CVE-2012-3488

First published: Fri Aug 17 2012(Updated: )

An XML External Entities (XXE) attack was found in the way xml2 contrib module, providing XPath querying and XSLT functionality, of PostgreSQL, an advanced Object-Relational database management system (DBMS), performed processing of XSLT documents. When the xml2 contrib module was enabled an unprivileged database user could issue a specially-crafted SQL query to the PostgreSQL server that, when processed could lead to attacker's ability to read or write (alter) arbitrary system files, accessible with the privileges of the user running the PostgreSQL server. References: [1] <a href="http://www.postgresql.org/docs/8.3/static/release-8-3-20.html">http://www.postgresql.org/docs/8.3/static/release-8-3-20.html</a> [2] <a href="http://www.postgresql.org/docs/9.0/static/release-9-0-9.html">http://www.postgresql.org/docs/9.0/static/release-9-0-9.html</a> [3] <a href="http://www.postgresql.org/docs/9.1/static/release-9-1-5.html">http://www.postgresql.org/docs/9.1/static/release-9-1-5.html</a>

Credit: secalert@redhat.com

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

• collector/redhat-bugzilla
• alias/CVE-2012-3488
• agent/author
• agent/severity
• agent/weakness
• agent/references
• agent/type
• agent/event
• agent/description
• agent/first-publish-date
• agent/last-modified-date
• agent/softwarecombine
• agent/tags
• collector/nvd-index
• agent/software-canonical-lookup-request
• package-manager/redhat
• vendor/postgresql
• canonical/postgresql postgresql
• version/postgresql postgresql/9.1
• version/postgresql postgresql/9.1.1
• version/postgresql postgresql/9.1.2
• version/postgresql postgresql/9.1.3
• version/postgresql postgresql/9.1.4
• version/postgresql postgresql/8.4
• version/postgresql postgresql/8.4.1
• version/postgresql postgresql/8.4.2
• version/postgresql postgresql/8.4.3
• version/postgresql postgresql/8.4.4
• version/postgresql postgresql/8.4.5
• version/postgresql postgresql/8.4.6
• version/postgresql postgresql/8.4.7
• version/postgresql postgresql/8.4.8
• version/postgresql postgresql/8.4.9
• version/postgresql postgresql/8.4.10
• version/postgresql postgresql/8.4.11
• version/postgresql postgresql/8.4.12
• version/postgresql postgresql/8.3
• version/postgresql postgresql/8.3.1
• version/postgresql postgresql/8.3.2
• version/postgresql postgresql/8.3.3
• version/postgresql postgresql/8.3.4
• version/postgresql postgresql/8.3.5
• version/postgresql postgresql/8.3.6
• version/postgresql postgresql/8.3.7
• version/postgresql postgresql/8.3.8
• version/postgresql postgresql/8.3.9
• version/postgresql postgresql/8.3.10
• version/postgresql postgresql/8.3.11
• version/postgresql postgresql/8.3.12
• version/postgresql postgresql/8.3.13
• version/postgresql postgresql/8.3.14
• version/postgresql postgresql/8.3.15
• version/postgresql postgresql/8.3.16
• version/postgresql postgresql/8.3.17
• version/postgresql postgresql/8.3.18
• version/postgresql postgresql/8.3.19
• version/postgresql postgresql/9.0
• version/postgresql postgresql/9.0.1
• version/postgresql postgresql/9.0.2
• version/postgresql postgresql/9.0.3
• version/postgresql postgresql/9.0.4
• version/postgresql postgresql/9.0.5
• version/postgresql postgresql/9.0.6
• version/postgresql postgresql/9.0.7
• version/postgresql postgresql/9.0.8