The xml_parse function in the libxml2 support in the core server component in PostgreSQL 8.3 before 8.3.20, 8.4 before 8.4.13, 9.0 before 9.0.9, and 9.1 before 9.1.5 allows remote authenticated users to determine the existence of arbitrary files or URLs, and possibly obtain file or URL content that triggers a parsing error, via an XML value that refers to (1) a DTD or (2) an entity, related to an XML External Entity (aka XXE) issue.
CVSS Details
- CVSS 3.1 Base Score: 6.5
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade postgresql | Aug 30, 2017 | Oct 3, 2012 |
| Apple Osx Note | — | Upgrade macOS to the latest versionApply OS X security update 2013-001Apply OS X security update 2013-002 | Aug 28, 2015 | Oct 3, 2012 |
| Apple Osx Postgresql | — | Apply OS X security update 2013-001 | Apr 3, 2013 | Oct 3, 2012 |
| Centos_linux | — | Upgrade postgresql84-pltclUpgrade postgresql84-develUpgrade postgresql84-contribUpgrade postgresql84-docsUpgrade postgresql84-tclUpgrade postgresql-develUpgrade postgresql-docsUpgrade postgresql84-serverUpgrade postgresql-contribUpgrade postgresql84Upgrade postgresql84-testUpgrade postgresql-libsUpgrade postgresql84-libsUpgrade postgresqlUpgrade postgresql-serverUpgrade postgresql84-plpythonUpgrade postgresql84-pythonUpgrade postgresql-plpythonUpgrade postgresql-testUpgrade postgresql84-plperlUpgrade postgresql-pltclUpgrade postgresql-plperl | Dec 1, 2016 | Oct 3, 2012 |
| Freebsd | — | Upgrade postgresql-server | Dec 10, 2025 | Aug 17, 2012 |
| Gentoo Linux | — | Upgrade dev-db/postgresql-server. | Oct 30, 2017 | Oct 3, 2012 |
| Oracle_linux | — | Upgrade postgresql-serverUpgrade postgresql84-tclUpgrade postgresql84-plperlUpgrade postgresqlUpgrade postgresql-testUpgrade postgresql-docsUpgrade postgresql84Upgrade postgresql84-contribUpgrade postgresql84-testUpgrade postgresql84-pltclUpgrade postgresql-plperlUpgrade postgresql-libsUpgrade postgresql84-serverUpgrade postgresql-contribUpgrade postgresql84-plpythonUpgrade postgresql-pltclUpgrade postgresql84-docsUpgrade postgresql84-pythonUpgrade postgresql84-libsUpgrade postgresql-develUpgrade postgresql84-develUpgrade postgresql-plpython | Oct 16, 2024 | Oct 3, 2012 |
| Postgres | — | Upgrade to PostgreSQL version 8.4.13Upgrade to PostgreSQL version 8.3.20Upgrade to PostgreSQL version 9.0.9Upgrade to PostgreSQL version 9.1.5 | Feb 24, 2013 | Oct 3, 2012 |
| Suse | — | Upgrade postgresql10-pltclUpgrade postgresql91-docsUpgrade postgresql94Upgrade postgresql93-docsUpgrade postgresql96-docsUpgrade postgresql94-docsUpgrade postgresql96-contribUpgrade libecpg6Upgrade postgresql96-serverUpgrade postgresql10-docsUpgrade postgresql-docsUpgrade postgresql94-contribUpgrade postgresql96Upgrade postgresql10-plperlUpgrade postgresql94-develUpgrade postgresql-contribUpgrade postgresql93-contribUpgrade postgresql93Upgrade postgresql91-contribUpgrade postgresql10-plpythonUpgrade postgresql10-contribUpgrade postgresql91Upgrade postgresql10-serverUpgrade postgresql-develUpgrade libpq5Upgrade postgresql10-develUpgrade postgresql-serverUpgrade postgresqlUpgrade postgresql10Upgrade postgresql93-serverUpgrade libpq5-32bitUpgrade postgresql93-develUpgrade postgresql96-develUpgrade postgresql91-serverUpgrade postgresql94-server | Dec 12, 2013 | Jun 28, 2013 |
| Ubuntu | — | Upgrade postgresql-8.4Upgrade postgresql-8.3Upgrade postgresql-9.1 | Nov 8, 2024 | Oct 3, 2012 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub