PostgreSQL -- anonymous remote access data corruption vulnerability

PostgreSQL project reports:

   The PostgreSQL Global Development Group has released a security
   update to all current versions of the PostgreSQL database system,
   including versions 9.2.4, 9.1.9, 9.0.13, and 8.4.17. This update
   fixes a high-exposure security vulnerability in versions 9.0 and
   later. All users of the affected versions are strongly urged to apply
   the update *immediately*.
  

   A major security issue (for versions 9.x only) fixed in this release,
   [CVE-2013-1899](https://vulners.com/cve/CVE-2013-1899),
   makes it possible for a connection request containing a database name
   that begins with "-" to be crafted that can damage or destroy files
   within a server's data directory. Anyone with access to the port the
   PostgreSQL server listens on can initiate this request. This issue was
   discovered by Mitsumasa Kondo and Kyotaro Horiguchi of NTT Open Source
   Software Center.
  

   Two lesser security fixes are also included in this release:
   [CVE-2013-1900](https://vulners.com/cve/CVE-2013-1900),
   wherein random numbers generated by contrib/pgcrypto functions may be
   easy for another database user to guess (all versions), and
   [CVE-2013-1901](https://vulners.com/cve/CVE-2013-1901),
   which mistakenly allows an unprivileged user to run commands that
   could interfere with in-progress backups (for versions 9.x only).