PostgreSQL 9.2.4 

This version fixes the following vulnerabilities:

* [CVE-2013-1899] - makes it possible for a connection request 
  containing a database name that begins with "-" to be crafted that can 
  damage or destroy files within a server's data directory. Anyone with 
  access to the port the PostgreSQL server listens on can initiate this 
  request.
* [CVE-2013-1900] - wherein random numbers generated by contrib/pgcrypto 
  functions may be easy for another database user to guess
* [CVE-2013-1901] - which mistakenly allows an unprivileged user to run 
  commands that could interfere with in-progress backups.

These issues are also addressed but only affect the graphical installers 
for Linux and Mac OS X:

* [CVE-2013-1902] - the use of predictable filenames in /tmp
* [CVE-2013-1903] - insecure passing of superuser passwords to a script

More details in the release announcement:
http://www.postgresql.org/about/news/1456/
Merge branch 'CHEF-4060'