<?xml version="1.0" encoding="UTF-8"?>
<cvrfdoc xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:cpe="http://cpe.mitre.org/language/2.0" xmlns:cvrf="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/cvrf" xmlns:cvrf-common="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/common" xmlns:cvssv2="http://scap.nist.gov/schema/cvss-v2/1.0" xmlns:cvssv3="https://www.first.org/cvss/cvss-v3.0.xsd" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:ns0="http://purl.org/dc/elements/1.1/" xmlns:prod="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/prod" xmlns:scap-core="http://scap.nist.gov/schema/scap-core/1.0" xmlns:sch="http://purl.oclc.org/dsdl/schematron" xmlns:vuln="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/cvrf">
  <DocumentTitle xml:lang="en">Security update for postgresql94</DocumentTitle>
  <DocumentType>SUSE Patch</DocumentType>
  <DocumentPublisher Type="Vendor">
    <ContactDetails>security@suse.de</ContactDetails>
    <IssuingAuthority>SUSE Security Team</IssuingAuthority>
  </DocumentPublisher>
  <DocumentTracking>
    <Identification>
      <ID>SUSE-SU-2017:1783-1</ID>
    </Identification>
    <Status>Final</Status>
    <Version>1</Version>
    <RevisionHistory>
      <Revision>
        <Number>1</Number>
        <Date>2017-07-05T14:17:54Z</Date>
        <Description>current</Description>
      </Revision>
    </RevisionHistory>
    <InitialReleaseDate>2017-07-05T14:17:54Z</InitialReleaseDate>
    <CurrentReleaseDate>2017-07-05T14:17:54Z</CurrentReleaseDate>
    <Generator>
      <Engine>cve-database/bin/generate-cvrf.pl</Engine>
      <Date>2017-02-24T01:00:00Z</Date>
    </Generator>
  </DocumentTracking>
  <DocumentNotes>
    <Note Title="Topic" Type="Summary" Ordinal="1" xml:lang="en">Security update for postgresql94</Note>
    <Note Title="Details" Type="General" Ordinal="2" xml:lang="en">
This update for postgresql93 fixes the following issues:

- bsc#1029547: Fix tests with timezone 2017a 
- CVE-2017-7486: Restrict visibility of
    pg_user_mappings.umoptions, to protect passwords stored as
    user mapping options. (bsc#1037624) 
- CVE-2017-7485: Recognize PGREQUIRESSL variable again. (bsc#1038293)
- CVE-2017-7484: Prevent exposure of statistical information via leaky operators. (bsc#1037603)
</Note>
    <Note Title="Terms of Use" Type="Legal Disclaimer" Ordinal="3" xml:lang="en">The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).</Note>
    <Note Title="Patchnames" Type="Details" Ordinal="4" xml:lang="en">sdksp4-postgresql94-13196,slessp4-postgresql94-13196</Note>
  </DocumentNotes>
  <DocumentDistribution xml:lang="en">Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0)</DocumentDistribution>
  <DocumentReferences>
    <Reference Type="Self">
      <URL>https://www.suse.com/support/update/announcement/2017/suse-su-20171783-1/</URL>
      <Description>Link for SUSE-SU-2017:1783-1</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://lists.suse.com/pipermail/sle-security-updates/2017-July/003010.html</URL>
      <Description>E-Mail link for SUSE-SU-2017:1783-1</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/support/security/rating/</URL>
      <Description>SUSE Security Ratings</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1029547</URL>
      <Description>SUSE Bug 1029547</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1037603</URL>
      <Description>SUSE Bug 1037603</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1037624</URL>
      <Description>SUSE Bug 1037624</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1038293</URL>
      <Description>SUSE Bug 1038293</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/security/cve/CVE-2017-7484/</URL>
      <Description>SUSE CVE CVE-2017-7484 page</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/security/cve/CVE-2017-7485/</URL>
      <Description>SUSE CVE CVE-2017-7485 page</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/security/cve/CVE-2017-7486/</URL>
      <Description>SUSE CVE CVE-2017-7486 page</Description>
    </Reference>
  </DocumentReferences>
  <ProductTree xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/prod">
    <Branch Type="Product Family" Name="SUSE Linux Enterprise Server 11 SP4">
      <Branch Type="Product Name" Name="SUSE Linux Enterprise Server 11 SP4">
        <FullProductName ProductID="SUSE Linux Enterprise Server 11 SP4" CPE="cpe:/o:suse:suse_sles:11:sp4">SUSE Linux Enterprise Server 11 SP4</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Family" Name="SUSE Linux Enterprise Server for SAP Applications 11 SP4">
      <Branch Type="Product Name" Name="SUSE Linux Enterprise Server for SAP Applications 11 SP4">
        <FullProductName ProductID="SUSE Linux Enterprise Server for SAP Applications 11 SP4" CPE="cpe:/o:suse:sles_sap:11:sp4">SUSE Linux Enterprise Server for SAP Applications 11 SP4</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Family" Name="SUSE Linux Enterprise Software Development Kit 11 SP4">
      <Branch Type="Product Name" Name="SUSE Linux Enterprise Software Development Kit 11 SP4">
        <FullProductName ProductID="SUSE Linux Enterprise Software Development Kit 11 SP4" CPE="cpe:/a:suse:sle-sdk:11:sp4">SUSE Linux Enterprise Software Development Kit 11 SP4</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Version" Name="postgresql94-devel-9.4.12-0.22.3">
      <FullProductName ProductID="postgresql94-devel-9.4.12-0.22.3">postgresql94-devel-9.4.12-0.22.3</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="libecpg6-9.4.12-0.22.3">
      <FullProductName ProductID="libecpg6-9.4.12-0.22.3">libecpg6-9.4.12-0.22.3</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="libpq5-9.4.12-0.22.3">
      <FullProductName ProductID="libpq5-9.4.12-0.22.3">libpq5-9.4.12-0.22.3</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="libpq5-32bit-9.4.12-0.22.3">
      <FullProductName ProductID="libpq5-32bit-9.4.12-0.22.3">libpq5-32bit-9.4.12-0.22.3</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="postgresql94-9.4.12-0.22.3">
      <FullProductName ProductID="postgresql94-9.4.12-0.22.3">postgresql94-9.4.12-0.22.3</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="postgresql94-contrib-9.4.12-0.22.3">
      <FullProductName ProductID="postgresql94-contrib-9.4.12-0.22.3">postgresql94-contrib-9.4.12-0.22.3</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="postgresql94-docs-9.4.12-0.22.3">
      <FullProductName ProductID="postgresql94-docs-9.4.12-0.22.3">postgresql94-docs-9.4.12-0.22.3</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="postgresql94-server-9.4.12-0.22.3">
      <FullProductName ProductID="postgresql94-server-9.4.12-0.22.3">postgresql94-server-9.4.12-0.22.3</FullProductName>
    </Branch>
    <Relationship ProductReference="libecpg6-9.4.12-0.22.3" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server 11 SP4">
      <FullProductName ProductID="SUSE Linux Enterprise Server 11 SP4:libecpg6-9.4.12-0.22.3">libecpg6-9.4.12-0.22.3 as a component of SUSE Linux Enterprise Server 11 SP4</FullProductName>
    </Relationship>
    <Relationship ProductReference="libpq5-9.4.12-0.22.3" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server 11 SP4">
      <FullProductName ProductID="SUSE Linux Enterprise Server 11 SP4:libpq5-9.4.12-0.22.3">libpq5-9.4.12-0.22.3 as a component of SUSE Linux Enterprise Server 11 SP4</FullProductName>
    </Relationship>
    <Relationship ProductReference="libpq5-32bit-9.4.12-0.22.3" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server 11 SP4">
      <FullProductName ProductID="SUSE Linux Enterprise Server 11 SP4:libpq5-32bit-9.4.12-0.22.3">libpq5-32bit-9.4.12-0.22.3 as a component of SUSE Linux Enterprise Server 11 SP4</FullProductName>
    </Relationship>
    <Relationship ProductReference="postgresql94-9.4.12-0.22.3" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server 11 SP4">
      <FullProductName ProductID="SUSE Linux Enterprise Server 11 SP4:postgresql94-9.4.12-0.22.3">postgresql94-9.4.12-0.22.3 as a component of SUSE Linux Enterprise Server 11 SP4</FullProductName>
    </Relationship>
    <Relationship ProductReference="postgresql94-contrib-9.4.12-0.22.3" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server 11 SP4">
      <FullProductName ProductID="SUSE Linux Enterprise Server 11 SP4:postgresql94-contrib-9.4.12-0.22.3">postgresql94-contrib-9.4.12-0.22.3 as a component of SUSE Linux Enterprise Server 11 SP4</FullProductName>
    </Relationship>
    <Relationship ProductReference="postgresql94-docs-9.4.12-0.22.3" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server 11 SP4">
      <FullProductName ProductID="SUSE Linux Enterprise Server 11 SP4:postgresql94-docs-9.4.12-0.22.3">postgresql94-docs-9.4.12-0.22.3 as a component of SUSE Linux Enterprise Server 11 SP4</FullProductName>
    </Relationship>
    <Relationship ProductReference="postgresql94-server-9.4.12-0.22.3" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server 11 SP4">
      <FullProductName ProductID="SUSE Linux Enterprise Server 11 SP4:postgresql94-server-9.4.12-0.22.3">postgresql94-server-9.4.12-0.22.3 as a component of SUSE Linux Enterprise Server 11 SP4</FullProductName>
    </Relationship>
    <Relationship ProductReference="libecpg6-9.4.12-0.22.3" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server for SAP Applications 11 SP4">
      <FullProductName ProductID="SUSE Linux Enterprise Server for SAP Applications 11 SP4:libecpg6-9.4.12-0.22.3">libecpg6-9.4.12-0.22.3 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4</FullProductName>
    </Relationship>
    <Relationship ProductReference="libpq5-9.4.12-0.22.3" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server for SAP Applications 11 SP4">
      <FullProductName ProductID="SUSE Linux Enterprise Server for SAP Applications 11 SP4:libpq5-9.4.12-0.22.3">libpq5-9.4.12-0.22.3 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4</FullProductName>
    </Relationship>
    <Relationship ProductReference="libpq5-32bit-9.4.12-0.22.3" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server for SAP Applications 11 SP4">
      <FullProductName ProductID="SUSE Linux Enterprise Server for SAP Applications 11 SP4:libpq5-32bit-9.4.12-0.22.3">libpq5-32bit-9.4.12-0.22.3 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4</FullProductName>
    </Relationship>
    <Relationship ProductReference="postgresql94-9.4.12-0.22.3" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server for SAP Applications 11 SP4">
      <FullProductName ProductID="SUSE Linux Enterprise Server for SAP Applications 11 SP4:postgresql94-9.4.12-0.22.3">postgresql94-9.4.12-0.22.3 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4</FullProductName>
    </Relationship>
    <Relationship ProductReference="postgresql94-contrib-9.4.12-0.22.3" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server for SAP Applications 11 SP4">
      <FullProductName ProductID="SUSE Linux Enterprise Server for SAP Applications 11 SP4:postgresql94-contrib-9.4.12-0.22.3">postgresql94-contrib-9.4.12-0.22.3 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4</FullProductName>
    </Relationship>
    <Relationship ProductReference="postgresql94-docs-9.4.12-0.22.3" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server for SAP Applications 11 SP4">
      <FullProductName ProductID="SUSE Linux Enterprise Server for SAP Applications 11 SP4:postgresql94-docs-9.4.12-0.22.3">postgresql94-docs-9.4.12-0.22.3 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4</FullProductName>
    </Relationship>
    <Relationship ProductReference="postgresql94-server-9.4.12-0.22.3" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server for SAP Applications 11 SP4">
      <FullProductName ProductID="SUSE Linux Enterprise Server for SAP Applications 11 SP4:postgresql94-server-9.4.12-0.22.3">postgresql94-server-9.4.12-0.22.3 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4</FullProductName>
    </Relationship>
    <Relationship ProductReference="postgresql94-devel-9.4.12-0.22.3" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Software Development Kit 11 SP4">
      <FullProductName ProductID="SUSE Linux Enterprise Software Development Kit 11 SP4:postgresql94-devel-9.4.12-0.22.3">postgresql94-devel-9.4.12-0.22.3 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4</FullProductName>
    </Relationship>
  </ProductTree>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="1">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">It was found that some selectivity estimation functions in PostgreSQL before 9.2.21, 9.3.x before 9.3.17, 9.4.x before 9.4.12, 9.5.x before 9.5.7, and 9.6.x before 9.6.3 did not check user privileges before providing information from pg_statistic, possibly leaking information. An unprivileged attacker could use this flaw to steal some information from tables they are otherwise not allowed to access.</Note>
    </Notes>
    <CVE>CVE-2017-7484</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>SUSE Linux Enterprise Server 11 SP4:libecpg6-9.4.12-0.22.3</ProductID>
        <ProductID>SUSE Linux Enterprise Server 11 SP4:libpq5-32bit-9.4.12-0.22.3</ProductID>
        <ProductID>SUSE Linux Enterprise Server 11 SP4:libpq5-9.4.12-0.22.3</ProductID>
        <ProductID>SUSE Linux Enterprise Server 11 SP4:postgresql94-9.4.12-0.22.3</ProductID>
        <ProductID>SUSE Linux Enterprise Server 11 SP4:postgresql94-contrib-9.4.12-0.22.3</ProductID>
        <ProductID>SUSE Linux Enterprise Server 11 SP4:postgresql94-docs-9.4.12-0.22.3</ProductID>
        <ProductID>SUSE Linux Enterprise Server 11 SP4:postgresql94-server-9.4.12-0.22.3</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 11 SP4:libecpg6-9.4.12-0.22.3</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 11 SP4:libpq5-32bit-9.4.12-0.22.3</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 11 SP4:libpq5-9.4.12-0.22.3</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 11 SP4:postgresql94-9.4.12-0.22.3</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 11 SP4:postgresql94-contrib-9.4.12-0.22.3</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 11 SP4:postgresql94-docs-9.4.12-0.22.3</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 11 SP4:postgresql94-server-9.4.12-0.22.3</ProductID>
        <ProductID>SUSE Linux Enterprise Software Development Kit 11 SP4:postgresql94-devel-9.4.12-0.22.3</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>low</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>3.5</BaseScoreV2>
        <VectorV2>AV:N/AC:M/Au:S/C:P/I:N/A:N</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>7.5</BaseScoreV3>
        <VectorV3>CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
</Description>
        <URL>https://www.suse.com/support/update/announcement/2017/suse-su-20171783-1/</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2017-7484.html</URL>
        <Description>CVE-2017-7484</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1037603</URL>
        <Description>SUSE Bug 1037603</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1051015</URL>
        <Description>SUSE Bug 1051015</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="2">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">In PostgreSQL 9.3.x before 9.3.17, 9.4.x before 9.4.12, 9.5.x before 9.5.7, and 9.6.x before 9.6.3, it was found that the PGREQUIRESSL environment variable was no longer enforcing a SSL/TLS connection to a PostgreSQL server. An active Man-in-the-Middle attacker could use this flaw to strip the SSL/TLS protection from a connection between a client and a server.</Note>
    </Notes>
    <CVE>CVE-2017-7485</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>SUSE Linux Enterprise Server 11 SP4:libecpg6-9.4.12-0.22.3</ProductID>
        <ProductID>SUSE Linux Enterprise Server 11 SP4:libpq5-32bit-9.4.12-0.22.3</ProductID>
        <ProductID>SUSE Linux Enterprise Server 11 SP4:libpq5-9.4.12-0.22.3</ProductID>
        <ProductID>SUSE Linux Enterprise Server 11 SP4:postgresql94-9.4.12-0.22.3</ProductID>
        <ProductID>SUSE Linux Enterprise Server 11 SP4:postgresql94-contrib-9.4.12-0.22.3</ProductID>
        <ProductID>SUSE Linux Enterprise Server 11 SP4:postgresql94-docs-9.4.12-0.22.3</ProductID>
        <ProductID>SUSE Linux Enterprise Server 11 SP4:postgresql94-server-9.4.12-0.22.3</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 11 SP4:libecpg6-9.4.12-0.22.3</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 11 SP4:libpq5-32bit-9.4.12-0.22.3</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 11 SP4:libpq5-9.4.12-0.22.3</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 11 SP4:postgresql94-9.4.12-0.22.3</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 11 SP4:postgresql94-contrib-9.4.12-0.22.3</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 11 SP4:postgresql94-docs-9.4.12-0.22.3</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 11 SP4:postgresql94-server-9.4.12-0.22.3</ProductID>
        <ProductID>SUSE Linux Enterprise Software Development Kit 11 SP4:postgresql94-devel-9.4.12-0.22.3</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>moderate</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>5.8</BaseScoreV2>
        <VectorV2>AV:N/AC:M/Au:N/C:P/I:P/A:N</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>5.9</BaseScoreV3>
        <VectorV3>CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
</Description>
        <URL>https://www.suse.com/support/update/announcement/2017/suse-su-20171783-1/</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2017-7485.html</URL>
        <Description>CVE-2017-7485</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1038293</URL>
        <Description>SUSE Bug 1038293</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1051015</URL>
        <Description>SUSE Bug 1051015</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="3">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">PostgreSQL versions 8.4 - 9.6 are vulnerable to information leak in pg_user_mappings view which discloses foreign server passwords to any user having USAGE privilege on the associated foreign server.</Note>
    </Notes>
    <CVE>CVE-2017-7486</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>SUSE Linux Enterprise Server 11 SP4:libecpg6-9.4.12-0.22.3</ProductID>
        <ProductID>SUSE Linux Enterprise Server 11 SP4:libpq5-32bit-9.4.12-0.22.3</ProductID>
        <ProductID>SUSE Linux Enterprise Server 11 SP4:libpq5-9.4.12-0.22.3</ProductID>
        <ProductID>SUSE Linux Enterprise Server 11 SP4:postgresql94-9.4.12-0.22.3</ProductID>
        <ProductID>SUSE Linux Enterprise Server 11 SP4:postgresql94-contrib-9.4.12-0.22.3</ProductID>
        <ProductID>SUSE Linux Enterprise Server 11 SP4:postgresql94-docs-9.4.12-0.22.3</ProductID>
        <ProductID>SUSE Linux Enterprise Server 11 SP4:postgresql94-server-9.4.12-0.22.3</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 11 SP4:libecpg6-9.4.12-0.22.3</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 11 SP4:libpq5-32bit-9.4.12-0.22.3</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 11 SP4:libpq5-9.4.12-0.22.3</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 11 SP4:postgresql94-9.4.12-0.22.3</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 11 SP4:postgresql94-contrib-9.4.12-0.22.3</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 11 SP4:postgresql94-docs-9.4.12-0.22.3</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 11 SP4:postgresql94-server-9.4.12-0.22.3</ProductID>
        <ProductID>SUSE Linux Enterprise Software Development Kit 11 SP4:postgresql94-devel-9.4.12-0.22.3</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>low</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>3.5</BaseScoreV2>
        <VectorV2>AV:N/AC:M/Au:S/C:P/I:N/A:N</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>7.5</BaseScoreV3>
        <VectorV3>CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
</Description>
        <URL>https://www.suse.com/support/update/announcement/2017/suse-su-20171783-1/</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2017-7486.html</URL>
        <Description>CVE-2017-7486</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1037624</URL>
        <Description>SUSE Bug 1037624</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1051015</URL>
        <Description>SUSE Bug 1051015</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1051685</URL>
        <Description>SUSE Bug 1051685</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
</cvrfdoc>
