{"schemaVersion":3,"id":"CVE-2012-3489","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"The xml_parse function in the libxml2 support in the core server component in PostgreSQL 8.3 before 8.3.20, 8.4 before 8.4.13, 9.0 before 9.0.9, and 9.1 before 9.1.5 allows remote authenticated users to determine the existence of arbitrary files or URLs, and possibly obtain file or URL content that triggers a parsing error, via an XML value that refers to (1) a DTD or (2) an entity, related to an XML External Entity (aka XXE) issue.","dates":{"published":"2012-10-03T21:00:00.000Z","modified":"2024-08-06T20:05:12.659Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":6.5,"severity":"medium","version":"3.1","versionLabel":"v3.1","source":"NVD","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":6.5,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","exploitability":null,"impact":null,"computed":false},{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":4,"severity":"medium","vector":"AV:N/AC:L/Au:S/C:P/I:N/A:N","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.03057,"percentile":0.87418,"severity":"low","asOf":"2026-10-20T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-20T00:00:00.000Z","baselineScore":0.03057},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.03057,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.03057,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.03057,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.03057,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.03057,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.03057,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.03057,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.03057,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.03057,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.03057,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.03057,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.03057,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.03057,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.03057,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.03057,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.03057,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.03057,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.03057,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.03057,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.03057,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.03057,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.03057,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.03057,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.03057,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.03057,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.03057,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.03057,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.03057,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.03057,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.03057,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.03057,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.03057,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.03057,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.03057,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.03057,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.03057,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.03057,"percentile":0.87418}],"last30":[{"date":"2026-09-20T00:00:00.000Z","score":0.03057,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.03057,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.03057,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.03057,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.03057,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.03057,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.03057,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.03057,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.03057,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.03057,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.03057,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.03057,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.03057,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.03057,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.03057,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.03057,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.03057,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.03057,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.03057,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.03057,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.03057,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.03057,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.03057,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.03057,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.03057,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.03057,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.03057,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.03057,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.03057,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.03057,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.03057,"percentile":0.87418}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-611","name":"Improper Restriction of XML External Entity Reference","description":"The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.","type":"weakness","status":"Draft","abstraction":"Base","likelihoodOfExploit":null,"url":"https://cwe.mitre.org/data/definitions/611.html"}],"affected":[{"vendor":"apple","product":"mac_os_x_server","name":"mac os x server","label":"mac_os_x_server","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≥ 10.7.0, ≤ 10.7.5","noFixRecorded":false,"fixedIn":null},{"text":"10.6.8","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 10.7.0, ≤ 10.7.5 | 10.6.8","eol":null,"hubHref":"/vendor/apple/mac_os_x_server"},{"vendor":"canonical","product":"ubuntu_linux","name":"ubuntu linux","label":"ubuntu_linux","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"8.04","noFixRecorded":false,"fixedIn":null},{"text":"10.04","noFixRecorded":false,"fixedIn":null},{"text":"11.04","noFixRecorded":false,"fixedIn":null},{"text":"11.10","noFixRecorded":false,"fixedIn":null},{"text":"12.04","noFixRecorded":false,"fixedIn":null}],"versionsText":"8.04 | 10.04 | 11.04 | 11.10 | 12.04","eol":{"isEol":true,"eolDate":"2013-05-09T00:00:00.000Z","matchMethod":"cpe","cycle":{"name":"8.04","label":"8.04 'Hardy Heron' (LTS)","eolFrom":"2013-05-09T00:00:00.000Z","isLts":true,"isMaintained":false,"latestVersion":"8.04.4"},"product":{"name":"ubuntu","label":"Ubuntu","category":"os"}},"hubHref":"/vendor/canonical/ubuntu_linux"},{"vendor":"debian","product":"debian_linux","name":"debian linux","label":"debian_linux","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"6.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"6.0","eol":{"isEol":true,"eolDate":"2016-02-29T00:00:00.000Z","matchMethod":"cpe","cycle":{"name":"6","label":"6 (Squeeze)","eolFrom":"2016-02-29T00:00:00.000Z","isLts":false,"isMaintained":false,"latestVersion":"6.0.10"},"product":{"name":"debian","label":"Debian","category":"os"}},"hubHref":"/vendor/debian/debian_linux"},{"vendor":"opensuse","product":"opensuse","name":"opensuse","label":"opensuse","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"11.4","noFixRecorded":false,"fixedIn":null},{"text":"12.1","noFixRecorded":false,"fixedIn":null},{"text":"12.2","noFixRecorded":false,"fixedIn":null}],"versionsText":"11.4 | 12.1 | 12.2","eol":{"isEol":true,"eolDate":"2012-11-05T00:00:00.000Z","matchMethod":"cpe","cycle":{"name":"11.4","label":"11.4","eolFrom":"2012-11-05T00:00:00.000Z","isLts":false,"isMaintained":false,"latestVersion":null},"product":{"name":"opensuse","label":"openSUSE","category":"os"}},"hubHref":"/vendor/opensuse/opensuse"},{"vendor":"postgresql","product":"postgresql","name":"postgresql","label":"postgresql","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 8.3.0, < 8.3.20","noFixRecorded":false,"fixedIn":null},{"text":"≥ 8.4.0, < 8.4.13","noFixRecorded":false,"fixedIn":null},{"text":"≥ 9.0.0, < 9.0.9","noFixRecorded":false,"fixedIn":null},{"text":"≥ 9.1.0, < 9.1.5","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 8.3.0, < 8.3.20 | ≥ 8.4.0, < 8.4.13 | ≥ 9.0.0, < 9.0.9 | ≥ 9.1.0, < 9.1.5","eol":{"isEol":null,"eolDate":null,"matchMethod":"cpe","cycle":null,"product":{"name":"postgresql","label":"PostgreSQL","category":"database"}},"hubHref":"/vendor/postgresql/postgresql"},{"vendor":"redhat","product":"enterprise_linux_desktop","name":"enterprise linux desktop","label":"enterprise_linux_desktop","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"5.0","noFixRecorded":false,"fixedIn":null},{"text":"6.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"5.0 | 6.0","eol":null,"hubHref":"/vendor/redhat/enterprise_linux_desktop"},{"vendor":"redhat","product":"enterprise_linux_eus","name":"enterprise linux eus","label":"enterprise_linux_eus","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"6.3","noFixRecorded":false,"fixedIn":null}],"versionsText":"6.3","eol":null,"hubHref":"/vendor/redhat/enterprise_linux_eus"},{"vendor":"redhat","product":"enterprise_linux_server","name":"enterprise linux server","label":"enterprise_linux_server","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"5.0","noFixRecorded":false,"fixedIn":null},{"text":"6.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"5.0 | 6.0","eol":null,"hubHref":"/vendor/redhat/enterprise_linux_server"},{"vendor":"redhat","product":"enterprise_linux_workstation","name":"enterprise linux workstation","label":"enterprise_linux_workstation","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"5.0","noFixRecorded":false,"fixedIn":null},{"text":"6.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"5.0 | 6.0","eol":null,"hubHref":"/vendor/redhat/enterprise_linux_workstation"}],"affectedCount":9,"eol":{"hasEol":true,"count":3},"references":[{"url":"http://rhn.redhat.com/errata/RHSA-2012-1263.html","label":"rhn.redhat.com/errata/RHSA-2012-1263.html","hostname":"rhn.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT","Third Party Advisory"]},{"url":"http://www.securityfocus.com/bid/55074","label":"www.securityfocus.com/bid/55074","hostname":"www.securityfocus.com","tags":["VDB Entry","X Refsource BID","Broken Link","Third Party Advisory"]},{"url":"http://www.postgresql.org/docs/9.0/static/release-9-0-9.html","label":"www.postgresql.org/docs/9.0/static/release-9-0-9.html","hostname":"www.postgresql.org","tags":["X Refsource CONFIRM","Release Notes"]},{"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2012:139","label":"www.mandriva.com/security/advisories?name=MDVSA-2012:139","hostname":"www.mandriva.com","tags":["Vendor Advisory","X Refsource MANDRIVA","Broken Link"]},{"url":"http://www.ubuntu.com/usn/USN-1542-1","label":"www.ubuntu.com/usn/USN-1542-1","hostname":"www.ubuntu.com","tags":["Vendor Advisory","X Refsource UBUNTU","Third Party Advisory"]},{"url":"http://secunia.com/advisories/50718","label":"secunia.com/advisories/50718","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA","Broken Link"]},{"url":"http://www.postgresql.org/docs/9.1/static/release-9-1-5.html","label":"www.postgresql.org/docs/9.1/static/release-9-1-5.html","hostname":"www.postgresql.org","tags":["X Refsource CONFIRM","Release Notes"]},{"url":"https://blogs.oracle.com/sunsecurity/entry/multiple_vulnerabilities_in_postgresql2","label":"blogs.oracle.com/sunsecurity/entry/multiple_vulnerabilities_in_postgresql2","hostname":"blogs.oracle.com","tags":["X Refsource CONFIRM","Third Party Advisory"]},{"url":"http://www.postgresql.org/docs/8.4/static/release-8-4-13.html","label":"www.postgresql.org/docs/8.4/static/release-8-4-13.html","hostname":"www.postgresql.org","tags":["X Refsource CONFIRM","Release Notes"]},{"url":"http://www.postgresql.org/docs/8.3/static/release-8-3-20.html","label":"www.postgresql.org/docs/8.3/static/release-8-3-20.html","hostname":"www.postgresql.org","tags":["X Refsource CONFIRM","Release Notes"]},{"url":"http://www.postgresql.org/about/news/1407/","label":"www.postgresql.org/about/news/1407/","hostname":"www.postgresql.org","tags":["X Refsource CONFIRM","Vendor Advisory"]},{"url":"http://secunia.com/advisories/50635","label":"secunia.com/advisories/50635","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA","Broken Link"]},{"url":"http://www.postgresql.org/support/security/","label":"www.postgresql.org/support/security/","hostname":"www.postgresql.org","tags":["X Refsource CONFIRM","Release Notes","Vendor Advisory"]},{"url":"http://lists.apple.com/archives/security-announce/2013/Mar/msg00002.html","label":"lists.apple.com/archives/security-announce/2013/Mar/msg00002.html","hostname":"lists.apple.com","tags":["Vendor Advisory","X Refsource APPLE","Mailing List"]},{"url":"http://secunia.com/advisories/50946","label":"secunia.com/advisories/50946","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA","Broken Link"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=849173","label":"bugzilla.redhat.com/show_bug.cgi?id=849173","hostname":"bugzilla.redhat.com","tags":["X Refsource CONFIRM","Issue Tracking","Patch","Release Notes"]},{"url":"http://www.debian.org/security/2012/dsa-2534","label":"www.debian.org/security/2012/dsa-2534","hostname":"www.debian.org","tags":["Vendor Advisory","X Refsource DEBIAN","Mailing List"]},{"url":"http://lists.opensuse.org/opensuse-updates/2012-09/msg00102.html","label":"lists.opensuse.org/opensuse-updates/2012-09/msg00102.html","hostname":"lists.opensuse.org","tags":["Vendor Advisory","X Refsource SUSE","Mailing List"]},{"url":"http://lists.opensuse.org/opensuse-updates/2012-10/msg00013.html","label":"lists.opensuse.org/opensuse-updates/2012-10/msg00013.html","hostname":"lists.opensuse.org","tags":["Vendor Advisory","X Refsource SUSE","Mailing List"]},{"url":"http://secunia.com/advisories/50859","label":"secunia.com/advisories/50859","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA","Broken Link"]},{"url":"http://lists.opensuse.org/opensuse-updates/2012-10/msg00024.html","label":"lists.opensuse.org/opensuse-updates/2012-10/msg00024.html","hostname":"lists.opensuse.org","tags":["Vendor Advisory","X Refsource SUSE","Mailing List"]}],"lineage":{"upstream":[],"downstream":["DSA-2534-1","OPENSUSE-SU-2024:10030-1","OPENSUSE-SU-2024:10256-1","OPENSUSE-SU-2024:10273-1","RHSA-2012:1263"],"duplicates":[],"related":["OPENSUSE-SU-2024:10030-1","OPENSUSE-SU-2024:10256-1","OPENSUSE-SU-2024:10273-1"]},"timeline":[{"kind":"published","date":"2012-10-03T21:00:00.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2024-08-06T20:05:12.659Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":27,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T17:54:09.894Z","stale":false,"partial":false}}