CVE-2012-3489

CVSS V2 Medium 4 CVSS V3 None
Description
The xml_parse function in the libxml2 support in the core server component in PostgreSQL 8.3 before 8.3.20, 8.4 before 8.4.13, 9.0 before 9.0.9, and 9.1 before 9.1.5 allows remote authenticated users to determine the existence of arbitrary files or URLs, and possibly obtain file or URL content that triggers a parsing error, via an XML value that refers to (1) a DTD or (2) an entity, related to an XML External Entity (aka XXE) issue.
Overview
  • CVE ID
  • CVE-2012-3489
  • Assigner
  • secalert@redhat.com
  • Vulnerability Status
  • Analyzed
  • Published Version
  • 2012-10-03T21:55:00
  • Last Modified Date
  • 2013-10-10T19:23:41
Weakness Enumerations
CWE URL
CWE-20 http://cwe.mitre.org/data/definitions/20.html
CPE Configuration (Product)
CPE Vulnerable Operator Version Start Version End
cpe:2.3:a:postgresql:postgresql:9.0:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:postgresql:postgresql:9.0.1:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:postgresql:postgresql:9.0.2:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:postgresql:postgresql:9.0.3:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:postgresql:postgresql:9.0.4:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:postgresql:postgresql:9.0.5:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:postgresql:postgresql:9.0.6:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:postgresql:postgresql:9.0.7:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:postgresql:postgresql:9.0.8:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:postgresql:postgresql:9.1:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:postgresql:postgresql:9.1.1:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:postgresql:postgresql:9.1.2:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:postgresql:postgresql:9.1.3:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:postgresql:postgresql:9.1.4:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:postgresql:postgresql:8.3:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:postgresql:postgresql:8.3.1:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:postgresql:postgresql:8.3.2:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:postgresql:postgresql:8.3.3:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:postgresql:postgresql:8.3.4:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:postgresql:postgresql:8.3.5:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:postgresql:postgresql:8.3.6:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:postgresql:postgresql:8.3.7:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:postgresql:postgresql:8.3.8:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:postgresql:postgresql:8.3.9:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:postgresql:postgresql:8.3.10:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:postgresql:postgresql:8.3.11:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:postgresql:postgresql:8.3.12:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:postgresql:postgresql:8.3.13:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:postgresql:postgresql:8.3.14:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:postgresql:postgresql:8.3.15:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:postgresql:postgresql:8.3.16:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:postgresql:postgresql:8.3.17:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:postgresql:postgresql:8.3.18:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:postgresql:postgresql:8.3.19:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:postgresql:postgresql:8.4:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:postgresql:postgresql:8.4.1:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:postgresql:postgresql:8.4.2:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:postgresql:postgresql:8.4.3:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:postgresql:postgresql:8.4.4:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:postgresql:postgresql:8.4.5:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:postgresql:postgresql:8.4.6:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:postgresql:postgresql:8.4.7:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:postgresql:postgresql:8.4.8:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:postgresql:postgresql:8.4.9:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:postgresql:postgresql:8.4.10:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:postgresql:postgresql:8.4.11:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:postgresql:postgresql:8.4.12:*:*:*:*:*:*:* 1 OR
CVSS Version 2
  • Version
  • 2.0
  • Vector String
  • AV:N/AC:L/Au:S/C:P/I:N/A:N
  • Access Vector
  • NETWORK
  • Access Compatibility
  • LOW
  • Authentication
  • SINGLE
  • Confidentiality Impact
  • PARTIAL
  • Integrity Impact
  • NONE
  • Availability Impact
  • NONE
  • Base Score
  • 4
  • Severity
  • MEDIUM
  • Exploitability Score
  • 8
  • Impact Score
  • 2.9
References
Reference URL Reference Tags
http://www.postgresql.org/docs/8.3/static/release-8-3-20.html
http://www.postgresql.org/support/security/ Vendor Advisory
http://www.postgresql.org/docs/9.1/static/release-9-1-5.html
http://www.postgresql.org/docs/8.4/static/release-8-4-13.html
https://bugzilla.redhat.com/show_bug.cgi?id=849173
http://www.postgresql.org/docs/9.0/static/release-9-0-9.html
http://www.postgresql.org/about/news/1407/ Vendor Advisory
http://lists.opensuse.org/opensuse-updates/2012-10/msg00024.html
http://lists.opensuse.org/opensuse-updates/2012-09/msg00102.html
http://www.debian.org/security/2012/dsa-2534
http://rhn.redhat.com/errata/RHSA-2012-1263.html
http://lists.opensuse.org/opensuse-updates/2012-10/msg00013.html
http://www.securityfocus.com/bid/55074
http://lists.apple.com/archives/security-announce/2013/Mar/msg00002.html
http://www.ubuntu.com/usn/USN-1542-1
http://secunia.com/advisories/50635
http://www.mandriva.com/security/advisories?name=MDVSA-2012:139
http://secunia.com/advisories/50718
https://blogs.oracle.com/sunsecurity/entry/multiple_vulnerabilities_in_postgresql2
http://secunia.com/advisories/50946
http://secunia.com/advisories/50859
Sources
Source Name Source URL
NIST https://nvd.nist.gov/vuln/detail/CVE-2012-3489
MITRE https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3489
History
Created Old Value New Value Data Type Notes
2022-05-10 10:41:55 Added to TrackCVE