The xml_parse function in the libxml2 support in the core server component in PostgreSQL 8.3 before 8.3.20, 8.4 before 8.4.13, 9.0 before 9.0.9, and 9.1 before 9.1.5 allows remote authenticated users to determine the existence of arbitrary files or URLs, and possibly obtain file or URL content that triggers a parsing error, via an XML value that refers to (1) a DTD or (2) an entity, related to an XML External Entity (aka XXE) issue.
CVSS Details
- CVSS 3.1 Base Score: 6.5
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade postgresql | Aug 30, 2017 | Oct 3, 2012 |
| Apple Osx Note | — | Upgrade macOS to the latest versionApply OS X security update 2013-002Apply OS X security update 2013-001 | Aug 28, 2015 | Oct 3, 2012 |
| Apple Osx Postgresql | — | Apply OS X security update 2013-001 | Apr 3, 2013 | Oct 3, 2012 |
| Centos_linux | — | Upgrade postgresql84-docsUpgrade postgresql84-develUpgrade postgresql84-pltclUpgrade postgresql84-tclUpgrade postgresql84-contribUpgrade postgresql-contribUpgrade postgresql-docsUpgrade postgresql84-serverUpgrade postgresql84-testUpgrade postgresql-develUpgrade postgresql84Upgrade postgresql-libsUpgrade postgresql-pltclUpgrade postgresqlUpgrade postgresql-serverUpgrade postgresql84-libsUpgrade postgresql-plpythonUpgrade postgresql84-plpythonUpgrade postgresql84-pythonUpgrade postgresql-testUpgrade postgresql84-plperlUpgrade postgresql-plperl | Dec 1, 2016 | Oct 3, 2012 |
| Freebsd | — | Upgrade postgresql-server | Dec 10, 2025 | Aug 17, 2012 |
| Gentoo Linux | — | Upgrade dev-db/postgresql-server. | Oct 30, 2017 | Oct 3, 2012 |
| Oracle_linux | — | Upgrade postgresql84-plperlUpgrade postgresql-libsUpgrade postgresql-docsUpgrade postgresqlUpgrade postgresql84-tclUpgrade postgresql-testUpgrade postgresql84-pltclUpgrade postgresql-serverUpgrade postgresql84-testUpgrade postgresql84-contribUpgrade postgresql-plperlUpgrade postgresql84Upgrade postgresql84-docsUpgrade postgresql84-pythonUpgrade postgresql84-libsUpgrade postgresql84-plpythonUpgrade postgresql-pltclUpgrade postgresql-develUpgrade postgresql84-develUpgrade postgresql-plpythonUpgrade postgresql-contribUpgrade postgresql84-server | Oct 16, 2024 | Oct 3, 2012 |
| Postgres | — | Upgrade to PostgreSQL version 8.4.13Upgrade to PostgreSQL version 9.0.9Upgrade to PostgreSQL version 8.3.20Upgrade to PostgreSQL version 9.1.5 | Feb 24, 2013 | Oct 3, 2012 |
| Suse | — | Upgrade postgresql-develUpgrade postgresql93Upgrade postgresql10-serverUpgrade postgresql96-develUpgrade postgresql-serverUpgrade postgresql10-develUpgrade postgresqlUpgrade postgresql91-contribUpgrade postgresql10-plpythonUpgrade postgresql93-contribUpgrade libpq5-32bitUpgrade postgresql10Upgrade postgresql94-serverUpgrade postgresql93-serverUpgrade postgresql93-develUpgrade postgresql91Upgrade libpq5Upgrade postgresql91-serverUpgrade postgresql10-contribUpgrade postgresql-contribUpgrade postgresql10-pltclUpgrade postgresql10-docsUpgrade postgresql94-contribUpgrade libecpg6Upgrade postgresql94-docsUpgrade postgresql10-plperlUpgrade postgresql93-docsUpgrade postgresql96-contribUpgrade postgresql96-serverUpgrade postgresql94Upgrade postgresql91-docsUpgrade postgresql96-docsUpgrade postgresql-docsUpgrade postgresql94-develUpgrade postgresql96 | Dec 12, 2013 | Jun 28, 2013 |
| Ubuntu | — | Upgrade postgresql-9.1Upgrade postgresql-8.3Upgrade postgresql-8.4 | Nov 8, 2024 | Oct 3, 2012 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub