Last-minute updates for release notes.

Security: CVE-2019-10129, CVE-2019-10130

diff --git a/doc/src/sgml/release-9.4.sgml b/doc/src/sgml/release-9.4.sgml
index c55c194266a5dbf3ff8e868f9937f672da0f05d5..9bec0bf5589e669b671e00461db024e5dd8c8ff3 100644 (file)
--- a/doc/src/sgml/release-9.4.sgml
+++ b/doc/src/sgml/release-9.4.sgml
@@ -159,6 +159,23 @@
      
     
 
+    
+     
+      Check the appropriate user's permissions when enforcing rules about
+      letting a leaky operator see pg_statistic
+      data (Dean Rasheed)
+     
+
+     
+      When an underlying table is being accessed via a view, consider the
+      privileges of the view owner while deciding whether leaky operators
+      may be applied to the table's statistics data, rather than the
+      privileges of the user making the query.  This makes the planner's
+      rules about what data is visible match up with the executor's,
+      avoiding unnecessarily-poor plans.
+     
+    
+
     
      
       Avoid O(N^2) performance issue when rolling back a transaction that