CVE-2012-3489: apple mac_os_x_server
Vulnerability summary
CVE-2012-3489 is a medium (CVSS 6.5) vulnerability in apple mac_os_x_server. EPSS estimates a 3.06% chance of exploitation in the next 30 days, higher than 87.4% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 5 · Related 3Timeline
- 03-10-2012PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
The xml_parse function in the libxml2 support in the core server component in PostgreSQL 8.3 before 8.3.20, 8.4 before 8.4.13, 9.0 before 9.0.9, and 9.1 before 9.1.5 allows remote authenticated users to determine the existence of arbitrary files or URLs, and possibly obtain file or URL content that triggers a parsing error, via an XML value that refers to (1) a DTD or (2) an entity, related to an XML External Entity (aka XXE) issue.
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
3.06%
Chance of exploitation in the next 30 days
Percentile
87%
Versus all other CVEs
30-day change
0.00 pp
From 3.06% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Redhat4 products
- enterprise_linux_desktop5.0 | 6.0
- enterprise_linux_eus6.3
- enterprise_linux_server5.0 | 6.0
- enterprise_linux_workstation5.0 | 6.0
Apple1 product
- mac_os_x_server≥ 10.7.0, ≤ 10.7.5 | 10.6.8
Canonical1 product
- ubuntu_linuxEOL8.04 | 10.04 | 11.04 | 11.10 | 12.04
Debian1 product
- debian_linuxEOL6.0
Opensuse1 product
- opensuseEOL11.4 | 12.1 | 12.2
Postgresql1 product
- postgresql≥ 8.3.0, < 8.3.20 | ≥ 8.4.0, < 8.4.13 | ≥ 9.0.0, < 9.0.9 | ≥ 9.1.0, < 9.1.5
6 vendors · 9 products
References
21 links- www.mandriva.com/security/advisories?name=MDVSA-2012:139Vendor AdvisoryX Refsource MANDRIVABroken Link
- blogs.oracle.com/sunsecurity/entry/multiple_vulnerabilities_in_postgresql2X Refsource CONFIRMThird Party Advisory
Show all 21 references
- lists.apple.com/archives/security-announce/2013/Mar/msg00002.htmlVendor AdvisoryX Refsource APPLEMailing List
- lists.opensuse.org/opensuse-updates/2012-09/msg00102.htmlVendor AdvisoryX Refsource SUSEMailing List
- lists.opensuse.org/opensuse-updates/2012-10/msg00013.htmlVendor AdvisoryX Refsource SUSEMailing List
- lists.opensuse.org/opensuse-updates/2012-10/msg00024.htmlVendor AdvisoryX Refsource SUSEMailing List