Intel

CVE-2012-3489

The xml_parse function in the libxml2 support in the core server component in PostgreSQL 8.3 before 8.3.20, 8.4 before 8.4.13, 9.0 before… (CVE-2012-3489)

mediumEPSS 3.1%

Description

The xml_parse function in the libxml2 support in the core server component in PostgreSQL 8.3 before 8.3.20, 8.4 before 8.4.13, 9.0 before 9.0.9, and 9.1 before 9.1.5 allows remote authenticated users to determine the existence of arbitrary files or URLs, and possibly obtain file or URL content that triggers a parsing error, via an XML value that refers to (1) a DTD or (2) an entity, related to an XML External Entity (aka XXE) issue.

Source: CVELISTV5NVD

Metrics

Severity
medium
Priority score
84.59
KEV status
—
Exploit maturity
no public PoC known
XIEM Effective CVSS
6.5
Source: nvd-v3
CVSS v3
6.5
CVSS v4
—
EPSS percentile
86.8 %
Critical — this CVE ranks in the top fifth of all CVEs scored today (rank ≥ 80%).
EPSS score
3.1 %
Moderate — model estimates 1-10% exploitation likelihood.
Published
2012-10-03 21:00 UTC
CWE
—

Affected operating systems

  • linux

    debian / debian_linux6.0

  • linux

    redhat / enterprise_linux_desktop5.0

  • linux

    redhat / enterprise_linux_desktop6.0

  • linux

    redhat / enterprise_linux_eus6.3

  • linux

    redhat / enterprise_linux_server5.0

  • linux

    redhat / enterprise_linux_server6.0

  • linux

    redhat / enterprise_linux_workstation5.0

  • linux

    redhat / enterprise_linux_workstation6.0

  • linux

    canonical / ubuntu_linux10.04

  • linux

    canonical / ubuntu_linux11.04

  • linux

    canonical / ubuntu_linux11.10

  • linux

    canonical / ubuntu_linux12.04

  • linux

    canonical / ubuntu_linux8.04

  • macos

    apple / mac_os_x_server

  • macos

    apple / mac_os_x_server10.6.8

  • os

    opensuse / opensuse11.4

  • os

    opensuse / opensuse12.1

  • os

    opensuse / opensuse12.2

Affected products

Products and version ranges extracted from the vendor/CERT advisory. A range like „<4.14.6“ implies the update recommendation „upgrade to 4.14.6 or later“.

  • postgresql

    postgresql8.3.0 – 8.3.20

  • postgresql

    postgresql8.4.0 – 8.4.13

  • postgresql

    postgresql9.0.0 – 9.0.9

  • postgresql

    postgresql9.1.0 – 9.1.5

References & sources

IDCVE-2012-3489