuration (/var/lib/pgsql). -- SL7 x86_64 postgresql-debuginfo-9.2.23-3.el7_4.i686.rpm postgresql-debuginfo-9.2.23-3.el7_4.x86_64.rpm postgresql-libs-9.2.23-3.el7_4.i686.rpm postgresql-libs-9.2.23-3.el7_4.x86_64.rpm postgresql-9.2.23-3.el7_4.i686.rpm postgresql-9.2.23-3.el7_4.x86_64.rpm postgresql-contrib-9.2.23-3.el7_4.x86_64.rpm postgresql-devel-9.2.23-3.el7_4.i686.rpm postgresql-devel-9.2.23-3.el7_4.x86_64.rpm postgresql-docs-9.2.23-3.el7_4.x86_64.rpm postgresql-plperl-9.2.23-3.el7_4.x86_64.rpm postgresql-plpython-9.2.23-3.el7_4.x86_64.rpm postgresql-pltcl-9.2.23-3.el7_4.x86_64.rpm postgresql-server-9.2.23-3.el7_4.x86_64.rpm postgresql-static-9.2.23-3.el7_4.i686.rpm postgresql-static-9.2.23-3.el7_4.x86_64.rpm postgresql-test-9.2.23-3.el7_4.x86_64.rpm postgresql-upgrade-9.2.23-3.el7_4.x86_64.rpm postgresql-9.2.23-3.el7_4.src.rpm - Scientific Linux Development Team