CVE-2012-3489

Published: Oct 3, 2012Modified: Apr 29, 2026

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Exploitability: 2.8 / Impact: 3.6

Source: NVD

Description

The xml_parse function in the libxml2 support in the core server component in PostgreSQL 8.3 before 8.3.20, 8.4 before 8.4.13, 9.0 before 9.0.9, and 9.1 before 9.1.5 allows remote authenticated users to determine the existence of arbitrary files or URLs, and possibly obtain file or URL content that triggers a parsing error, via an XML value that refers to (1) a DTD or (2) an entity, related to an XML External Entity (aka XXE) issue.

Affected (22)

Products: Postgresql: Postgresql · Opensuse: Opensuse · Apple: Mac Os X Server · +3 more

Show all products

Postgresql: Postgresql · Opensuse: Opensuse · Apple: Mac Os X Server · Canonical: Ubuntu Linux · Debian: Debian Linux · Redhat: Enterprise Linux Desktop, Enterprise Linux Eus, Enterprise Linux Server, Enterprise Linux Workstation

1 product

1 product

1 product

1 product

1 product

4 products

Enterprise Linux Desktop

Enterprise Linux Eus

Enterprise Linux Server

Enterprise Linux Workstation

Configuration A

4 vulnerable

Vulnerable Software	Affected Versions
Postgresql Postgresql	From 8.3.0 to 8.3.20
Postgresql Postgresql	From 8.4.0 to 8.4.13
Postgresql Postgresql	From 9.0.0 to 9.0.9
Postgresql Postgresql	From 9.1.0 to 9.1.5

Configuration B

3 vulnerable

Vulnerable Software	Affected Versions
Opensuse Opensuse	Version 11.4
Opensuse Opensuse	Version 12.1
Opensuse Opensuse	Version 12.2

Configuration C

2 vulnerable

Vulnerable Software	Affected Versions
Apple Mac Os X Server	From 10.7.0 to 10.7.5
Apple Mac Os X Server	Version 10.6.8

Configuration D

5 vulnerable

Vulnerable Software	Affected Versions
Canonical Ubuntu Linux	Version 10.04
Canonical Ubuntu Linux	Version 11.04
Canonical Ubuntu Linux	Version 11.10
Canonical Ubuntu Linux	Version 12.04
Canonical Ubuntu Linux	Version 8.04

Configuration E

1 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 6.0

Configuration F

7 vulnerable

Vulnerable Software	Affected Versions
Redhat Enterprise Linux Desktop	Version 5.0
Redhat Enterprise Linux Desktop	Version 6.0
Redhat Enterprise Linux Eus	Version 6.3
Redhat Enterprise Linux Server	Version 5.0
Redhat Enterprise Linux Server	Version 6.0
Redhat Enterprise Linux Workstation	Version 5.0
Redhat Enterprise Linux Workstation	Version 6.0

Related CWEs

CWE-611

Improper Restriction of XML External Entity Reference

The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

References (42)

http://lists.apple.com/archives/security-announce/2013/Mar/msg00002.html

Source: secalert@redhat.com

Mailing List

http://lists.opensuse.org/opensuse-updates/2012-09/msg00102.html

Source: secalert@redhat.com

Mailing List

http://lists.opensuse.org/opensuse-updates/2012-10/msg00013.html

Source: secalert@redhat.com

Mailing List

http://lists.opensuse.org/opensuse-updates/2012-10/msg00024.html

Source: secalert@redhat.com

Mailing List

http://rhn.redhat.com/errata/RHSA-2012-1263.html

Source: secalert@redhat.com

Third Party Advisory

http://secunia.com/advisories/50635

Source: secalert@redhat.com

Broken Link

http://secunia.com/advisories/50718

Source: secalert@redhat.com

Broken Link

http://secunia.com/advisories/50859

Source: secalert@redhat.com

Broken Link

http://secunia.com/advisories/50946

Source: secalert@redhat.com

Broken Link

http://www.debian.org/security/2012/dsa-2534

Source: secalert@redhat.com

Mailing List

http://www.mandriva.com/security/advisories?name=MDVSA-2012:139

Source: secalert@redhat.com

Broken Link

http://www.postgresql.org/about/news/1407/

Source: secalert@redhat.com

Vendor Advisory

http://www.postgresql.org/docs/8.3/static/release-8-3-20.html

Source: secalert@redhat.com

Release Notes

http://www.postgresql.org/docs/8.4/static/release-8-4-13.html

Source: secalert@redhat.com

Release Notes

http://www.postgresql.org/docs/9.0/static/release-9-0-9.html

Source: secalert@redhat.com

Release Notes

http://www.postgresql.org/docs/9.1/static/release-9-1-5.html

Source: secalert@redhat.com

Release Notes

http://www.postgresql.org/support/security/

Source: secalert@redhat.com

Release NotesVendor Advisory

http://www.securityfocus.com/bid/55074

Source: secalert@redhat.com

Broken LinkThird Party AdvisoryVDB Entry

http://www.ubuntu.com/usn/USN-1542-1

Source: secalert@redhat.com

Third Party Advisory

https://blogs.oracle.com/sunsecurity/entry/multiple_vulnerabilities_in_postgresql2

Source: secalert@redhat.com

Third Party Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=849173

Source: secalert@redhat.com

Issue TrackingPatchRelease Notes

http://lists.apple.com/archives/security-announce/2013/Mar/msg00002.html