CVE-2012-3489
The xml_parse function in the libxml2 support in the core server component in PostgreSQL 8.3...
6.5 Medium
The xml_parse function in the libxml2 support in the core server component in PostgreSQL 8.3 before 8.3.20, 8.4 before 8.4.13, 9.0 before 9.0.9, and 9.1 before 9.1.5 allows remote authenticated users to determine the existence of arbitrary files or URLs, and possibly obtain file or URL content that triggers a parsing error, via an XML value that refers to (1) a DTD or (2) an entity, related to an XML External Entity (aka XXE) issue.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
3.06%Up 0.5 points since Feb 4, 2022
What each source reports
NVD Score used
The xml_parse function in the libxml2 support in the core server component in PostgreSQL 8.3 before 8.3.20, 8.4 before 8.4.13, 9.0 before 9.0.9, and 9.1 before 9.1.5 allows remote authenticated users to determine the existence of arbitrary files or URLs, and possibly obtain file or URL content that triggers a parsing error, via an XML value that refers to (1) a DTD or (2) an entity, related to an XML External Entity (aka XXE) issue.
- Record
CVE-2012-3489- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - CVSS 2.0
- 4.0 Medium
AV:N/AC:L/Au:S/C:P/I:N/A:N - Weakness
- CWE-611
- Updated
- 2026-11-02
CVE ListNo score
The xml_parse function in the libxml2 support in the core server component in PostgreSQL 8.3 before 8.3.20, 8.4 before 8.4.13, 9.0 before 9.0.9, and 9.1 before 9.1.5 allows remote authenticated users to determine the existence of arbitrary files or URLs, and possibly obtain file or URL content that triggers a parsing error, via an XML value that refers to (1) a DTD or (2) an entity, related to an XML External Entity (aka XXE) issue.
- Record
CVE-2012-3489- Updated
- 2026-11-02
EUVDEUVD-2012-3445No score
The xml_parse function in the libxml2 support in the core server component in PostgreSQL 8.3 before 8.3.20, 8.4 before 8.4.13, 9.0 before 9.0.9, and 9.1 before 9.1.5 allows remote authenticated users to determine the existence of arbitrary files or URLs, and possibly obtain file or URL content that triggers a parsing error, via an XML value that refers to (1) a DTD or (2) an entity, related to an XML External Entity (aka XXE) issue.
- Record
EUVD-2012-3445- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-fpq4-mcf9-c5w9
The xml_parse function in the libxml2 support in the core server component in PostgreSQL 8.3...
The xml_parse function in the libxml2 support in the core server component in PostgreSQL 8.3 before 8.3.20, 8.4 before 8.4.13, 9.0 before 9.0.9, and 9.1 before 9.1.5 allows remote authenticated users to determine the existence of arbitrary files or URLs, and possibly obtain file or URL content that triggers a parsing error, via an XML value that refers to (1) a DTD or (2) an entity, related to an XML External Entity (aka XXE) issue.
- Record
GHSA-fpq4-mcf9-c5w9- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-20, CWE-611
- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10030-1No score
postgresql94-9.4.10-1.1 on GA media
These are all security issues fixed in the postgresql94-9.4.10-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10030-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10256-1No score
postgresql93-9.3.15-1.1 on GA media
These are all security issues fixed in the postgresql93-9.3.15-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10256-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10273-1No score
libecpg6-32bit-9.5.4-1.2 on GA media
These are all security issues fixed in the libecpg6-32bit-9.5.4-1.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10273-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
postgresql-8.4Debian:6.0 From an advisory covering 2 CVEs | before 8.4.13-0squeeze1, plus listed versions 8.4.10-0squeeze18.4.10-0squeeze1~bpo50+18.4.10-18.4.11-0squeeze18.4.11-1 Show 22 moreShow less8.4.12-0squeeze18.4.12-18.4.12-28.4.12-38.4.5-0squeeze28.4.5-18.4.5-1~bpo50+18.4.5-28.4.5-2~bpo50+18.4.6-18.4.7-0squeeze1~bpo50+18.4.7-0squeeze28.4.7-18.4.8-0squeeze18.4.8-0squeeze1~bpo50+18.4.8-0squeeze28.4.8-0squeeze2~bpo50+18.4.8-18.4.8-28.4.9-0squeeze18.4.9-0squeeze1~bpo50+18.4.9-1 | 8.4.13-0squeeze1 |
postgresql84Red Hat:enterprise_linux:5::client From an advisory covering 2 CVEs | before 0:8.4.13-1.el5_8 | 0:8.4.13-1.el5_8 |
postgresql84-contribRed Hat:enterprise_linux:5::client From an advisory covering 2 CVEs | before 0:8.4.13-1.el5_8 | 0:8.4.13-1.el5_8 |
postgresql84-debuginfoRed Hat:enterprise_linux:5::client From an advisory covering 2 CVEs | before 0:8.4.13-1.el5_8 | 0:8.4.13-1.el5_8 |
postgresql84-docsRed Hat:enterprise_linux:5::client From an advisory covering 2 CVEs | before 0:8.4.13-1.el5_8 | 0:8.4.13-1.el5_8 |
postgresql84-libsRed Hat:enterprise_linux:5::client From an advisory covering 2 CVEs | before 0:8.4.13-1.el5_8 | 0:8.4.13-1.el5_8 |
postgresql84-pythonRed Hat:enterprise_linux:5::client From an advisory covering 2 CVEs | before 0:8.4.13-1.el5_8 | 0:8.4.13-1.el5_8 |
postgresql84-tclRed Hat:enterprise_linux:5::client From an advisory covering 2 CVEs | before 0:8.4.13-1.el5_8 | 0:8.4.13-1.el5_8 |
postgresql84Red Hat:enterprise_linux:5::client_workstation From an advisory covering 2 CVEs | before 0:8.4.13-1.el5_8 | 0:8.4.13-1.el5_8 |
postgresql84-debuginfoRed Hat:enterprise_linux:5::client_workstation From an advisory covering 2 CVEs | before 0:8.4.13-1.el5_8 | 0:8.4.13-1.el5_8 |
Show 66 moreShow less
| Package | Affected | Fixed |
|---|---|---|
postgresql84-develRed Hat:enterprise_linux:5::client_workstation From an advisory covering 2 CVEs | before 0:8.4.13-1.el5_8 | 0:8.4.13-1.el5_8 |
postgresql84-plperlRed Hat:enterprise_linux:5::client_workstation From an advisory covering 2 CVEs | before 0:8.4.13-1.el5_8 | 0:8.4.13-1.el5_8 |
postgresql84-plpythonRed Hat:enterprise_linux:5::client_workstation From an advisory covering 2 CVEs | before 0:8.4.13-1.el5_8 | 0:8.4.13-1.el5_8 |
postgresql84-pltclRed Hat:enterprise_linux:5::client_workstation From an advisory covering 2 CVEs | before 0:8.4.13-1.el5_8 | 0:8.4.13-1.el5_8 |
postgresql84-serverRed Hat:enterprise_linux:5::client_workstation From an advisory covering 2 CVEs | before 0:8.4.13-1.el5_8 | 0:8.4.13-1.el5_8 |
postgresql84-testRed Hat:enterprise_linux:5::client_workstation From an advisory covering 2 CVEs | before 0:8.4.13-1.el5_8 | 0:8.4.13-1.el5_8 |
postgresql84Red Hat:enterprise_linux:5::server From an advisory covering 2 CVEs | before 0:8.4.13-1.el5_8 | 0:8.4.13-1.el5_8 |
postgresql84-contribRed Hat:enterprise_linux:5::server From an advisory covering 2 CVEs | before 0:8.4.13-1.el5_8 | 0:8.4.13-1.el5_8 |
postgresql84-debuginfoRed Hat:enterprise_linux:5::server From an advisory covering 2 CVEs | before 0:8.4.13-1.el5_8 | 0:8.4.13-1.el5_8 |
postgresql84-develRed Hat:enterprise_linux:5::server From an advisory covering 2 CVEs | before 0:8.4.13-1.el5_8 | 0:8.4.13-1.el5_8 |
postgresql84-docsRed Hat:enterprise_linux:5::server From an advisory covering 2 CVEs | before 0:8.4.13-1.el5_8 | 0:8.4.13-1.el5_8 |
postgresql84-libsRed Hat:enterprise_linux:5::server From an advisory covering 2 CVEs | before 0:8.4.13-1.el5_8 | 0:8.4.13-1.el5_8 |
postgresql84-plperlRed Hat:enterprise_linux:5::server From an advisory covering 2 CVEs | before 0:8.4.13-1.el5_8 | 0:8.4.13-1.el5_8 |
postgresql84-plpythonRed Hat:enterprise_linux:5::server From an advisory covering 2 CVEs | before 0:8.4.13-1.el5_8 | 0:8.4.13-1.el5_8 |
postgresql84-pltclRed Hat:enterprise_linux:5::server From an advisory covering 2 CVEs | before 0:8.4.13-1.el5_8 | 0:8.4.13-1.el5_8 |
postgresql84-pythonRed Hat:enterprise_linux:5::server From an advisory covering 2 CVEs | before 0:8.4.13-1.el5_8 | 0:8.4.13-1.el5_8 |
postgresql84-serverRed Hat:enterprise_linux:5::server From an advisory covering 2 CVEs | before 0:8.4.13-1.el5_8 | 0:8.4.13-1.el5_8 |
postgresql84-tclRed Hat:enterprise_linux:5::server From an advisory covering 2 CVEs | before 0:8.4.13-1.el5_8 | 0:8.4.13-1.el5_8 |
postgresql84-testRed Hat:enterprise_linux:5::server From an advisory covering 2 CVEs | before 0:8.4.13-1.el5_8 | 0:8.4.13-1.el5_8 |
postgresqlRed Hat:enterprise_linux:6::client From an advisory covering 2 CVEs | before 0:8.4.13-1.el6_3 | 0:8.4.13-1.el6_3 |
postgresql-debuginfoRed Hat:enterprise_linux:6::client From an advisory covering 2 CVEs | before 0:8.4.13-1.el6_3 | 0:8.4.13-1.el6_3 |
postgresql-libsRed Hat:enterprise_linux:6::client From an advisory covering 2 CVEs | before 0:8.4.13-1.el6_3 | 0:8.4.13-1.el6_3 |
postgresql-contribRed Hat:enterprise_linux:6::client From an advisory covering 2 CVEs | before 0:8.4.13-1.el6_3 | 0:8.4.13-1.el6_3 |
postgresql-develRed Hat:enterprise_linux:6::client From an advisory covering 2 CVEs | before 0:8.4.13-1.el6_3 | 0:8.4.13-1.el6_3 |
postgresql-docsRed Hat:enterprise_linux:6::client From an advisory covering 2 CVEs | before 0:8.4.13-1.el6_3 | 0:8.4.13-1.el6_3 |
postgresql-plperlRed Hat:enterprise_linux:6::client From an advisory covering 2 CVEs | before 0:8.4.13-1.el6_3 | 0:8.4.13-1.el6_3 |
postgresql-plpythonRed Hat:enterprise_linux:6::client From an advisory covering 2 CVEs | before 0:8.4.13-1.el6_3 | 0:8.4.13-1.el6_3 |
postgresql-pltclRed Hat:enterprise_linux:6::client From an advisory covering 2 CVEs | before 0:8.4.13-1.el6_3 | 0:8.4.13-1.el6_3 |
postgresql-serverRed Hat:enterprise_linux:6::client From an advisory covering 2 CVEs | before 0:8.4.13-1.el6_3 | 0:8.4.13-1.el6_3 |
postgresql-testRed Hat:enterprise_linux:6::client From an advisory covering 2 CVEs | before 0:8.4.13-1.el6_3 | 0:8.4.13-1.el6_3 |
postgresqlRed Hat:enterprise_linux:6::computenode From an advisory covering 2 CVEs | before 0:8.4.13-1.el6_3 | 0:8.4.13-1.el6_3 |
postgresql-debuginfoRed Hat:enterprise_linux:6::computenode From an advisory covering 2 CVEs | before 0:8.4.13-1.el6_3 | 0:8.4.13-1.el6_3 |
postgresql-libsRed Hat:enterprise_linux:6::computenode From an advisory covering 2 CVEs | before 0:8.4.13-1.el6_3 | 0:8.4.13-1.el6_3 |
postgresql-contribRed Hat:enterprise_linux:6::computenode From an advisory covering 2 CVEs | before 0:8.4.13-1.el6_3 | 0:8.4.13-1.el6_3 |
postgresql-develRed Hat:enterprise_linux:6::computenode From an advisory covering 2 CVEs | before 0:8.4.13-1.el6_3 | 0:8.4.13-1.el6_3 |
postgresql-docsRed Hat:enterprise_linux:6::computenode From an advisory covering 2 CVEs | before 0:8.4.13-1.el6_3 | 0:8.4.13-1.el6_3 |
postgresql-plperlRed Hat:enterprise_linux:6::computenode From an advisory covering 2 CVEs | before 0:8.4.13-1.el6_3 | 0:8.4.13-1.el6_3 |
postgresql-plpythonRed Hat:enterprise_linux:6::computenode From an advisory covering 2 CVEs | before 0:8.4.13-1.el6_3 | 0:8.4.13-1.el6_3 |
postgresql-pltclRed Hat:enterprise_linux:6::computenode From an advisory covering 2 CVEs | before 0:8.4.13-1.el6_3 | 0:8.4.13-1.el6_3 |
postgresql-serverRed Hat:enterprise_linux:6::computenode From an advisory covering 2 CVEs | before 0:8.4.13-1.el6_3 | 0:8.4.13-1.el6_3 |
postgresql-testRed Hat:enterprise_linux:6::computenode From an advisory covering 2 CVEs | before 0:8.4.13-1.el6_3 | 0:8.4.13-1.el6_3 |
postgresqlRed Hat:enterprise_linux:6::server From an advisory covering 2 CVEs | before 0:8.4.13-1.el6_3 | 0:8.4.13-1.el6_3 |
postgresql-contribRed Hat:enterprise_linux:6::server From an advisory covering 2 CVEs | before 0:8.4.13-1.el6_3 | 0:8.4.13-1.el6_3 |
postgresql-debuginfoRed Hat:enterprise_linux:6::server From an advisory covering 2 CVEs | before 0:8.4.13-1.el6_3 | 0:8.4.13-1.el6_3 |
postgresql-develRed Hat:enterprise_linux:6::server From an advisory covering 2 CVEs | before 0:8.4.13-1.el6_3 | 0:8.4.13-1.el6_3 |
postgresql-docsRed Hat:enterprise_linux:6::server From an advisory covering 2 CVEs | before 0:8.4.13-1.el6_3 | 0:8.4.13-1.el6_3 |
postgresql-libsRed Hat:enterprise_linux:6::server From an advisory covering 2 CVEs | before 0:8.4.13-1.el6_3 | 0:8.4.13-1.el6_3 |
postgresql-plperlRed Hat:enterprise_linux:6::server From an advisory covering 2 CVEs | before 0:8.4.13-1.el6_3 | 0:8.4.13-1.el6_3 |
postgresql-plpythonRed Hat:enterprise_linux:6::server From an advisory covering 2 CVEs | before 0:8.4.13-1.el6_3 | 0:8.4.13-1.el6_3 |
postgresql-pltclRed Hat:enterprise_linux:6::server From an advisory covering 2 CVEs | before 0:8.4.13-1.el6_3 | 0:8.4.13-1.el6_3 |
postgresql-serverRed Hat:enterprise_linux:6::server From an advisory covering 2 CVEs | before 0:8.4.13-1.el6_3 | 0:8.4.13-1.el6_3 |
postgresql-testRed Hat:enterprise_linux:6::server From an advisory covering 2 CVEs | before 0:8.4.13-1.el6_3 | 0:8.4.13-1.el6_3 |
postgresqlRed Hat:enterprise_linux:6::workstation From an advisory covering 2 CVEs | before 0:8.4.13-1.el6_3 | 0:8.4.13-1.el6_3 |
postgresql-contribRed Hat:enterprise_linux:6::workstation From an advisory covering 2 CVEs | before 0:8.4.13-1.el6_3 | 0:8.4.13-1.el6_3 |
postgresql-debuginfoRed Hat:enterprise_linux:6::workstation From an advisory covering 2 CVEs | before 0:8.4.13-1.el6_3 | 0:8.4.13-1.el6_3 |
postgresql-develRed Hat:enterprise_linux:6::workstation From an advisory covering 2 CVEs | before 0:8.4.13-1.el6_3 | 0:8.4.13-1.el6_3 |
postgresql-docsRed Hat:enterprise_linux:6::workstation From an advisory covering 2 CVEs | before 0:8.4.13-1.el6_3 | 0:8.4.13-1.el6_3 |
postgresql-libsRed Hat:enterprise_linux:6::workstation From an advisory covering 2 CVEs | before 0:8.4.13-1.el6_3 | 0:8.4.13-1.el6_3 |
postgresql-plperlRed Hat:enterprise_linux:6::workstation From an advisory covering 2 CVEs | before 0:8.4.13-1.el6_3 | 0:8.4.13-1.el6_3 |
postgresql-plpythonRed Hat:enterprise_linux:6::workstation From an advisory covering 2 CVEs | before 0:8.4.13-1.el6_3 | 0:8.4.13-1.el6_3 |
postgresql-pltclRed Hat:enterprise_linux:6::workstation From an advisory covering 2 CVEs | before 0:8.4.13-1.el6_3 | 0:8.4.13-1.el6_3 |
postgresql-serverRed Hat:enterprise_linux:6::workstation From an advisory covering 2 CVEs | before 0:8.4.13-1.el6_3 | 0:8.4.13-1.el6_3 |
postgresql-testRed Hat:enterprise_linux:6::workstation From an advisory covering 2 CVEs | before 0:8.4.13-1.el6_3 | 0:8.4.13-1.el6_3 |
postgresql94openSUSE:Tumbleweed From an advisory covering 35 CVEs | before 9.4.10-1.1 | 9.4.10-1.1 |
postgresql93openSUSE:Tumbleweed From an advisory covering 40 CVEs | before 9.3.15-1.1 | 9.3.15-1.1 |
postgresql95openSUSE:Tumbleweed From an advisory covering 37 CVEs | before 9.5.4-1.2 | 9.5.4-1.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2012-3489 is a medium vulnerability (CVSS 6.5) in Postgresql, published August 25, 2012. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.06%, the 87th percentile. No source names a fixed version.
References
rhn.redhat.com/errata/RHSA-2012-1263.html
securityfocus.com/bid/55074
postgresql.org/docs/9.0/static/release-9-0-9.html
mandriva.com/security/advisories?name=MDVSA-2012:139
ubuntu.com/usn/USN-1542-1
secunia.com/advisories/50718
Show 68 moreShow less
blogs.oracle.com/sunsecurity/entry/multiple_vulnerabilities_in_postgresql2
lists.apple.com/archives/security-announce/2013/Mar/msg00002.html
bugzilla.redhat.com/show_bug.cgi?id=849173
debian.org/security/2012/dsa-2534
lists.opensuse.org/opensuse-updates/2012-09/msg00102.html
nvd.nist.gov/vuln/detail/CVE-2012-3489
github.com/advisories/GHSA-fpq4-mcf9-c5w9
access.redhat.com/errata/RHSA-2012:1263
security.access.redhat.com/data/csaf/v2/advisories/2012/rhsa-2012_1263.json
cve.org/CVERecord?id=CVE-2012-3488
suse.com/security/cve/CVE-2007-4772