CVE-2012-3488
The libxslt support in contrib/xml2 in PostgreSQL 8.3 before 8.3.20, 8.4 before 8.4.13, 9.0...
4.9 MediumFix available
The libxslt support in contrib/xml2 in PostgreSQL 8.3 before 8.3.20, 8.4 before 8.4.13, 9.0 before 9.0.9, and 9.1 before 9.1.5 does not properly restrict access to files and URLs, which allows remote authenticated users to modify data, obtain sensitive information, or trigger outbound traffic to arbitrary external hosts by leveraging (1) stylesheet commands that are permitted by the libxslt security options or (2) an xslt_process feature, related to an XML External Entity (aka XXE) issue.
Exploit likelihood
3.30%Up 0.8 points since Feb 4, 2022
What each source reports
NVD Score used
The libxslt support in contrib/xml2 in PostgreSQL 8.3 before 8.3.20, 8.4 before 8.4.13, 9.0 before 9.0.9, and 9.1 before 9.1.5 does not properly restrict access to files and URLs, which allows remote authenticated users to modify data, obtain sensitive information, or trigger outbound traffic to arbitrary external hosts by leveraging (1) stylesheet commands that are permitted by the libxslt security options or (2) an xslt_process feature, related to an XML External Entity (aka XXE) issue.
- Record
CVE-2012-3488- CVSS 2.0
- 4.9 Medium
AV:N/AC:M/Au:S/C:P/I:P/A:N - Weakness
- CWE-264
- Updated
- 2026-11-02
CVE List No score
The libxslt support in contrib/xml2 in PostgreSQL 8.3 before 8.3.20, 8.4 before 8.4.13, 9.0 before 9.0.9, and 9.1 before 9.1.5 does not properly restrict access to files and URLs, which allows remote authenticated users to modify data, obtain sensitive information, or trigger outbound traffic to arbitrary external hosts by leveraging (1) stylesheet commands that are permitted by the libxslt security options or (2) an xslt_process feature, related to an XML External Entity (aka XXE) issue.
- Record
CVE-2012-3488- Updated
- 2026-11-02
EUVDEUVD-2012-3444 No score
The libxslt support in contrib/xml2 in PostgreSQL 8.3 before 8.3.20, 8.4 before 8.4.13, 9.0 before 9.0.9, and 9.1 before 9.1.5 does not properly restrict access to files and URLs, which allows remote authenticated users to modify data, obtain sensitive information, or trigger outbound traffic to arbitrary external hosts by leveraging (1) stylesheet commands that are permitted by the libxslt security options or (2) an xslt_process feature, related to an XML External Entity (aka XXE) issue.
- Record
EUVD-2012-3444- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-8wqv-9478-cg4h No score
The libxslt support in contrib/xml2 in PostgreSQL 8.3 before 8.3.20, 8.4 before 8.4.13, 9.0...
The libxslt support in contrib/xml2 in PostgreSQL 8.3 before 8.3.20, 8.4 before 8.4.13, 9.0 before 9.0.9, and 9.1 before 9.1.5 does not properly restrict access to files and URLs, which allows remote authenticated users to modify data, obtain sensitive information, or trigger outbound traffic to arbitrary external hosts by leveraging (1) stylesheet commands that are permitted by the libxslt security options or (2) an xslt_process feature, related to an XML External Entity (aka XXE) issue.
- Record
GHSA-8wqv-9478-cg4h- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10030-1 No score
postgresql94-9.4.10-1.1 on GA media
These are all security issues fixed in the postgresql94-9.4.10-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10030-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10256-1 No score
postgresql93-9.3.15-1.1 on GA media
These are all security issues fixed in the postgresql93-9.3.15-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10256-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10273-1 No score
libecpg6-32bit-9.5.4-1.2 on GA media
These are all security issues fixed in the libecpg6-32bit-9.5.4-1.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10273-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
postgresql-8.4Debian:6.0 From an advisory covering 2 CVEs |
before 8.4.13-0squeeze1, plus listed versions 8.4.10-0squeeze18.4.10-0squeeze1~bpo50+18.4.10-18.4.11-0squeeze18.4.11-1 Show 22 moreShow less8.4.12-0squeeze18.4.12-18.4.12-28.4.12-38.4.5-0squeeze28.4.5-18.4.5-1~bpo50+18.4.5-28.4.5-2~bpo50+18.4.6-18.4.7-0squeeze1~bpo50+18.4.7-0squeeze28.4.7-18.4.8-0squeeze18.4.8-0squeeze1~bpo50+18.4.8-0squeeze28.4.8-0squeeze2~bpo50+18.4.8-18.4.8-28.4.9-0squeeze18.4.9-0squeeze1~bpo50+18.4.9-1 |
8.4.13-0squeeze1 |
postgresql84Red Hat:enterprise_linux:5::client From an advisory covering 2 CVEs |
before 0:8.4.13-1.el5_8 | 0:8.4.13-1.el5_8 |
postgresql84-contribRed Hat:enterprise_linux:5::client From an advisory covering 2 CVEs |
before 0:8.4.13-1.el5_8 | 0:8.4.13-1.el5_8 |
postgresql84-debuginfoRed Hat:enterprise_linux:5::client From an advisory covering 2 CVEs |
before 0:8.4.13-1.el5_8 | 0:8.4.13-1.el5_8 |
postgresql84-docsRed Hat:enterprise_linux:5::client From an advisory covering 2 CVEs |
before 0:8.4.13-1.el5_8 | 0:8.4.13-1.el5_8 |
postgresql84-libsRed Hat:enterprise_linux:5::client From an advisory covering 2 CVEs |
before 0:8.4.13-1.el5_8 | 0:8.4.13-1.el5_8 |
postgresql84-pythonRed Hat:enterprise_linux:5::client From an advisory covering 2 CVEs |
before 0:8.4.13-1.el5_8 | 0:8.4.13-1.el5_8 |
postgresql84-tclRed Hat:enterprise_linux:5::client From an advisory covering 2 CVEs |
before 0:8.4.13-1.el5_8 | 0:8.4.13-1.el5_8 |
postgresql84Red Hat:enterprise_linux:5::client_workstation From an advisory covering 2 CVEs |
before 0:8.4.13-1.el5_8 | 0:8.4.13-1.el5_8 |
postgresql84-debuginfoRed Hat:enterprise_linux:5::client_workstation From an advisory covering 2 CVEs |
before 0:8.4.13-1.el5_8 | 0:8.4.13-1.el5_8 |
Show 90 moreShow less
| Package | Affected | Fixed |
|---|---|---|
postgresql84-develRed Hat:enterprise_linux:5::client_workstation From an advisory covering 2 CVEs |
before 0:8.4.13-1.el5_8 | 0:8.4.13-1.el5_8 |
postgresql84-plperlRed Hat:enterprise_linux:5::client_workstation From an advisory covering 2 CVEs |
before 0:8.4.13-1.el5_8 | 0:8.4.13-1.el5_8 |
postgresql84-plpythonRed Hat:enterprise_linux:5::client_workstation From an advisory covering 2 CVEs |
before 0:8.4.13-1.el5_8 | 0:8.4.13-1.el5_8 |
postgresql84-pltclRed Hat:enterprise_linux:5::client_workstation From an advisory covering 2 CVEs |
before 0:8.4.13-1.el5_8 | 0:8.4.13-1.el5_8 |
postgresql84-serverRed Hat:enterprise_linux:5::client_workstation From an advisory covering 2 CVEs |
before 0:8.4.13-1.el5_8 | 0:8.4.13-1.el5_8 |
postgresql84-testRed Hat:enterprise_linux:5::client_workstation From an advisory covering 2 CVEs |
before 0:8.4.13-1.el5_8 | 0:8.4.13-1.el5_8 |
postgresql84Red Hat:enterprise_linux:5::server From an advisory covering 2 CVEs |
before 0:8.4.13-1.el5_8 | 0:8.4.13-1.el5_8 |
postgresql84-contribRed Hat:enterprise_linux:5::server From an advisory covering 2 CVEs |
before 0:8.4.13-1.el5_8 | 0:8.4.13-1.el5_8 |
postgresql84-debuginfoRed Hat:enterprise_linux:5::server From an advisory covering 2 CVEs |
before 0:8.4.13-1.el5_8 | 0:8.4.13-1.el5_8 |
postgresql84-develRed Hat:enterprise_linux:5::server From an advisory covering 2 CVEs |
before 0:8.4.13-1.el5_8 | 0:8.4.13-1.el5_8 |
postgresql84-docsRed Hat:enterprise_linux:5::server From an advisory covering 2 CVEs |
before 0:8.4.13-1.el5_8 | 0:8.4.13-1.el5_8 |
postgresql84-libsRed Hat:enterprise_linux:5::server From an advisory covering 2 CVEs |
before 0:8.4.13-1.el5_8 | 0:8.4.13-1.el5_8 |
postgresql84-plperlRed Hat:enterprise_linux:5::server From an advisory covering 2 CVEs |
before 0:8.4.13-1.el5_8 | 0:8.4.13-1.el5_8 |
postgresql84-plpythonRed Hat:enterprise_linux:5::server From an advisory covering 2 CVEs |
before 0:8.4.13-1.el5_8 | 0:8.4.13-1.el5_8 |
postgresql84-pltclRed Hat:enterprise_linux:5::server From an advisory covering 2 CVEs |
before 0:8.4.13-1.el5_8 | 0:8.4.13-1.el5_8 |
postgresql84-pythonRed Hat:enterprise_linux:5::server From an advisory covering 2 CVEs |
before 0:8.4.13-1.el5_8 | 0:8.4.13-1.el5_8 |
postgresql84-serverRed Hat:enterprise_linux:5::server From an advisory covering 2 CVEs |
before 0:8.4.13-1.el5_8 | 0:8.4.13-1.el5_8 |
postgresql84-tclRed Hat:enterprise_linux:5::server From an advisory covering 2 CVEs |
before 0:8.4.13-1.el5_8 | 0:8.4.13-1.el5_8 |
postgresql84-testRed Hat:enterprise_linux:5::server From an advisory covering 2 CVEs |
before 0:8.4.13-1.el5_8 | 0:8.4.13-1.el5_8 |
postgresqlRed Hat:enterprise_linux:6::client From an advisory covering 2 CVEs |
before 0:8.4.13-1.el6_3 | 0:8.4.13-1.el6_3 |
postgresql-debuginfoRed Hat:enterprise_linux:6::client From an advisory covering 2 CVEs |
before 0:8.4.13-1.el6_3 | 0:8.4.13-1.el6_3 |
postgresql-libsRed Hat:enterprise_linux:6::client From an advisory covering 2 CVEs |
before 0:8.4.13-1.el6_3 | 0:8.4.13-1.el6_3 |
postgresql-contribRed Hat:enterprise_linux:6::client From an advisory covering 2 CVEs |
before 0:8.4.13-1.el6_3 | 0:8.4.13-1.el6_3 |
postgresql-develRed Hat:enterprise_linux:6::client From an advisory covering 2 CVEs |
before 0:8.4.13-1.el6_3 | 0:8.4.13-1.el6_3 |
postgresql-docsRed Hat:enterprise_linux:6::client From an advisory covering 2 CVEs |
before 0:8.4.13-1.el6_3 | 0:8.4.13-1.el6_3 |
postgresql-plperlRed Hat:enterprise_linux:6::client From an advisory covering 2 CVEs |
before 0:8.4.13-1.el6_3 | 0:8.4.13-1.el6_3 |
postgresql-plpythonRed Hat:enterprise_linux:6::client From an advisory covering 2 CVEs |
before 0:8.4.13-1.el6_3 | 0:8.4.13-1.el6_3 |
postgresql-pltclRed Hat:enterprise_linux:6::client From an advisory covering 2 CVEs |
before 0:8.4.13-1.el6_3 | 0:8.4.13-1.el6_3 |
postgresql-serverRed Hat:enterprise_linux:6::client From an advisory covering 2 CVEs |
before 0:8.4.13-1.el6_3 | 0:8.4.13-1.el6_3 |
postgresql-testRed Hat:enterprise_linux:6::client From an advisory covering 2 CVEs |
before 0:8.4.13-1.el6_3 | 0:8.4.13-1.el6_3 |
postgresqlRed Hat:enterprise_linux:6::computenode From an advisory covering 2 CVEs |
before 0:8.4.13-1.el6_3 | 0:8.4.13-1.el6_3 |
postgresql-debuginfoRed Hat:enterprise_linux:6::computenode From an advisory covering 2 CVEs |
before 0:8.4.13-1.el6_3 | 0:8.4.13-1.el6_3 |
postgresql-libsRed Hat:enterprise_linux:6::computenode From an advisory covering 2 CVEs |
before 0:8.4.13-1.el6_3 | 0:8.4.13-1.el6_3 |
postgresql-contribRed Hat:enterprise_linux:6::computenode From an advisory covering 2 CVEs |
before 0:8.4.13-1.el6_3 | 0:8.4.13-1.el6_3 |
postgresql-develRed Hat:enterprise_linux:6::computenode From an advisory covering 2 CVEs |
before 0:8.4.13-1.el6_3 | 0:8.4.13-1.el6_3 |
postgresql-docsRed Hat:enterprise_linux:6::computenode From an advisory covering 2 CVEs |
before 0:8.4.13-1.el6_3 | 0:8.4.13-1.el6_3 |
postgresql-plperlRed Hat:enterprise_linux:6::computenode From an advisory covering 2 CVEs |
before 0:8.4.13-1.el6_3 | 0:8.4.13-1.el6_3 |
postgresql-plpythonRed Hat:enterprise_linux:6::computenode From an advisory covering 2 CVEs |
before 0:8.4.13-1.el6_3 | 0:8.4.13-1.el6_3 |
postgresql-pltclRed Hat:enterprise_linux:6::computenode From an advisory covering 2 CVEs |
before 0:8.4.13-1.el6_3 | 0:8.4.13-1.el6_3 |
postgresql-serverRed Hat:enterprise_linux:6::computenode From an advisory covering 2 CVEs |
before 0:8.4.13-1.el6_3 | 0:8.4.13-1.el6_3 |
postgresql-testRed Hat:enterprise_linux:6::computenode From an advisory covering 2 CVEs |
before 0:8.4.13-1.el6_3 | 0:8.4.13-1.el6_3 |
postgresqlRed Hat:enterprise_linux:6::server From an advisory covering 2 CVEs |
before 0:8.4.13-1.el6_3 | 0:8.4.13-1.el6_3 |
postgresql-contribRed Hat:enterprise_linux:6::server From an advisory covering 2 CVEs |
before 0:8.4.13-1.el6_3 | 0:8.4.13-1.el6_3 |
postgresql-debuginfoRed Hat:enterprise_linux:6::server From an advisory covering 2 CVEs |
before 0:8.4.13-1.el6_3 | 0:8.4.13-1.el6_3 |
postgresql-develRed Hat:enterprise_linux:6::server From an advisory covering 2 CVEs |
before 0:8.4.13-1.el6_3 | 0:8.4.13-1.el6_3 |
postgresql-docsRed Hat:enterprise_linux:6::server From an advisory covering 2 CVEs |
before 0:8.4.13-1.el6_3 | 0:8.4.13-1.el6_3 |
postgresql-libsRed Hat:enterprise_linux:6::server From an advisory covering 2 CVEs |
before 0:8.4.13-1.el6_3 | 0:8.4.13-1.el6_3 |
postgresql-plperlRed Hat:enterprise_linux:6::server From an advisory covering 2 CVEs |
before 0:8.4.13-1.el6_3 | 0:8.4.13-1.el6_3 |
postgresql-plpythonRed Hat:enterprise_linux:6::server From an advisory covering 2 CVEs |
before 0:8.4.13-1.el6_3 | 0:8.4.13-1.el6_3 |
postgresql-pltclRed Hat:enterprise_linux:6::server From an advisory covering 2 CVEs |
before 0:8.4.13-1.el6_3 | 0:8.4.13-1.el6_3 |
postgresql-serverRed Hat:enterprise_linux:6::server From an advisory covering 2 CVEs |
before 0:8.4.13-1.el6_3 | 0:8.4.13-1.el6_3 |
postgresql-testRed Hat:enterprise_linux:6::server From an advisory covering 2 CVEs |
before 0:8.4.13-1.el6_3 | 0:8.4.13-1.el6_3 |
postgresqlRed Hat:enterprise_linux:6::workstation From an advisory covering 2 CVEs |
before 0:8.4.13-1.el6_3 | 0:8.4.13-1.el6_3 |
postgresql-contribRed Hat:enterprise_linux:6::workstation From an advisory covering 2 CVEs |
before 0:8.4.13-1.el6_3 | 0:8.4.13-1.el6_3 |
postgresql-debuginfoRed Hat:enterprise_linux:6::workstation From an advisory covering 2 CVEs |
before 0:8.4.13-1.el6_3 | 0:8.4.13-1.el6_3 |
postgresql-develRed Hat:enterprise_linux:6::workstation From an advisory covering 2 CVEs |
before 0:8.4.13-1.el6_3 | 0:8.4.13-1.el6_3 |
postgresql-docsRed Hat:enterprise_linux:6::workstation From an advisory covering 2 CVEs |
before 0:8.4.13-1.el6_3 | 0:8.4.13-1.el6_3 |
postgresql-libsRed Hat:enterprise_linux:6::workstation From an advisory covering 2 CVEs |
before 0:8.4.13-1.el6_3 | 0:8.4.13-1.el6_3 |
postgresql-plperlRed Hat:enterprise_linux:6::workstation From an advisory covering 2 CVEs |
before 0:8.4.13-1.el6_3 | 0:8.4.13-1.el6_3 |
postgresql-plpythonRed Hat:enterprise_linux:6::workstation From an advisory covering 2 CVEs |
before 0:8.4.13-1.el6_3 | 0:8.4.13-1.el6_3 |
postgresql-pltclRed Hat:enterprise_linux:6::workstation From an advisory covering 2 CVEs |
before 0:8.4.13-1.el6_3 | 0:8.4.13-1.el6_3 |
postgresql-serverRed Hat:enterprise_linux:6::workstation From an advisory covering 2 CVEs |
before 0:8.4.13-1.el6_3 | 0:8.4.13-1.el6_3 |
postgresql-testRed Hat:enterprise_linux:6::workstation From an advisory covering 2 CVEs |
before 0:8.4.13-1.el6_3 | 0:8.4.13-1.el6_3 |
postgresqlRed Hat:enterprise_linux:5::client |
before 0:8.1.23-6.el5_8 | 0:8.1.23-6.el5_8 |
postgresql-contribRed Hat:enterprise_linux:5::client |
before 0:8.1.23-6.el5_8 | 0:8.1.23-6.el5_8 |
postgresql-debuginfoRed Hat:enterprise_linux:5::client |
before 0:8.1.23-6.el5_8 | 0:8.1.23-6.el5_8 |
postgresql-docsRed Hat:enterprise_linux:5::client |
before 0:8.1.23-6.el5_8 | 0:8.1.23-6.el5_8 |
postgresql-libsRed Hat:enterprise_linux:5::client |
before 0:8.1.23-6.el5_8 | 0:8.1.23-6.el5_8 |
postgresql-pythonRed Hat:enterprise_linux:5::client |
before 0:8.1.23-6.el5_8 | 0:8.1.23-6.el5_8 |
postgresql-tclRed Hat:enterprise_linux:5::client |
before 0:8.1.23-6.el5_8 | 0:8.1.23-6.el5_8 |
postgresqlRed Hat:enterprise_linux:5::client_workstation |
before 0:8.1.23-6.el5_8 | 0:8.1.23-6.el5_8 |
postgresql-debuginfoRed Hat:enterprise_linux:5::client_workstation |
before 0:8.1.23-6.el5_8 | 0:8.1.23-6.el5_8 |
postgresql-develRed Hat:enterprise_linux:5::client_workstation |
before 0:8.1.23-6.el5_8 | 0:8.1.23-6.el5_8 |
postgresql-plRed Hat:enterprise_linux:5::client_workstation |
before 0:8.1.23-6.el5_8 | 0:8.1.23-6.el5_8 |
postgresql-serverRed Hat:enterprise_linux:5::client_workstation |
before 0:8.1.23-6.el5_8 | 0:8.1.23-6.el5_8 |
postgresql-testRed Hat:enterprise_linux:5::client_workstation |
before 0:8.1.23-6.el5_8 | 0:8.1.23-6.el5_8 |
postgresqlRed Hat:enterprise_linux:5::server |
before 0:8.1.23-6.el5_8 | 0:8.1.23-6.el5_8 |
postgresql-contribRed Hat:enterprise_linux:5::server |
before 0:8.1.23-6.el5_8 | 0:8.1.23-6.el5_8 |
postgresql-debuginfoRed Hat:enterprise_linux:5::server |
before 0:8.1.23-6.el5_8 | 0:8.1.23-6.el5_8 |
postgresql-develRed Hat:enterprise_linux:5::server |
before 0:8.1.23-6.el5_8 | 0:8.1.23-6.el5_8 |
postgresql-docsRed Hat:enterprise_linux:5::server |
before 0:8.1.23-6.el5_8 | 0:8.1.23-6.el5_8 |
postgresql-libsRed Hat:enterprise_linux:5::server |
before 0:8.1.23-6.el5_8 | 0:8.1.23-6.el5_8 |
postgresql-plRed Hat:enterprise_linux:5::server |
before 0:8.1.23-6.el5_8 | 0:8.1.23-6.el5_8 |
postgresql-pythonRed Hat:enterprise_linux:5::server |
before 0:8.1.23-6.el5_8 | 0:8.1.23-6.el5_8 |
postgresql-serverRed Hat:enterprise_linux:5::server |
before 0:8.1.23-6.el5_8 | 0:8.1.23-6.el5_8 |
postgresql-tclRed Hat:enterprise_linux:5::server |
before 0:8.1.23-6.el5_8 | 0:8.1.23-6.el5_8 |
postgresql-testRed Hat:enterprise_linux:5::server |
before 0:8.1.23-6.el5_8 | 0:8.1.23-6.el5_8 |
postgresql94openSUSE:Tumbleweed From an advisory covering 35 CVEs |
before 9.4.10-1.1 | 9.4.10-1.1 |
postgresql93openSUSE:Tumbleweed From an advisory covering 40 CVEs |
before 9.3.15-1.1 | 9.3.15-1.1 |
postgresql95openSUSE:Tumbleweed From an advisory covering 37 CVEs |
before 9.5.4-1.2 | 9.5.4-1.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2012-3488 is a medium vulnerability (CVSS 4.9) in Postgresql, published August 25, 2012. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.30%, the 88th percentile. Fixed in postgresql 0:8.1.23-6.el5_8.
References
rhn.redhat.com/errata/RHSA-2012-1263.html
postgresql.org/docs/9.0/static/release-9-0-9.html
mandriva.com/security/advisories?name=MDVSA-2012:139
secunia.com/advisories/50636
bugzilla.redhat.com/show_bug.cgi?id=849172
ubuntu.com/usn/USN-1542-1
Show 73 moreShow less
blogs.oracle.com/sunsecurity/entry/multiple_vulnerabilities_in_postgresql2
lists.apple.com/archives/security-announce/2013/Mar/msg00002.html
securityfocus.com/bid/55072
debian.org/security/2012/dsa-2534
kb.juniper.net/InfoCenter/index?page=content&id=JSA10705
lists.opensuse.org/opensuse-updates/2012-09/msg00102.html
nvd.nist.gov/vuln/detail/CVE-2012-3488
github.com/advisories/GHSA-8wqv-9478-cg4h
access.redhat.com/errata/RHSA-2012:1263
security.access.redhat.com/data/csaf/v2/advisories/2012/rhsa-2012_1263.json
cve.org/CVERecord?id=CVE-2012-3488
suse.com/security/cve/CVE-2007-4772