The xml_parse function in the libxml2 support in the core server component in PostgreSQL 8.3 before 8.3.20, 8.4 before 8.4.13, 9.0 before 9.0.9, and 9.1 before 9.1.5 allows remote authenticated users to determine the existence of arbitrary files or URLs, and possibly obtain file or URL content that triggers a parsing error, via an XML value that refers to (1) a DTD or (2) an entity, related to an XML External Entity (aka XXE) issue.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade postgresql | Aug 30, 2017 | Oct 3, 2012 |
| Apple Osx Note | — | Apply OS X security update 2013-002Apply OS X security update 2013-001Upgrade macOS to the latest version | Aug 28, 2015 | Oct 3, 2012 |
| Apple Osx Postgresql | — | Apply OS X security update 2013-001 | Apr 3, 2013 | Oct 3, 2012 |
| Centos_linux | — | Upgrade postgresql84-testUpgrade postgresql84Upgrade postgresql84-pltclUpgrade postgresql84-docsUpgrade postgresql-develUpgrade postgresql-docsUpgrade postgresql84-serverUpgrade postgresql-contribUpgrade postgresql84-tclUpgrade postgresql84-contribUpgrade postgresql84-develUpgrade postgresql-pltclUpgrade postgresql-testUpgrade postgresql-plperlUpgrade postgresql-serverUpgrade postgresql-libsUpgrade postgresql84-libsUpgrade postgresql84-plpythonUpgrade postgresqlUpgrade postgresql84-pythonUpgrade postgresql84-plperlUpgrade postgresql-plpython | Dec 1, 2016 | Oct 3, 2012 |
| Freebsd | — | Upgrade postgresql-server | Dec 10, 2025 | Aug 17, 2012 |
| Gentoo Linux | — | Upgrade dev-db/postgresql-server. | Oct 30, 2017 | Oct 3, 2012 |
| Oracle_linux | — | Upgrade postgresql84Upgrade postgresql-libsUpgrade postgresql-serverUpgrade postgresql84-plperlUpgrade postgresql-testUpgrade postgresql-docsUpgrade postgresql-plperlUpgrade postgresql84-tclUpgrade postgresql84-testUpgrade postgresql84-pltclUpgrade postgresqlUpgrade postgresql84-contribUpgrade postgresql84-libsUpgrade postgresql-pltclUpgrade postgresql84-serverUpgrade postgresql84-docsUpgrade postgresql-develUpgrade postgresql84-plpythonUpgrade postgresql-plpythonUpgrade postgresql-contribUpgrade postgresql84-develUpgrade postgresql84-python | Oct 16, 2024 | Oct 3, 2012 |
| Postgres | — | Upgrade to PostgreSQL version 9.0.9Upgrade to PostgreSQL version 8.4.13Upgrade to PostgreSQL version 8.3.20Upgrade to PostgreSQL version 9.1.5 | Feb 24, 2013 | Oct 3, 2012 |
| Suse | — | Upgrade postgresql10-contribUpgrade postgresql96-develUpgrade postgresql94-serverUpgrade postgresql91-contribUpgrade postgresql10-develUpgrade postgresql-serverUpgrade postgresql93Upgrade postgresqlUpgrade postgresql91Upgrade postgresql93-develUpgrade postgresql10Upgrade postgresql-develUpgrade libpq5Upgrade libpq5-32bitUpgrade postgresql10-plpythonUpgrade postgresql93-serverUpgrade postgresql91-serverUpgrade postgresql10-serverUpgrade postgresql-contribUpgrade postgresql93-contribUpgrade postgresql94-docsUpgrade postgresql93-docsUpgrade postgresql96-serverUpgrade postgresql10-docsUpgrade postgresql96Upgrade postgresql94-contribUpgrade postgresql10-plperlUpgrade postgresql10-pltclUpgrade postgresql96-contribUpgrade postgresql96-docsUpgrade libecpg6Upgrade postgresql94-develUpgrade postgresql91-docsUpgrade postgresql94Upgrade postgresql-docs | Dec 12, 2013 | Jun 28, 2013 |
| Ubuntu | — | Upgrade postgresql-9.1Upgrade postgresql-8.4Upgrade postgresql-8.3 | Nov 8, 2024 | Oct 3, 2012 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub