CVE-2012-3489
En bref
- Source
- NVD
- EPSS
- EPSS 3.06 % · centile 88 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- redhat
- Statut NVD
- Modified
Description
The xml_parse function in the libxml2 support in the core server component in PostgreSQL 8.3 before 8.3.20, 8.4 before 8.4.13, 9.0 before 9.0.9, and 9.1 before 9.1.5 allows remote authenticated users to determine the existence of arbitrary files or URLs, and possibly obtain file or URL content that triggers a parsing error, via an XML value that refers to (1) a DTD or (2) an entity, related to an XML External Entity (aka XXE) issue.
Faiblesses (CWE)
- CWE-611 — Entité externe XML (XXE)
Références
- http://rhn.redhat.com/errata/RHSA-2012-1263.html
- http://www.securityfocus.com/bid/55074
- http://www.postgresql.org/docs/9.0/static/release-9-0-9.html
- http://www.mandriva.com/security/advisories?name=MDVSA-2012:139
- http://www.ubuntu.com/usn/USN-1542-1
- http://secunia.com/advisories/50718
- http://www.postgresql.org/docs/9.1/static/release-9-1-5.html
- https://blogs.oracle.com/sunsecurity/entry/multiple_vulnerabilities_in_postgresql2
- http://www.postgresql.org/docs/8.4/static/release-8-4-13.html
- http://www.postgresql.org/docs/8.3/static/release-8-3-20.html
- http://www.postgresql.org/about/news/1407/
- http://secunia.com/advisories/50635
- http://www.postgresql.org/support/security/
- http://lists.apple.com/archives/security-announce/2013/Mar/msg00002.html
- http://secunia.com/advisories/50946
- https://bugzilla.redhat.com/show_bug.cgi?id=849173
- http://www.debian.org/security/2012/dsa-2534
- http://lists.opensuse.org/opensuse-updates/2012-09/msg00102.html
- http://lists.opensuse.org/opensuse-updates/2012-10/msg00013.html
- http://secunia.com/advisories/50859
- http://lists.opensuse.org/opensuse-updates/2012-10/msg00024.html
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | MEDIUM 4.0 | AV:N/AC:L/Au:S/C:P/I:N/A:N | NVD · nvd@nist.gov (Primary) |
Références européennes
- ENISA EUVD · EUVD-2012-3445
- GCVE · GCVE-0-2012-3489
Avis du CERT-FR
- CERTA-2014-AVI-008 — Multiples vulnérabilités dans Avaya Experience Portal · cert.ssi.gouv.fr
- CERTA-2013-AVI-204 — Multiples vulnérabilités dans Google Chrome · cert.ssi.gouv.fr
- CERTA-2013-AVI-187 — Multiples vulnérabilités dans Apple OS X Mountain Lion · cert.ssi.gouv.fr
- CERTA-2012-AVI-546 — Multiples vulnérabilités dans Apple OS X Server · cert.ssi.gouv.fr
- CERTA-2012-AVI-455 — Vulnérabilités dans PostgreSQL · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*≥ 8.3.0 < 8.3.20cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*≥ 8.4.0 < 8.4.13cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*≥ 9.0.0 < 9.0.9cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*≥ 9.1.0 < 9.1.5cpe:2.3:o:opensuse:opensuse:11.4:*:*:*:*:*:*:*cpe:2.3:o:opensuse:opensuse:12.1:*:*:*:*:*:*:*cpe:2.3:o:opensuse:opensuse:12.2:*:*:*:*:*:*:*cpe:2.3:o:apple:mac_os_x_server:*:*:*:*:*:*:*:*≥ 10.7.0 ≤ 10.7.5cpe:2.3:o:apple:mac_os_x_server:10.6.8:*:*:*:*:*:*:*cpe:2.3:o:canonical:ubuntu_linux:8.04:*:*:*:-:*:*:*cpe:2.3:o:canonical:ubuntu_linux:10.04:*:*:*:-:*:*:*cpe:2.3:o:canonical:ubuntu_linux:11.04:*:*:*:*:*:*:*cpe:2.3:o:canonical:ubuntu_linux:11.10:*:*:*:*:*:*:*cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:-:*:*:*cpe:2.3:o:debian:debian_linux:6.0:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_desktop:5.0:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_eus:6.3:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_server:5.0:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_workstation:5.0:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*
Produits affectés
| Produit | Versions |
|---|---|
| affected n/a |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |