CVEvulnerability

CVE-2012-3489

6.5 MEDIUM Published 2012-10-03 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2012-10-03
Last modified
2026-06-16
Assigner
[email protected]
CVSS 3.1 ([email protected])
6.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0 ([email protected])
4.0 MEDIUM — AV:N/AC:L/Au:S/C:P/I:N/A:N
Weaknesses
CWE-611

Description

The xml_parse function in the libxml2 support in the core server component in PostgreSQL 8.3 before 8.3.20, 8.4 before 8.4.13, 9.0 before 9.0.9, and 9.1 before 9.1.5 allows remote authenticated users to determine the existence of arbitrary files or URLs, and possibly obtain file or URL content that triggers a parsing error, via an XML value that refers to (1) a DTD or (2) an entity, related to an XML External Entity (aka XXE) issue.

Affected configurations

• postgresql postgresql (>= 8.3.0 < 8.3.20) • postgresql postgresql (>= 8.4.0 < 8.4.13) • postgresql postgresql (>= 9.0.0 < 9.0.9) • postgresql postgresql (>= 9.1.0 < 9.1.5) • opensuse opensuse 11.4 • opensuse opensuse 12.1 • opensuse opensuse 12.2 • apple mac os x server (>= 10.7.0 <= 10.7.5) • apple mac os x server 10.6.8 • canonical ubuntu linux 8.04 • canonical ubuntu linux 10.04 • canonical ubuntu linux 11.04 • canonical ubuntu linux 11.10 • canonical ubuntu linux 12.04 • debian debian linux 6.0 • redhat enterprise linux desktop 5.0 • redhat enterprise linux desktop 6.0 • redhat enterprise linux eus 6.3 • redhat enterprise linux server 5.0 • redhat enterprise linux server 6.0 • redhat enterprise linux workstation 5.0 • redhat enterprise linux workstation 6.0

Related

Weakness · CWE (1)

  • CWE-611 Improper Restriction of XML External Entity Reference weakness

Referenced by CWE · observed example (1)

  • CWE-611 Improper Restriction of XML External Entity Reference weakness

References