CVE-2012-3489

The xml_parse function in the libxml2 support in the core server component in PostgreSQL 8.3 before 8.3.20, 8.4 before 8.4.13, 9.0 before 9.0.9, and 9.1 before 9.1.5 allows remote authenticated users to determine the existence of arbitrary files or URLs, and possibly obtain file or URL content that triggers a parsing error, via an XML value that refers to (1) a DTD or (2) an entity, related to an XML External Entity (aka XXE) issue.

• CWE-611

• http://lists.apple.com/archives/security-announce/2013/Mar/msg00002.htmlMailing List
• http://lists.opensuse.org/opensuse-updates/2012-09/msg00102.htmlMailing List
• http://lists.opensuse.org/opensuse-updates/2012-10/msg00013.htmlMailing List
• http://lists.opensuse.org/opensuse-updates/2012-10/msg00024.htmlMailing List
• http://rhn.redhat.com/errata/RHSA-2012-1263.htmlThird Party Advisory
• http://secunia.com/advisories/50635Broken Link
• http://secunia.com/advisories/50718Broken Link
• http://secunia.com/advisories/50859Broken Link
• http://secunia.com/advisories/50946Broken Link
• http://www.debian.org/security/2012/dsa-2534Mailing List
• http://www.mandriva.com/security/advisories?name=MDVSA-2012:139Broken Link
• http://www.postgresql.org/about/news/1407/Vendor Advisory
• http://www.postgresql.org/docs/8.3/static/release-8-3-20.htmlRelease Notes
• http://www.postgresql.org/docs/8.4/static/release-8-4-13.htmlRelease Notes
• http://www.postgresql.org/docs/9.0/static/release-9-0-9.htmlRelease Notes
• http://www.postgresql.org/docs/9.1/static/release-9-1-5.htmlRelease Notes
• http://www.postgresql.org/support/security/Release Notes, Vendor Advisory
• http://www.securityfocus.com/bid/55074Broken Link, Third Party Advisory, VDB Entry
• http://www.ubuntu.com/usn/USN-1542-1Third Party Advisory
• https://blogs.oracle.com/sunsecurity/entry/multiple_vulnerabilities_in_postgresql2Third Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=849173Issue Tracking, Patch, Release Notes
• http://lists.apple.com/archives/security-announce/2013/Mar/msg00002.htmlMailing List
• http://lists.opensuse.org/opensuse-updates/2012-09/msg00102.htmlMailing List
• http://lists.opensuse.org/opensuse-updates/2012-10/msg00013.htmlMailing List
• http://lists.opensuse.org/opensuse-updates/2012-10/msg00024.htmlMailing List
• http://rhn.redhat.com/errata/RHSA-2012-1263.htmlThird Party Advisory
• http://secunia.com/advisories/50635Broken Link
• http://secunia.com/advisories/50718Broken Link
• http://secunia.com/advisories/50859Broken Link
• http://secunia.com/advisories/50946Broken Link
• http://www.debian.org/security/2012/dsa-2534Mailing List
• http://www.mandriva.com/security/advisories?name=MDVSA-2012:139Broken Link
• http://www.postgresql.org/about/news/1407/Vendor Advisory
• http://www.postgresql.org/docs/8.3/static/release-8-3-20.htmlRelease Notes
• http://www.postgresql.org/docs/8.4/static/release-8-4-13.htmlRelease Notes
• http://www.postgresql.org/docs/9.0/static/release-9-0-9.htmlRelease Notes
• http://www.postgresql.org/docs/9.1/static/release-9-1-5.htmlRelease Notes
• http://www.postgresql.org/support/security/Release Notes, Vendor Advisory
• http://www.securityfocus.com/bid/55074Broken Link, Third Party Advisory, VDB Entry
• http://www.ubuntu.com/usn/USN-1542-1Third Party Advisory
• https://blogs.oracle.com/sunsecurity/entry/multiple_vulnerabilities_in_postgresql2Third Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=849173Issue Tracking, Patch, Release Notes

Published

Oct 3, 2012

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2012-3483Race condition in the runScript function in Tunnelblick 3.3b…
• CVE-2012-3484Tunnelblick 3.3beta20 and earlier relies on a test for speci…
• CVE-2012-3485Tunnelblick 3.3beta20 and earlier relies on argv[0] to deter…
• CVE-2012-3486Tunnelblick 3.3beta20 and earlier allows local users to gain…
• CVE-2012-3487Race condition in Tunnelblick 3.3beta20 and earlier allows l…
• CVE-2012-3488The libxslt support in contrib/xml2 in PostgreSQL 8.3 before…
• CVE-2012-3490The (1) my_popenv_impl and (2) my_spawnv functions in src/co…8.8
• CVE-2012-3491src/condor_schedd.V6/schedd.cpp in Condor 7.6.x before 7.6.1…
• CVE-2012-3492The filesystem authentication (condor_io/condor_auth_fs.cpp)…
• CVE-2012-3493The command_give_request_ad function in condor_startd.V6/com…
• CVE-2012-3494The set_debugreg hypercall in include/asm-x86/debugreg.h in …
• CVE-2012-3495The physdev_get_free_pirq hypercall in arch/x86/physdev.c in…