The libxslt support in contrib/xml2 in PostgreSQL 8.3 before 8.3.20, 8.4 before 8.4.13, 9.0 before 9.0.9, and 9.1 before 9.1.5 does not properly restrict access to files and URLs, which allows remote authenticated users to modify data, obtain sensitive information, or trigger outbound traffic to arbitrary external hosts by leveraging (1) stylesheet commands that are permitted by the libxslt security options or (2) an xslt_process feature, related to an XML External Entity (aka XXE) issue.
CVSS Details
- CVSS 3.1 Base Score: 8.1
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade postgresql | Aug 30, 2017 | Oct 3, 2012 |
| Apple Osx Note | — | Apply OS X security update 2013-002Apply OS X security update 2013-001Upgrade macOS to the latest version | Aug 28, 2015 | Oct 3, 2012 |
| Apple Osx Postgresql | — | Apply OS X security update 2013-001 | Apr 3, 2013 | Oct 3, 2012 |
| Centos_linux | — | Upgrade postgresql-pltclUpgrade postgresql-libsUpgrade postgresql84-pltclUpgrade postgresql-plperlUpgrade postgresql-serverUpgrade postgresql84-pythonUpgrade postgresql-plUpgrade postgresql84-libsUpgrade postgresqlUpgrade postgresql-contribUpgrade postgresql84-serverUpgrade postgresql-plpythonUpgrade postgresql84-develUpgrade postgresql-testUpgrade postgresql-pythonUpgrade postgresql84-plpythonUpgrade postgresql-develUpgrade postgresql84-docsUpgrade postgresql84-testUpgrade postgresql-tclUpgrade postgresql-docsUpgrade postgresql84Upgrade postgresql84-contribUpgrade postgresql84-tclUpgrade postgresql84-plperl | Dec 1, 2016 | Oct 3, 2012 |
| Freebsd | — | Upgrade postgresql-server | Dec 10, 2025 | Aug 17, 2012 |
| Gentoo Linux | — | Upgrade dev-db/postgresql-server. | Oct 30, 2017 | Oct 3, 2012 |
| Oracle_linux | — | Upgrade postgresql84-libsUpgrade postgresql-serverUpgrade postgresql84-develUpgrade postgresql-plperlUpgrade postgresql84-serverUpgrade postgresql-libsUpgrade postgresql84Upgrade postgresql-pltclUpgrade postgresql-develUpgrade postgresql84-contribUpgrade postgresql-docsUpgrade postgresql84-pltclUpgrade postgresql-plpythonUpgrade postgresql84-tclUpgrade postgresql-contribUpgrade postgresql-tclUpgrade postgresql-testUpgrade postgresql84-pythonUpgrade postgresql84-testUpgrade postgresql-plUpgrade postgresql84-docsUpgrade postgresql84-plperlUpgrade postgresql-pythonUpgrade postgresql84-plpythonUpgrade postgresql | Oct 16, 2024 | Oct 3, 2012 |
| Postgres | — | Upgrade to PostgreSQL version 9.1.5Upgrade to PostgreSQL version 8.3.20Upgrade to PostgreSQL version 8.4.13Upgrade to PostgreSQL version 9.0.9 | Feb 24, 2013 | Oct 3, 2012 |
| Suse | — | Upgrade libecpg6Upgrade postgresql93Upgrade postgresql94-contribUpgrade postgresql94-develUpgrade postgresql10-plperlUpgrade postgresql91-docsUpgrade postgresql96Upgrade postgresql-docsUpgrade postgresql10-docsUpgrade postgresql93-docsUpgrade postgresql10-plpythonUpgrade postgresql94Upgrade postgresql96-docsUpgrade postgresql96-contribUpgrade postgresql96-serverUpgrade postgresql94-docsUpgrade postgresql10-pltclUpgrade postgresql93-serverUpgrade postgresql93-develUpgrade postgresql-serverUpgrade postgresql96-develUpgrade postgresql93-contribUpgrade postgresql10-serverUpgrade postgresql91-serverUpgrade postgresql10-develUpgrade postgresql10Upgrade postgresql94-serverUpgrade postgresql10-contribUpgrade postgresql-develUpgrade libpq5-32bitUpgrade postgresql91Upgrade postgresql-contribUpgrade postgresql91-contribUpgrade libpq5Upgrade postgresql | Dec 12, 2013 | Jun 28, 2013 |
| Ubuntu | — | Upgrade postgresql-8.4Upgrade postgresql-9.1Upgrade postgresql-8.3 | Nov 8, 2024 | Oct 3, 2012 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub