{"id":"CVE-2012-3489","aliases":["DSA-2534-1","EUVD-2012-3445","GHSA-fpq4-mcf9-c5w9","RHSA-2012:1263","openSUSE-SU-2024:10030-1","openSUSE-SU-2024:10256-1","openSUSE-SU-2024:10273-1"],"status":"published","title":"The xml_parse function in the libxml2 support in the core server component in PostgreSQL 8.3...","description":"The xml_parse function in the libxml2 support in the core server component in PostgreSQL 8.3 before 8.3.20, 8.4 before 8.4.13, 9.0 before 9.0.9, and 9.1 before 9.1.5 allows remote authenticated users to determine the existence of arbitrary files or URLs, and possibly obtain file or URL content that triggers a parsing error, via an XML value that refers to (1) a DTD or (2) an entity, related to an XML External Entity (aka XXE) issue.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.03057,"percentile":0.87678,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-20","CWE-611"],"published":"2012-08-25T00:00:00Z","modified":"2026-06-26T12:21:42Z","affected":[{"source":"osv","ecosystem":"Debian:6.0","package":"postgresql-8.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.13-0squeeze1"}]}],"versions":["8.4.10-0squeeze1","8.4.10-0squeeze1~bpo50+1","8.4.10-1","8.4.11-0squeeze1","8.4.11-1","8.4.12-0squeeze1","8.4.12-1","8.4.12-2","8.4.12-3","8.4.5-0squeeze2","8.4.5-1","8.4.5-1~bpo50+1","8.4.5-2","8.4.5-2~bpo50+1","8.4.6-1","8.4.7-0squeeze1~bpo50+1","8.4.7-0squeeze2","8.4.7-1","8.4.8-0squeeze1","8.4.8-0squeeze1~bpo50+1","8.4.8-0squeeze2","8.4.8-0squeeze2~bpo50+1","8.4.8-1","8.4.8-2","8.4.9-0squeeze1","8.4.9-0squeeze1~bpo50+1","8.4.9-1"],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client","package":"postgresql84","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.13-1.el5_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client","package":"postgresql84-contrib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.13-1.el5_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client","package":"postgresql84-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.13-1.el5_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client","package":"postgresql84-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.13-1.el5_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client","package":"postgresql84-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.13-1.el5_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client","package":"postgresql84-python","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.13-1.el5_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client","package":"postgresql84-tcl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.13-1.el5_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client_workstation","package":"postgresql84","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.13-1.el5_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client_workstation","package":"postgresql84-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.13-1.el5_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client_workstation","package":"postgresql84-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.13-1.el5_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client_workstation","package":"postgresql84-plperl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.13-1.el5_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client_workstation","package":"postgresql84-plpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.13-1.el5_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client_workstation","package":"postgresql84-pltcl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.13-1.el5_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client_workstation","package":"postgresql84-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.13-1.el5_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client_workstation","package":"postgresql84-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.13-1.el5_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"postgresql84","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.13-1.el5_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"postgresql84-contrib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.13-1.el5_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"postgresql84-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.13-1.el5_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"postgresql84-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.13-1.el5_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"postgresql84-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.13-1.el5_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"postgresql84-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.13-1.el5_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"postgresql84-plperl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.13-1.el5_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"postgresql84-plpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.13-1.el5_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"postgresql84-pltcl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.13-1.el5_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"postgresql84-python","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.13-1.el5_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"postgresql84-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.13-1.el5_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"postgresql84-tcl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.13-1.el5_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"postgresql84-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.13-1.el5_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"postgresql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.13-1.el6_3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"postgresql-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.13-1.el6_3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"postgresql-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.13-1.el6_3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"postgresql-contrib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.13-1.el6_3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"postgresql-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.13-1.el6_3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"postgresql-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.13-1.el6_3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"postgresql-plperl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.13-1.el6_3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"postgresql-plpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.13-1.el6_3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"postgresql-pltcl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.13-1.el6_3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"postgresql-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.13-1.el6_3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"postgresql-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.13-1.el6_3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"postgresql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.13-1.el6_3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"postgresql-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.13-1.el6_3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"postgresql-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.13-1.el6_3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"postgresql-contrib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.13-1.el6_3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"postgresql-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.13-1.el6_3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"postgresql-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.13-1.el6_3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"postgresql-plperl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.13-1.el6_3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"postgresql-plpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.13-1.el6_3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"postgresql-pltcl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.13-1.el6_3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"postgresql-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.13-1.el6_3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"postgresql-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.13-1.el6_3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"postgresql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.13-1.el6_3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"postgresql-contrib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.13-1.el6_3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"postgresql-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.13-1.el6_3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"postgresql-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.13-1.el6_3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"postgresql-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.13-1.el6_3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"postgresql-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.13-1.el6_3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"postgresql-plperl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.13-1.el6_3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"postgresql-plpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.13-1.el6_3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"postgresql-pltcl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.13-1.el6_3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"postgresql-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.13-1.el6_3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"postgresql-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.13-1.el6_3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"postgresql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.13-1.el6_3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"postgresql-contrib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.13-1.el6_3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"postgresql-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.13-1.el6_3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"postgresql-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.13-1.el6_3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"postgresql-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.13-1.el6_3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"postgresql-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.13-1.el6_3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"postgresql-plperl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.13-1.el6_3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"postgresql-plpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.13-1.el6_3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"postgresql-pltcl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.13-1.el6_3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"postgresql-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.13-1.el6_3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"postgresql-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.13-1.el6_3"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"postgresql94","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.10-1.1"}]}],"bundled":35},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"postgresql93","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.3.15-1.1"}]}],"bundled":40},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"postgresql95","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.4-1.2"}]}],"bundled":37}],"products":[{"vendor":"apple","product":"mac_os_x_server"},{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"debian","product":"debian_linux"},{"vendor":"opensuse","product":"opensuse"},{"vendor":"postgresql","product":"postgresql"},{"vendor":"redhat","product":"enterprise_linux_desktop"},{"vendor":"redhat","product":"enterprise_linux_eus"},{"vendor":"redhat","product":"enterprise_linux_server"},{"vendor":"redhat","product":"enterprise_linux_workstation"}],"references":[{"url":"http://rhn.redhat.com/errata/RHSA-2012-1263.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory"]},{"url":"http://www.securityfocus.com/bid/55074","tags":["vdb-entry","x_refsource_BID","x_transferred","Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://www.postgresql.org/docs/9.0/static/release-9-0-9.html","tags":["x_refsource_CONFIRM","x_transferred","Release Notes"]},{"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2012:139","tags":["vendor-advisory","x_refsource_MANDRIVA","x_transferred","Broken Link"]},{"url":"http://www.ubuntu.com/usn/USN-1542-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory"]},{"url":"http://secunia.com/advisories/50718","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Broken Link"]},{"url":"http://www.postgresql.org/docs/9.1/static/release-9-1-5.html","tags":["x_refsource_CONFIRM","x_transferred","Release Notes"]},{"url":"https://blogs.oracle.com/sunsecurity/entry/multiple_vulnerabilities_in_postgresql2","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory"]},{"url":"http://www.postgresql.org/docs/8.4/static/release-8-4-13.html","tags":["x_refsource_CONFIRM","x_transferred","Release Notes","article"]},{"url":"http://www.postgresql.org/docs/8.3/static/release-8-3-20.html","tags":["x_refsource_CONFIRM","x_transferred","Release Notes"]},{"url":"http://www.postgresql.org/about/news/1407/","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory"]},{"url":"http://secunia.com/advisories/50635","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Broken Link"]},{"url":"http://www.postgresql.org/support/security/","tags":["x_refsource_CONFIRM","x_transferred","Release Notes","Vendor Advisory"]},{"url":"http://lists.apple.com/archives/security-announce/2013/Mar/msg00002.html","tags":["vendor-advisory","x_refsource_APPLE","x_transferred","Mailing List"]},{"url":"http://secunia.com/advisories/50946","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Broken Link"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=849173","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Patch","Release Notes","report"]},{"url":"http://www.debian.org/security/2012/dsa-2534","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Mailing List"]},{"url":"http://lists.opensuse.org/opensuse-updates/2012-09/msg00102.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List"]},{"url":"http://lists.opensuse.org/opensuse-updates/2012-10/msg00013.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List"]},{"url":"http://secunia.com/advisories/50859","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Broken Link"]},{"url":"http://lists.opensuse.org/opensuse-updates/2012-10/msg00024.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2012-3489","tags":["advisory"]},{"url":"http://www.postgresql.org/about/news/1407"},{"url":"http://www.postgresql.org/support/security"},{"url":"https://github.com/advisories/GHSA-fpq4-mcf9-c5w9"},{"url":"https://access.redhat.com/errata/RHSA-2012:1263","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=849172","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2012/rhsa-2012_1263.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2012-3488","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2012-3488","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2012-3488","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2012-3489","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2012-3489","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2007-4772","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2007-6600","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2009-4034","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2009-4136","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2010-1169","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2010-1170","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2010-3433","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-0866","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-0867","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-0868","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-2143","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-2655","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-3488","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-3489","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-0255","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1899","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1900","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1901","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0060","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0061","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0062","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0063","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0064","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0065","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0066","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0067","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3165","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3166","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3167","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5288","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5289","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-0766","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-0773","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5423","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5424","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-8161","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-0241","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-0242","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-0243","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-0244","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2193","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-3065","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2012-3489","description":"The xml_parse function in the libxml2 support in the core server component in PostgreSQL 8.3 before 8.3.20, 8.4 before 8.4.13, 9.0 before 9.0.9, and 9.1 before 9.1.5 allows remote authenticated users to determine the existence of arbitrary files or URLs, and possibly obtain file or URL content that triggers a parsing error, via an XML value that refers to (1) a DTD or (2) an entity, related to an XML External Entity (aka XXE) issue.","status":"published","published":"2012-10-03T21:00:00Z","modified":"2024-08-06T20:05:12.659Z","updated_at":"2026-11-02T14:34:50.615647Z"}],"euvd":[{"id":"EUVD-2012-3445","description":"The xml_parse function in the libxml2 support in the core server component in PostgreSQL 8.3 before 8.3.20, 8.4 before 8.4.13, 9.0 before 9.0.9, and 9.1 before 9.1.5 allows remote authenticated users to determine the existence of arbitrary files or URLs, and possibly obtain file or URL content that triggers a parsing error, via an XML value that refers to (1) a DTD or (2) an entity, related to an XML External Entity (aka XXE) issue.","status":"published","published":"2012-10-03T21:00:00Z","modified":"2024-08-06T20:05:12Z","updated_at":"2026-11-03T01:56:10.882899Z"}],"ghsa":[{"id":"GHSA-fpq4-mcf9-c5w9","title":"The xml_parse function in the libxml2 support in the core server component in PostgreSQL 8.3...","description":"The xml_parse function in the libxml2 support in the core server component in PostgreSQL 8.3 before 8.3.20, 8.4 before 8.4.13, 9.0 before 9.0.9, and 9.1 before 9.1.5 allows remote authenticated users to determine the existence of arbitrary files or URLs, and possibly obtain file or URL content that triggers a parsing error, via an XML value that refers to (1) a DTD or (2) an entity, related to an XML External Entity (aka XXE) issue.","status":"published","published":"2022-05-17T05:02:45Z","modified":"2026-03-21T05:38:28Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-20","CWE-611"],"updated_at":"2026-11-02T15:06:45.356317Z"}],"nvd":[{"id":"CVE-2012-3489","description":"The xml_parse function in the libxml2 support in the core server component in PostgreSQL 8.3 before 8.3.20, 8.4 before 8.4.13, 9.0 before 9.0.9, and 9.1 before 9.1.5 allows remote authenticated users to determine the existence of arbitrary files or URLs, and possibly obtain file or URL content that triggers a parsing error, via an XML value that refers to (1) a DTD or (2) an entity, related to an XML External Entity (aka XXE) issue.","status":"published","published":"2012-10-03T21:55:00.813Z","modified":"2026-06-16T23:43:19.497Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4,"vector":"AV:N/AC:L/Au:S/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-611"],"updated_at":"2026-11-02T14:02:16.115119Z"}],"osv":[{"id":"DSA-2534-1","title":"postgresql-8.4 - several","status":"published","published":"2012-08-25T00:00:00Z","modified":"2026-03-09T01:20:23.275812Z","updated_at":"2026-11-02T15:46:15.489951Z"},{"id":"openSUSE-SU-2024:10030-1","title":"postgresql94-9.4.10-1.1 on GA media","description":"These are all security issues fixed in the postgresql94-9.4.10-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:28:08.668099Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"openSUSE-SU-2024:10256-1","title":"postgresql93-9.3.15-1.1 on GA media","description":"These are all security issues fixed in the postgresql93-9.3.15-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2025-05-07T18:08:24.407905Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"openSUSE-SU-2024:10273-1","title":"libecpg6-32bit-9.5.4-1.2 on GA media","description":"These are all security issues fixed in the libecpg6-32bit-9.5.4-1.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:33:24.576512Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"RHSA-2012:1263","title":"Red Hat Security Advisory: postgresql and postgresql84 security update","status":"published","published":"2024-09-15T20:14:22Z","modified":"2026-06-26T12:21:42.793535719Z","updated_at":"2026-11-02T15:53:01.495018Z"}]}}