NVD

Id
45082  
Name
CVE-2012-3489  
Description
The xml_parse function in the libxml2 support in the core server component in PostgreSQL 8.3 before 8.3.20, 8.4 before 8.4.13, 9.0 before 9.0.9, and 9.1 before 9.1.5 allows remote authenticated users to determine the existence of arbitrary files or URLs, and possibly obtain file or URL content that triggers a parsing error, via an XML value that refers to (1) a DTD or (2) an entity, related to an XML External Entity (aka XXE) issue.  
Reject
 
CVSS Version
2  
CVSS Score
4  
Severity
Medium  
CVSS Base Score
4  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
8  
CVSS Vector
(AV:N/AC:L/Au:S/C:P/I:N/A:N)  
Pub Date
2017-01-19  
Published
2012-10-03  
Modified Date
2013-10-10  
Seq
2012-3489  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
226070 45082 CVE-2012-3489 APPLE-SA-2013-03-14-1  View
226071 45082 CVE-2012-3489 openSUSE-SU-2012:1251  View
226072 45082 CVE-2012-3489 openSUSE-SU-2012:1288  View
226073 45082 CVE-2012-3489 openSUSE-SU-2012:1299  View
226074 45082 CVE-2012-3489 RHSA-2012:1263  View
226075 45082 CVE-2012-3489 DSA-2534  View
226076 45082 CVE-2012-3489 MDVSA-2012:139  View
226077 45082 CVE-2012-3489 http://www.postgresql.org/about/news/1407/  View
226078 45082 CVE-2012-3489 http://www.postgresql.org/docs/8.3/static/release-8-3-20.html  View
226079 45082 CVE-2012-3489 http://www.postgresql.org/docs/8.4/static/release-8-4-13.html  View
226080 45082 CVE-2012-3489 http://www.postgresql.org/docs/9.0/static/release-9-0-9.html  View
226081 45082 CVE-2012-3489 http://www.postgresql.org/docs/9.1/static/release-9-1-5.html  View
226082 45082 CVE-2012-3489 http://www.postgresql.org/support/security/  View
226083 45082 CVE-2012-3489 55074  View
226084 45082 CVE-2012-3489 USN-1542-1  View
226085 45082 CVE-2012-3489 https://blogs.oracle.com/sunsecurity/entry/multiple_vulnerabilities_in_postgresql2  View
226086 45082 CVE-2012-3489 https://bugzilla.redhat.com/show_bug.cgi?id=849173  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
29020 JVNDB-2012-004727 PostgreSQL のコアサーバコンポーネントにおける任意のファイルの存在を特定される脆弱性 PostgreSQL のコアサーバコンポーネント内の libxml2 のサポート機能の xml_parse 関数には、任意のファイルまたは URL の存在を特定される、および、ファイルまたは URL のコンテンツを取得される脆弱性が存在します。 CVE-2012-3489 56727 CVE-2012-3489 45082 5 http://jvndb.jvn.jp/ja/contents/2012/JVNDB-2012-004727.html 2012-08-17 2013-04-02 View