The Rocky Linux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_0478 advisory.

    This advisory aggregates security fixes for the postgresql SRPM in CIQ LTS 9.2. It addresses 34 CVEs:
    CVE-2007-0555, CVE-2025-8714, CVE-2012-2655, CVE-2007-6067, CVE-2012-0867, and 29 more.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An array index error, leading to a heap-based out-of-bounds buffer read flaw, was found in the way PostgreSQL performed certain error processing using enumeration types. An unprivileged database user could issue a specially crafted SQL query that, when processed by the server component of the PostgreSQL service, would lead to a denial of service (daemon crash) or disclosure of certain portions of server memory. (CVE-2013-0255)

A flaw was found in the way the pgcrypto contrib module of PostgreSQL (re)initialized its internal random number generator. This could lead to random numbers with less bits of entropy being used by certain pgcrypto functions, possibly allowing an attacker to conduct other attacks. (CVE-2013-1900)

These updated packages upgrade PostgreSQL to version 8.4.18, which fixes these issues as well as several non-security issues. Refer to the PostgreSQL Release Notes for a full list of changes :

http://www.postgresql.org/docs/8.4/static/release-8-4-18.html

After installing this update, it is advisable to rebuild, using the REINDEX command, Generalized Search Tree (GiST) indexes that meet one or more of the following conditions :

    - GiST indexes on box, polygon, circle, or point columns

    - GiST indexes for variable-width data types, that is       text, bytea, bit, and numeric

    - GiST multi-column indexes

If the postgresql service is running, it will be automatically restarted after installing this update.

The remote MiracleLinux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2014-004:01 advisory.

    PostgreSQL is an advanced Object-Relational database management system (DBMS) that supports almost all SQL     constructs (including transactions, subselects and user-defined types and functions). The postgresql     package includes the client programs and libraries that you'll need to access a PostgreSQL DBMS server.
    These PostgreSQL client programs are programs that directly manipulate the internal structure of     PostgreSQL databases on a PostgreSQL server. These client programs can be located on the same machine with     the PostgreSQL server, or may be on a remote machine which accesses a PostgreSQL server over a network     connection. This package contains the docs in HTML for the whole package, as well as command-line     utilities for managing PostgreSQL databases on a PostgreSQL server.
    If you want to manipulate a PostgreSQL database on a local or remote PostgreSQL server, you need this     package. You also need to install this package if you're installing the postgresql-server package.
    Security issues fixed with this release:
     CVE-2013-0255     PostgreSQL 9.2.x before 9.2.3, 9.1.x before 9.1.8, 9.0.x before 9.0.12, 8.4.x before 8.4.16, and 8.3.x     before 8.3.23 does not properly declare the enum_recv function in backend/utils/adt/enum.c, which causes     it to be invoked with incorrect arguments and allows remote authenticated users to cause a denial of     service (server crash) or read sensitive process memory via a crafted SQL command, which triggers an array     index error and an out-of-bounds read.
     CVE-2013-1900      PostgreSQL 9.2.x before 9.2.4, 9.1.x before 9.1.9, 9.0.x before 9.0.13, and 8.4.x before 8.4.17, when     using OpenSSL, generates insufficiently random numbers, which might allow remote authenticated users to     have an unspecified impact via vectors related to the contrib/pgcrypto functions.
     CVE-2014-0060      CVE-2014-0061      CVE-2014-0062      CVE-2014-0063      CVE-2014-0064      CVE-2014-0065      CVE-2014-0066     No information available at the time of writing, please refer to the CVE links below.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - PostgreSQL 9.2.x before 9.2.4, 9.1.x before 9.1.9, 9.0.x before 9.0.13, and 8.4.x before 8.4.17, when     using OpenSSL, generates insufficiently random numbers, which might allow remote authenticated users to     have an unspecified impact via vectors related to the contrib/pgcrypto functions. (CVE-2013-1900)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote host is running a version of Mac OS X 10.8.x that is prior to 10.8.5. The newer version contains multiple security-related fixes for the following components :

  - Apache
  - Bind
  - Certificate Trust Policy
  - CoreGraphics
  - ImageIO
  - Installer
  - IPSec
  - Kernel
  - Mobile Device Management
  - OpenSSL
  - PHP
  - PostgreSQL
  - Power Management
  - QuickTime
  - Screen Lock
  - sudo

This update also addresses an issue in which certain Unicode strings could cause applications to unexpectedly quit.

Note that successful exploitation of the most serious issues could result in arbitrary code execution.

The remote Mac OS X 10.8 host has a version of OS X Server installed that is prior to 2.2.2. It is, therefore, affected by the following vulnerabilities :

  - Two vulnerabilities exist in the included ClamAV     software, the most serious of which could allow an     attacker to execute arbitrary code remotely.
    (CVE-2013-2020 / CVE-2013-2021)

  - Three vulnerabilities exist in the included PostgreSQL     software, the most serious of which could result in     data corruption or privilege escalation.
    (CVE-2013-1899 / CVE-2013-1900 / CVE-2013-1901)

  - Multiple cross-site scripting issues exist in the     included Wiki Server software (CVE-2013-1034)

Multiple vulnerabilities has been discovered and corrected in postgresql :

PostgreSQL 9.2.x before 9.2.3, 9.1.x before 9.1.8, 9.0.x before 9.0.12, 8.4.x before 8.4.16, and 8.3.x before 8.3.23 does not properly declare the enum_recv function in backend/utils/adt/enum.c, which causes it to be invoked with incorrect arguments and allows remote authenticated users to cause a denial of service (server crash) or read sensitive process memory via a crafted SQL command, which triggers an array index error and an out-of-bounds read (CVE-2013-0255).

Argument injection vulnerability in PostgreSQL 9.2.x before 9.2.4, 9.1.x before 9.1.9, and 9.0.x before 9.0.13 allows remote attackers to cause a denial of service (file corruption), and allows remote authenticated users to modify configuration settings and execute arbitrary code, via a connection request using a database name that begins with a - (hyphen) (CVE-2013-1899).

PostgreSQL 9.2.x before 9.2.4, 9.1.x before 9.1.9, 9.0.x before 9.0.13, and 8.4.x before 8.4.17, when using OpenSSL, generates insufficiently random numbers, which might allow remote authenticated users to have an unspecified impact via vectors related to the contrib/pgcrypto functions. (CVE-2013-1900).

PostgreSQL 9.2.x before 9.2.4 and 9.1.x before 9.1.9 does not properly check REPLICATION privileges, which allows remote authenticated users to bypass intended backup restrictions by calling the (1) pg_start_backup or (2) pg_stop_backup functions (CVE-2013-1901).

This advisory provides the latest versions of PostgreSQL that is not vulnerable to these issues.

The Rocky Linux 8.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_1609 advisory.

    This advisory aggregates security fixes for the postgresql SRPM in CIQ LTS 8.6. It addresses 31 CVEs:
    CVE-2021-32027, CVE-2012-3489, CVE-2007-0555, CVE-2021-23214, CVE-2021-32028, and 26 more.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
356309	Rocky Linux 9.2 [CIQ] Security Update: postgresql / postgresql-contrib / postgresql-contrib-debuginfo / etc Multiple Vulnerabilities (ciqsa-2026_0478)	Nessus	Rocky Linux Local Security Checks	10/1/2026	10/12/2026	high
70705	Scientific Linux Security Update : postgresql and postgresql84 on SL5.x, SL6.x i386/x86_64 (20131029)	Nessus	Scientific Linux Local Security Checks	10/31/2013	1/14/2021	high
289665	MiracleLinux 4 : postgresql-8.4.20-1.AXS4 (AXSA:2014-004:01)	Nessus	Miracle Linux Local Security Checks	1/16/2026	1/16/2026	critical
217967	Linux Distros Unpatched Vulnerability : CVE-2013-1900	Nessus	Misc.	3/4/2025	1/28/2026	critical
69877	Mac OS X 10.8.x < 10.8.5 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	9/13/2013	5/28/2024	critical
69932	Mac OS X : OS X Server < 2.2.2 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	9/17/2013	7/14/2018	high
66154	Mandriva Linux Security Advisory : postgresql (MDVSA-2013:142)	Nessus	Mandriva Local Security Checks	4/20/2013	1/6/2021	high
364612	Rocky Linux 8.6 [CIQ] Security Update: postgresql / postgresql-contrib / postgresql-docs / etc Multiple Vulnerabilities (ciqsa-2026_1609)	Nessus	Rocky Linux Local Security Checks	10/12/2026	10/12/2026	high

Detections

Analytics

Plugins Search

high

high

critical

critical

critical

high

high

high