1. CVE-Search
  2. CVE-2012-3489
ID CVE-2012-3489
Summary The xml_parse function in the libxml2 support in the core server component in PostgreSQL 8.3 before 8.3.20, 8.4 before 8.4.13, 9.0 before 9.0.9, and 9.1 before 9.1.5 allows remote authenticated users to determine the existence of arbitrary files or URLs, and possibly obtain file or URL content that triggers a parsing error, via an XML value that refers to (1) a DTD or (2) an entity, related to an XML External Entity (aka XXE) issue.
References
Vulnerable Configurations
  • cpe:2.3:a:postgresql:postgresql:8.3.0:*:*:*:*:*:*:*
    cpe:2.3:a:postgresql:postgresql:8.3.0:*:*:*:*:*:*:*
  • cpe:2.3:a:postgresql:postgresql:8.3.1:*:*:*:*:*:*:*
    cpe:2.3:a:postgresql:postgresql:8.3.1:*:*:*:*:*:*:*
  • cpe:2.3:a:postgresql:postgresql:8.3.2:*:*:*:*:*:*:*
    cpe:2.3:a:postgresql:postgresql:8.3.2:*:*:*:*:*:*:*
  • cpe:2.3:a:postgresql:postgresql:8.3.3:*:*:*:*:*:*:*
    cpe:2.3:a:postgresql:postgresql:8.3.3:*:*:*:*:*:*:*
  • cpe:2.3:a:postgresql:postgresql:8.3.4:*:*:*:*:*:*:*
    cpe:2.3:a:postgresql:postgresql:8.3.4:*:*:*:*:*:*:*
  • cpe:2.3:a:postgresql:postgresql:8.3.5:*:*:*:*:*:*:*
    cpe:2.3:a:postgresql:postgresql:8.3.5:*:*:*:*:*:*:*
  • cpe:2.3:a:postgresql:postgresql:8.3.6:*:*:*:*:*:*:*
    cpe:2.3:a:postgresql:postgresql:8.3.6:*:*:*:*:*:*:*
  • cpe:2.3:a:postgresql:postgresql:8.3.7:*:*:*:*:*:*:*
    cpe:2.3:a:postgresql:postgresql:8.3.7:*:*:*:*:*:*:*
  • cpe:2.3:a:postgresql:postgresql:8.3.8:*:*:*:*:*:*:*
    cpe:2.3:a:postgresql:postgresql:8.3.8:*:*:*:*:*:*:*
  • cpe:2.3:a:postgresql:postgresql:8.3.9:*:*:*:*:*:*:*
    cpe:2.3:a:postgresql:postgresql:8.3.9:*:*:*:*:*:*:*
  • cpe:2.3:a:postgresql:postgresql:8.3.10:*:*:*:*:*:*:*
    cpe:2.3:a:postgresql:postgresql:8.3.10:*:*:*:*:*:*:*
  • cpe:2.3:a:postgresql:postgresql:8.3.11:*:*:*:*:*:*:*
    cpe:2.3:a:postgresql:postgresql:8.3.11:*:*:*:*:*:*:*
  • cpe:2.3:a:postgresql:postgresql:8.3.12:*:*:*:*:*:*:*
    cpe:2.3:a:postgresql:postgresql:8.3.12:*:*:*:*:*:*:*
  • cpe:2.3:a:postgresql:postgresql:8.3.13:*:*:*:*:*:*:*
    cpe:2.3:a:postgresql:postgresql:8.3.13:*:*:*:*:*:*:*
  • cpe:2.3:a:postgresql:postgresql:8.3.14:*:*:*:*:*:*:*
    cpe:2.3:a:postgresql:postgresql:8.3.14:*:*:*:*:*:*:*
  • cpe:2.3:a:postgresql:postgresql:8.3.15:*:*:*:*:*:*:*
    cpe:2.3:a:postgresql:postgresql:8.3.15:*:*:*:*:*:*:*
  • cpe:2.3:a:postgresql:postgresql:8.3.16:*:*:*:*:*:*:*
    cpe:2.3:a:postgresql:postgresql:8.3.16:*:*:*:*:*:*:*
  • cpe:2.3:a:postgresql:postgresql:8.3.17:*:*:*:*:*:*:*
    cpe:2.3:a:postgresql:postgresql:8.3.17:*:*:*:*:*:*:*
  • cpe:2.3:a:postgresql:postgresql:8.3.18:*:*:*:*:*:*:*
    cpe:2.3:a:postgresql:postgresql:8.3.18:*:*:*:*:*:*:*
  • cpe:2.3:a:postgresql:postgresql:8.3.19:*:*:*:*:*:*:*
    cpe:2.3:a:postgresql:postgresql:8.3.19:*:*:*:*:*:*:*
  • cpe:2.3:a:postgresql:postgresql:8.4.0:*:*:*:*:*:*:*
    cpe:2.3:a:postgresql:postgresql:8.4.0:*:*:*:*:*:*:*
  • cpe:2.3:a:postgresql:postgresql:8.4.1:*:*:*:*:*:*:*
    cpe:2.3:a:postgresql:postgresql:8.4.1:*:*:*:*:*:*:*
  • cpe:2.3:a:postgresql:postgresql:8.4.2:*:*:*:*:*:*:*
    cpe:2.3:a:postgresql:postgresql:8.4.2:*:*:*:*:*:*:*
  • cpe:2.3:a:postgresql:postgresql:8.4.3:*:*:*:*:*:*:*
    cpe:2.3:a:postgresql:postgresql:8.4.3:*:*:*:*:*:*:*
  • cpe:2.3:a:postgresql:postgresql:8.4.4:*:*:*:*:*:*:*
    cpe:2.3:a:postgresql:postgresql:8.4.4:*:*:*:*:*:*:*
  • cpe:2.3:a:postgresql:postgresql:8.4.5:*:*:*:*:*:*:*
    cpe:2.3:a:postgresql:postgresql:8.4.5:*:*:*:*:*:*:*
  • cpe:2.3:a:postgresql:postgresql:8.4.6:*:*:*:*:*:*:*
    cpe:2.3:a:postgresql:postgresql:8.4.6:*:*:*:*:*:*:*
  • cpe:2.3:a:postgresql:postgresql:8.4.7:*:*:*:*:*:*:*
    cpe:2.3:a:postgresql:postgresql:8.4.7:*:*:*:*:*:*:*
  • cpe:2.3:a:postgresql:postgresql:8.4.8:*:*:*:*:*:*:*
    cpe:2.3:a:postgresql:postgresql:8.4.8:*:*:*:*:*:*:*
  • cpe:2.3:a:postgresql:postgresql:8.4.9:*:*:*:*:*:*:*
    cpe:2.3:a:postgresql:postgresql:8.4.9:*:*:*:*:*:*:*
  • cpe:2.3:a:postgresql:postgresql:8.4.10:*:*:*:*:*:*:*
    cpe:2.3:a:postgresql:postgresql:8.4.10:*:*:*:*:*:*:*
  • cpe:2.3:a:postgresql:postgresql:8.4.11:*:*:*:*:*:*:*
    cpe:2.3:a:postgresql:postgresql:8.4.11:*:*:*:*:*:*:*
  • cpe:2.3:a:postgresql:postgresql:8.4.12:*:*:*:*:*:*:*
    cpe:2.3:a:postgresql:postgresql:8.4.12:*:*:*:*:*:*:*
  • cpe:2.3:a:postgresql:postgresql:9.1.0:*:*:*:*:*:*:*
    cpe:2.3:a:postgresql:postgresql:9.1.0:*:*:*:*:*:*:*
  • cpe:2.3:a:postgresql:postgresql:9.1.1:*:*:*:*:*:*:*
    cpe:2.3:a:postgresql:postgresql:9.1.1:*:*:*:*:*:*:*
  • cpe:2.3:a:postgresql:postgresql:9.1.2:*:*:*:*:*:*:*
    cpe:2.3:a:postgresql:postgresql:9.1.2:*:*:*:*:*:*:*
  • cpe:2.3:a:postgresql:postgresql:9.1.3:*:*:*:*:*:*:*
    cpe:2.3:a:postgresql:postgresql:9.1.3:*:*:*:*:*:*:*
  • cpe:2.3:a:postgresql:postgresql:9.1.4:*:*:*:*:*:*:*
    cpe:2.3:a:postgresql:postgresql:9.1.4:*:*:*:*:*:*:*
  • cpe:2.3:a:postgresql:postgresql:9.0.0:*:*:*:*:*:*:*
    cpe:2.3:a:postgresql:postgresql:9.0.0:*:*:*:*:*:*:*
  • cpe:2.3:a:postgresql:postgresql:9.0.1:*:*:*:*:*:*:*
    cpe:2.3:a:postgresql:postgresql:9.0.1:*:*:*:*:*:*:*
  • cpe:2.3:a:postgresql:postgresql:9.0.2:*:*:*:*:*:*:*
    cpe:2.3:a:postgresql:postgresql:9.0.2:*:*:*:*:*:*:*
  • cpe:2.3:a:postgresql:postgresql:9.0.3:*:*:*:*:*:*:*
    cpe:2.3:a:postgresql:postgresql:9.0.3:*:*:*:*:*:*:*
  • cpe:2.3:a:postgresql:postgresql:9.0.4:*:*:*:*:*:*:*
    cpe:2.3:a:postgresql:postgresql:9.0.4:*:*:*:*:*:*:*
  • cpe:2.3:a:postgresql:postgresql:9.0.5:*:*:*:*:*:*:*
    cpe:2.3:a:postgresql:postgresql:9.0.5:*:*:*:*:*:*:*
  • cpe:2.3:a:postgresql:postgresql:9.0.6:*:*:*:*:*:*:*
    cpe:2.3:a:postgresql:postgresql:9.0.6:*:*:*:*:*:*:*
  • cpe:2.3:a:postgresql:postgresql:9.0.7:*:*:*:*:*:*:*
    cpe:2.3:a:postgresql:postgresql:9.0.7:*:*:*:*:*:*:*
  • cpe:2.3:a:postgresql:postgresql:9.0.8:*:*:*:*:*:*:*
    cpe:2.3:a:postgresql:postgresql:9.0.8:*:*:*:*:*:*:*
  • cpe:2.3:o:opensuse:opensuse:11.4:*:*:*:*:*:*:*
    cpe:2.3:o:opensuse:opensuse:11.4:*:*:*:*:*:*:*
  • cpe:2.3:o:opensuse:opensuse:12.2:*:*:*:*:*:*:*
    cpe:2.3:o:opensuse:opensuse:12.2:*:*:*:*:*:*:*
  • cpe:2.3:o:opensuse:opensuse:12.1:*:*:*:*:*:*:*
    cpe:2.3:o:opensuse:opensuse:12.1:*:*:*:*:*:*:*
  • cpe:2.3:o:apple:mac_os_x_server:10.6.8:*:*:*:*:*:*:*
    cpe:2.3:o:apple:mac_os_x_server:10.6.8:*:*:*:*:*:*:*
  • cpe:2.3:o:apple:mac_os_x_server:10.7.0:*:*:*:*:*:*:*
    cpe:2.3:o:apple:mac_os_x_server:10.7.0:*:*:*:*:*:*:*
  • cpe:2.3:o:apple:mac_os_x_server:10.7.1:*:*:*:*:*:*:*
    cpe:2.3:o:apple:mac_os_x_server:10.7.1:*:*:*:*:*:*:*
  • cpe:2.3:o:apple:mac_os_x_server:10.7.2:*:*:*:*:*:*:*
    cpe:2.3:o:apple:mac_os_x_server:10.7.2:*:*:*:*:*:*:*
  • cpe:2.3:o:apple:mac_os_x_server:10.7.3:*:*:*:*:*:*:*
    cpe:2.3:o:apple:mac_os_x_server:10.7.3:*:*:*:*:*:*:*
  • cpe:2.3:o:apple:mac_os_x_server:10.7.4:*:*:*:*:*:*:*
    cpe:2.3:o:apple:mac_os_x_server:10.7.4:*:*:*:*:*:*:*
  • cpe:2.3:o:apple:mac_os_x_server:10.7.5:*:*:*:*:*:*:*
    cpe:2.3:o:apple:mac_os_x_server:10.7.5:*:*:*:*:*:*:*
  • cpe:2.3:o:canonical:ubuntu_linux:11.04:*:*:*:*:*:*:*
    cpe:2.3:o:canonical:ubuntu_linux:11.04:*:*:*:*:*:*:*
  • cpe:2.3:o:canonical:ubuntu_linux:11.10:*:*:*:*:*:*:*
    cpe:2.3:o:canonical:ubuntu_linux:11.10:*:*:*:*:*:*:*
  • cpe:2.3:o:canonical:ubuntu_linux:8.04:*:*:*:-:*:*:*
    cpe:2.3:o:canonical:ubuntu_linux:8.04:*:*:*:-:*:*:*
  • cpe:2.3:o:canonical:ubuntu_linux:10.04:*:*:*:-:*:*:*
    cpe:2.3:o:canonical:ubuntu_linux:10.04:*:*:*:-:*:*:*
  • cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:-:*:*:*
    cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:-:*:*:*
  • cpe:2.3:o:debian:debian_linux:6.0:*:*:*:*:*:*:*
    cpe:2.3:o:debian:debian_linux:6.0:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_server:5.0:*:*:*:*:*:*:*
    cpe:2.3:o:redhat:enterprise_linux_server:5.0:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_workstation:5.0:*:*:*:*:*:*:*
    cpe:2.3:o:redhat:enterprise_linux_workstation:5.0:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*
    cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*
    cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*
    cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_desktop:5.0:*:*:*:*:*:*:*
    cpe:2.3:o:redhat:enterprise_linux_desktop:5.0:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_eus:6.3:*:*:*:*:*:*:*
    cpe:2.3:o:redhat:enterprise_linux_eus:6.3:*:*:*:*:*:*:*
CVSS
Base: 4.0 (as of 15-02-2024 - 03:22)
Impact:
Exploitability:
CWE CWE-611
CAPEC
  • XML External Entities Blowup
    This attack takes advantage of the entity replacement property of XML where the value of the replacement is a URI. A well-crafted XML document could have the entity refer to a URI that consumes a large amount of resources to create a denial of service condition. This can cause the system to either freeze, crash, or execute arbitrary code depending on the URI.
Access
VectorComplexityAuthentication
NETWORK LOW SINGLE
Impact
ConfidentialityIntegrityAvailability
PARTIAL NONE NONE
cvss-vector via4 AV:N/AC:L/Au:S/C:P/I:N/A:N
redhat via4
advisories
bugzilla
id 849173
title CVE-2012-3489 postgresql: File disclosure through XXE in xmlparse by DTD validation
oval
OR
  • comment Red Hat Enterprise Linux must be installed
    oval oval:com.redhat.rhba:tst:20070304026
  • AND
    • comment Red Hat Enterprise Linux 5 is installed
      oval oval:com.redhat.rhba:tst:20070331005
    • OR
      • AND
        • comment postgresql84 is earlier than 0:8.4.13-1.el5_8
          oval oval:com.redhat.rhsa:tst:20121263001
        • comment postgresql84 is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhsa:tst:20100430002
      • AND
        • comment postgresql84-contrib is earlier than 0:8.4.13-1.el5_8
          oval oval:com.redhat.rhsa:tst:20121263003
        • comment postgresql84-contrib is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhsa:tst:20100430004
      • AND
        • comment postgresql84-devel is earlier than 0:8.4.13-1.el5_8
          oval oval:com.redhat.rhsa:tst:20121263005
        • comment postgresql84-devel is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhsa:tst:20100430006
      • AND
        • comment postgresql84-docs is earlier than 0:8.4.13-1.el5_8
          oval oval:com.redhat.rhsa:tst:20121263007
        • comment postgresql84-docs is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhsa:tst:20100430008
      • AND
        • comment postgresql84-libs is earlier than 0:8.4.13-1.el5_8
          oval oval:com.redhat.rhsa:tst:20121263009
        • comment postgresql84-libs is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhsa:tst:20100430010
      • AND
        • comment postgresql84-plperl is earlier than 0:8.4.13-1.el5_8
          oval oval:com.redhat.rhsa:tst:20121263011
        • comment postgresql84-plperl is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhsa:tst:20100430012
      • AND
        • comment postgresql84-plpython is earlier than 0:8.4.13-1.el5_8
          oval oval:com.redhat.rhsa:tst:20121263013
        • comment postgresql84-plpython is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhsa:tst:20100430014
      • AND
        • comment postgresql84-pltcl is earlier than 0:8.4.13-1.el5_8
          oval oval:com.redhat.rhsa:tst:20121263015
        • comment postgresql84-pltcl is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhsa:tst:20100430016
      • AND
        • comment postgresql84-python is earlier than 0:8.4.13-1.el5_8
          oval oval:com.redhat.rhsa:tst:20121263017
        • comment postgresql84-python is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhsa:tst:20100430018
      • AND
        • comment postgresql84-server is earlier than 0:8.4.13-1.el5_8
          oval oval:com.redhat.rhsa:tst:20121263019
        • comment postgresql84-server is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhsa:tst:20100430020
      • AND
        • comment postgresql84-tcl is earlier than 0:8.4.13-1.el5_8
          oval oval:com.redhat.rhsa:tst:20121263021
        • comment postgresql84-tcl is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhsa:tst:20100430022
      • AND
        • comment postgresql84-test is earlier than 0:8.4.13-1.el5_8
          oval oval:com.redhat.rhsa:tst:20121263023
        • comment postgresql84-test is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhsa:tst:20100430024
  • AND
    • comment Red Hat Enterprise Linux 6 is installed
      oval oval:com.redhat.rhba:tst:20111656003
    • OR
      • AND
        • comment postgresql is earlier than 0:8.4.13-1.el6_3
          oval oval:com.redhat.rhsa:tst:20121263026
        • comment postgresql is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20100908002
      • AND
        • comment postgresql-contrib is earlier than 0:8.4.13-1.el6_3
          oval oval:com.redhat.rhsa:tst:20121263028
        • comment postgresql-contrib is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20100908004
      • AND
        • comment postgresql-devel is earlier than 0:8.4.13-1.el6_3
          oval oval:com.redhat.rhsa:tst:20121263030
        • comment postgresql-devel is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20100908006
      • AND
        • comment postgresql-docs is earlier than 0:8.4.13-1.el6_3
          oval oval:com.redhat.rhsa:tst:20121263032
        • comment postgresql-docs is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20100908008
      • AND
        • comment postgresql-libs is earlier than 0:8.4.13-1.el6_3
          oval oval:com.redhat.rhsa:tst:20121263034
        • comment postgresql-libs is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20100908010
      • AND
        • comment postgresql-plperl is earlier than 0:8.4.13-1.el6_3
          oval oval:com.redhat.rhsa:tst:20121263036
        • comment postgresql-plperl is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20100908012
      • AND
        • comment postgresql-plpython is earlier than 0:8.4.13-1.el6_3
          oval oval:com.redhat.rhsa:tst:20121263038
        • comment postgresql-plpython is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20100908014
      • AND
        • comment postgresql-pltcl is earlier than 0:8.4.13-1.el6_3
          oval oval:com.redhat.rhsa:tst:20121263040
        • comment postgresql-pltcl is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20100908016
      • AND
        • comment postgresql-server is earlier than 0:8.4.13-1.el6_3
          oval oval:com.redhat.rhsa:tst:20121263042
        • comment postgresql-server is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20100908018
      • AND
        • comment postgresql-test is earlier than 0:8.4.13-1.el6_3
          oval oval:com.redhat.rhsa:tst:20121263044
        • comment postgresql-test is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20100908020
rhsa
id RHSA-2012:1263
released 2012-09-13
severity Moderate
title RHSA-2012:1263: postgresql and postgresql84 security update (Moderate)
rpms
  • postgresql-0:8.4.13-1.el6_3
  • postgresql-contrib-0:8.4.13-1.el6_3
  • postgresql-debuginfo-0:8.4.13-1.el6_3
  • postgresql-devel-0:8.4.13-1.el6_3
  • postgresql-docs-0:8.4.13-1.el6_3
  • postgresql-libs-0:8.4.13-1.el6_3
  • postgresql-plperl-0:8.4.13-1.el6_3
  • postgresql-plpython-0:8.4.13-1.el6_3
  • postgresql-pltcl-0:8.4.13-1.el6_3
  • postgresql-server-0:8.4.13-1.el6_3
  • postgresql-test-0:8.4.13-1.el6_3
  • postgresql84-0:8.4.13-1.el5_8
  • postgresql84-contrib-0:8.4.13-1.el5_8
  • postgresql84-debuginfo-0:8.4.13-1.el5_8
  • postgresql84-devel-0:8.4.13-1.el5_8
  • postgresql84-docs-0:8.4.13-1.el5_8
  • postgresql84-libs-0:8.4.13-1.el5_8
  • postgresql84-plperl-0:8.4.13-1.el5_8
  • postgresql84-plpython-0:8.4.13-1.el5_8
  • postgresql84-pltcl-0:8.4.13-1.el5_8
  • postgresql84-python-0:8.4.13-1.el5_8
  • postgresql84-server-0:8.4.13-1.el5_8
  • postgresql84-tcl-0:8.4.13-1.el5_8
  • postgresql84-test-0:8.4.13-1.el5_8
refmap via4
apple APPLE-SA-2013-03-14-1
bid 55074
confirm
debian DSA-2534
mandriva MDVSA-2012:139
secunia
  • 50635
  • 50718
  • 50859
  • 50946
suse
  • openSUSE-SU-2012:1251
  • openSUSE-SU-2012:1288
  • openSUSE-SU-2012:1299
ubuntu USN-1542-1
Last major update 15-02-2024 - 03:22
Published 03-10-2012 - 21:55
Last modified 15-02-2024 - 03:22
Back to Top