CVE-2012-3489

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2012-10-03 · updated 2026-06-16
Weakness: CWE-611

Description

The xml_parse function in the libxml2 support in the core server component in PostgreSQL 8.3 before 8.3.20, 8.4 before 8.4.13, 9.0 before 9.0.9, and 9.1 before 9.1.5 allows remote authenticated users to determine the existence of arbitrary files or URLs, and possibly obtain file or URL content that triggers a parsing error, via an XML value that refers to (1) a DTD or (2) an entity, related to an XML External Entity (aka XXE) issue.

Affected products

Apple Mac Os X Server: from 10.7.0 through 10.7.5; 10.6.8
Canonical Ubuntu Linux: 8.04, 10.04, 11.04, 11.10, 12.04
Debian Linux: 6.0
Opensuse: 11.4, 12.1, 12.2
PostgreSQL: from 8.3.0 before 8.3.20; from 8.4.0 before 8.4.13; from 9.0.0 before 9.0.9; from 9.1.0 before 9.1.5 — fixed in 8.3.20, 8.4.13, 9.0.9, 9.1.5
RedHat Enterprise Linux Desktop: 5.0, 6.0
RedHat Enterprise Linux Eus: 6.3
RedHat Enterprise Linux Server: 5.0, 6.0
RedHat Enterprise Linux Workstation: 5.0, 6.0

How to fix

Upgrade to a fixed version: PostgreSQL 8.3.20, 8.4.13, 9.0.9, 9.1.5. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2012-3489 or the next vulnerability affects your stack