Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2012-3465 State: PUBLISHED Published: 2012-08-10T10:00:00 Last Updated: 2024-08-06T20:05:12.646Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in actionpack/lib/action_view/helpers/sanitize_helper.rb in the strip_tags helper in Ruby on Rails before 3.0.17, 3.1.x before 3.1.8, and 3.2.x before 3.2.8 allows remote attackers to inject arbitrary web script or HTML via malformed HTML markup. Additional Analyst Notes: - CVE Program Container: References: - http://weblog.rubyonrails.org/2012/8/9/ann-rails-3-2-8-has-been-released/ - http://secunia.com/advisories/50694 - http://rhn.redhat.com/errata/RHSA-2013-0154.html - https://groups
been-released/ - http://secunia.com/advisories/50694 - http://rhn.redhat.com/errata/RHSA-2013-0154.html - https://groups.google.com/group/rubyonrails-security/msg/7fbb5392d4d282b5?dmode=source&output=gplain
CVE ID: CVE-2012-3466 State: PUBLISHED Published: 2012-10-22T23:00:00 Last Updated: 2024-08-06T20:05:12.514Z Vendors: n/a Products: n/a Problem Types: n/a Description: GNOME gnome-keyring 3.4.0 through 3.4.1, when gpg-cache-method is set to "idle" or "timeout," does not properly limit the amount of time a passphrase is cached, which allows attackers to have an unspecified impact via unknown attack vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2012/08/09/2 - http://git.gnome.org/browse/gnome-keyring/commit/?id=51606f299e5ee9d48096db0a5957efe26cbf7cc3 - http://www.openwall.com/lists/oss-security/2012/08/09/1 - http://git.gn
t/?id=51606f299e5ee9d48096db0a5957efe26cbf7cc3 - http://www.openwall.com/lists/oss-security/2012/08/09/1 - http://git.gnome.org/browse/gnome-keyring/commit/?id=5dff623470b859e332dbe12afb0dc57b292832d2 - https://bugzilla.gnome.org/show_bug.cgi?id=681081 - http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=683655 - http://lists.opensuse.org/opensuse-updates/2012-09/msg00037.html - https://bugzilla.redhat.com/show_bug.cgi?id=845426 - http://www.mandriva.com/security/advisories?name=MDVSA-2013:084
CVE ID: CVE-2012-3467 State: PUBLISHED Published: 2012-08-27T23:00:00 Last Updated: 2024-08-06T20:05:12.646Z Vendors: n/a Products: n/a Problem Types: n/a Description: Apache QPID 0.14, 0.16, and earlier uses a NullAuthenticator mechanism to authenticate catch-up shadow connections to AMQP brokers, which allows remote attackers to bypass authentication. Additional Analyst Notes: - CVE Program Container: References: - http://svn.apache.org/viewvc?view=revision&revision=1352992 - http://secunia.com/advisories/50186 - http://www.securityfocus.com/bid/54954 - http://rhn.redhat.com/errata/RHSA-2012-1279.html - https://issues.apache.org/jira/browse/QPID-3849 - https://exchange.xforce.ibmcloud.com/
com/errata/RHSA-2012-1279.html - https://issues.apache.org/jira/browse/QPID-3849 - https://exchange.xforce.ibmcloud.com/vulnerabilities/77568 - http://rhn.redhat.com/errata/RHSA-2012-1277.html - http://secunia.com/advisories/50698 - https://bugzilla.redhat.com/show_bug.cgi?id=836276 - http://www.openwall.com/lists/oss-security/2012/08/09/6
CVE ID: CVE-2012-3468 State: PUBLISHED Published: 2012-08-12T21:00:00Z Last Updated: 2024-09-17T01:12:00.485Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple SQL injection vulnerabilities in the Ushahidi Platform before 2.5 allow remote attackers to execute arbitrary SQL commands via vectors related to (1) the verify function in application/controllers/alerts.php, (2) the save_all function in application/models/settings.php, or (3) the media type to the timeline function in application/controllers/json.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ushahidi/Ushahidi_Web/commit/d954093 - http://openwall.com/lists/oss-security/2012/
er: References: - https://github.com/ushahidi/Ushahidi_Web/commit/d954093 - http://openwall.com/lists/oss-security/2012/08/09/5 - https://github.com/ushahidi/Ushahidi_Web/commit/4764792 - https://github.com/ushahidi/Ushahidi_Web/commit/fdb48d1
CVE ID: CVE-2012-3469 State: PUBLISHED Published: 2012-08-12T21:00:00Z Last Updated: 2024-09-17T03:37:24.200Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple SQL injection vulnerabilities in the Ushahidi Platform before 2.5 allow remote attackers to execute arbitrary SQL commands via vectors related to (1) the messages admin functionality in application/controllers/admin/messages.php, (2) application/libraries/api/MY_Checkin_Api_Object.php, (3) application/controllers/admin/messages/reporters.php, or (4) the location API in application/libraries/api/MY_Locations_Api_Object.php and application/models/location.php. Additional Analyst Notes: - CVE Program Container: Referenc
ocations_Api_Object.php and application/models/location.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ushahidi/Ushahidi_Web/commit/e0e2b66 - https://github.com/ushahidi/Ushahidi_Web/commit/6f6a919 - https://github.com/ushahidi/Ushahidi_Web/commit/68d9916 - http://openwall.com/lists/oss-security/2012/08/09/5 - https://github.com/ushahidi/Ushahidi_Web/commit/a11d43c
CVE ID: CVE-2012-3470 State: PUBLISHED Published: 2012-08-12T21:00:00Z Last Updated: 2024-09-16T19:09:04.713Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple SQL injection vulnerabilities in application/libraries/api/MY_Countries_Api_Object.php in the Ushahidi Platform before 2.5 allow remote attackers to execute arbitrary SQL commands via vectors related to _get_countries functions. Additional Analyst Notes: - CVE Program Container: References: - http://openwall.com/lists/oss-security/2012/08/09/5 - https://github.com/ushahidi/Ushahidi_Web/commit/3301e48
CVE ID: CVE-2012-3471 State: PUBLISHED Published: 2012-08-12T21:00:00Z Last Updated: 2024-09-16T16:17:36.708Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple SQL injection vulnerabilities in the edit functions in (1) application/controllers/admin/reports.php and (2) application/controllers/members/reports.php in the Ushahidi Platform before 2.5 allow remote attackers to execute arbitrary SQL commands via an incident id. Additional Analyst Notes: - CVE Program Container: References: - http://openwall.com/lists/oss-security/2012/08/09/5 - https://github.com/ushahidi/Ushahidi_Web/commit/3f14fa0
CVE ID: CVE-2012-3472 State: PUBLISHED Published: 2012-08-12T21:00:00Z Last Updated: 2024-09-16T17:43:45.629Z Vendors: n/a Products: n/a Problem Types: n/a Description: The email API in application/libraries/api/MY_Email_Api_Object.php in the Ushahidi Platform before 2.5 does not require authentication, which allows remote attackers to list, delete, or organize messages via a GET request. Additional Analyst Notes: - CVE Program Container: References: - http://openwall.com/lists/oss-security/2012/08/09/5 - https://github.com/ushahidi/Ushahidi_Web/commit/4c24325
CVE ID: CVE-2012-3473 State: PUBLISHED Published: 2012-08-12T21:00:00Z Last Updated: 2024-09-16T16:27:36.345Z Vendors: n/a Products: n/a Problem Types: n/a Description: The (1) reports API and (2) administration feature in the comments API in the Ushahidi Platform before 2.5 do not require authentication, which allows remote attackers to generate reports and organize comments via API functions. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ushahidi/Ushahidi_Web/commit/13ca6f4 - http://openwall.com/lists/oss-security/2012/08/09/5 - https://github.com/ushahidi/Ushahidi_Web/commit/f67f4ad
CVE ID: CVE-2012-3474 State: PUBLISHED Published: 2012-08-12T21:00:00Z Last Updated: 2024-09-17T02:48:09.605Z Vendors: n/a Products: n/a Problem Types: n/a Description: The comments API in application/libraries/api/MY_Comments_Api_Object.php in the Ushahidi Platform before 2.5 allows remote attackers to obtain sensitive information about the e-mail address, IP address, and other attributes of the author of a comment via an API function call. Additional Analyst Notes: - CVE Program Container: References: - http://openwall.com/lists/oss-security/2012/08/09/5 - https://github.com/ushahidi/Ushahidi_Web/commit/529f353
CVE ID: CVE-2012-3475 State: PUBLISHED Published: 2012-08-12T21:00:00Z Last Updated: 2024-09-17T00:55:34.320Z Vendors: n/a Products: n/a Problem Types: n/a Description: The installer in the Ushahidi Platform before 2.5 omits certain calls to the exit function, which allows remote attackers to obtain administrative privileges via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://openwall.com/lists/oss-security/2012/08/09/5 - https://github.com/ushahidi/Ushahidi_Web/commit/7892559 - https://github.com/ushahidi/Ushahidi_Web/commit/fcdad03
CVE ID: CVE-2012-3476 State: PUBLISHED Published: 2012-08-12T21:00:00Z Last Updated: 2024-09-17T02:56:59.207Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in (1) application/views/admin/layout.php and (2) themes/default/views/header.php in the Ushahidi Platform before 2.5 allow remote authenticated users to inject arbitrary web script or HTML via vectors related to a site name. Additional Analyst Notes: - CVE Program Container: References: - http://openwall.com/lists/oss-security/2012/08/09/5 - https://github.com/ushahidi/Ushahidi_Web/commit/00eae4f
CVE ID: CVE-2012-3477 State: PUBLISHED Published: 2012-08-26T01:00:00Z Last Updated: 2024-09-16T19:19:30.503Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in signup_check.php in NeoInvoice allows remote attackers to execute arbitrary SQL commands via the value parameter in a username action. Additional Analyst Notes: - CVE Program Container: References: - http://archives.neohapsis.com/archives/bugtraq/2012-08/0087.html - http://adamcaudill.com/2012/08/12/neoinvoice-blind-sql-injection-cve-2012-3477/
CVE ID: CVE-2012-3478 State: PUBLISHED Published: 2012-08-31T18:00:00 Last Updated: 2024-08-06T20:05:12.555Z Vendors: n/a Products: n/a Problem Types: n/a Description: rssh 2.3.3 and earlier allows local users to bypass intended restricted shell access via crafted environment variables in the command line. Additional Analyst Notes: - CVE Program Container: References: - http://archives.neohapsis.com/archives/bugtraq/2012-05/0036.html - http://www.openwall.com/lists/oss-security/2012/11/28/3 - http://www.openwall.com/lists/oss-security/2012/08/11/3 - http://www.debian.org/security/2012/dsa-2530 - http://secunia.com/advisories/50272 - http://www.securityfocus.com/bid/53430 - http://www.openwal
curity/2012/dsa-2530 - http://secunia.com/advisories/50272 - http://www.securityfocus.com/bid/53430 - http://www.openwall.com/lists/oss-security/2012/08/10/7 - http://sourceforge.net/mailarchive/message.php?msg_id=29235647 - http://archives.neohapsis.com/archives/bugtraq/2012-11/0101.html
CVE ID: CVE-2012-3479 State: PUBLISHED Published: 2012-08-25T10:00:00 Last Updated: 2024-08-06T20:05:12.672Z Vendors: n/a Products: n/a Problem Types: n/a Description: lisp/files.el in Emacs 23.2, 23.3, 23.4, and 24.1 automatically executes eval forms in local-variable sections when the enable-local-variables option is set to :safe, which allows user-assisted remote attackers to execute arbitrary Emacs Lisp code via a crafted file. Additional Analyst Notes: - CVE Program Container: References: - http://www.slackware.com/security/viewer.php?l=slackware-security&y=2012&m=slackware-security.420006 - http://debbugs.gnu.org/cgi/bugreport.cgi?bug=12155 - http://lists.opensuse.org/opensuse-updates/
kware-security.420006 - http://debbugs.gnu.org/cgi/bugreport.cgi?bug=12155 - http://lists.opensuse.org/opensuse-updates/2012-10/msg00057.html - http://secunia.com/advisories/50801 - http://www.openwall.com/lists/oss-security/2012/08/13/2 - http://www.ubuntu.com/usn/USN-1586-1 - http://www.securityfocus.com/bid/54969 - http://www.securitytracker.com/id?1027375 - http://www.openwall.com/lists/oss-security/2012/08/13/1 - http://secunia.com/advisories/50157 - http://www.mandriva.com/security/advisories?name=MDVSA-2013:076 - http://www.debian.org/security/2013/dsa-2603
CVE ID: CVE-2012-3480 State: PUBLISHED Published: 2012-08-25T10:00:00 Last Updated: 2024-08-06T20:05:12.639Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple integer overflows in the (1) strtod, (2) strtof, (3) strtold, (4) strtod_l, and other unspecified "related functions" in stdlib in GNU C Library (aka glibc or libc6) 2.16 allow local users to cause a denial of service (application crash) and possibly execute arbitrary code via a long string, which triggers a stack-based buffer overflow. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2012/08/13/4 - http://lists.fedoraproject.org/pipermail/package-announce/201
http://www.openwall.com/lists/oss-security/2012/08/13/4 - http://lists.fedoraproject.org/pipermail/package-announce/2012-August/085190.html - http://osvdb.org/84710 - http://www.securityfocus.com/bid/54982 - http://www.openwall.com/lists/oss-security/2012/08/13/6 - http://rhn.redhat.com/errata/RHSA-2012-1325.html - http://sourceware.org/ml/libc-alpha/2012-08/msg00202.html - http://sourceware.org/bugzilla/show_bug.cgi?id=14459 - http://rhn.redhat.com/errata/RHSA-2012-1262.html - https://security.gentoo.org/glsa/201503-04 - http://rhn.redhat.com/errata/RHSA-2012-1207.html - http://www.securitytracker.com/id?1027374 - http://www.ubuntu.com/usn/USN-1589-1 - http://secunia.com/advisories/50201 -
http://www.securitytracker.com/id?1027374 - http://www.ubuntu.com/usn/USN-1589-1 - http://secunia.com/advisories/50201 - http://secunia.com/advisories/50422 - http://rhn.redhat.com/errata/RHSA-2012-1208.html
CVE ID: CVE-2012-3481 State: PUBLISHED Published: 2012-08-25T10:00:00 Last Updated: 2024-08-06T20:05:12.695Z Vendors: n/a Products: n/a Problem Types: n/a Description: Integer overflow in the ReadImage function in plug-ins/common/file-gif-load.c in the GIF image format plug-in in GIMP 2.8.x and earlier allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via crafted height and len properties in a GIF image file, which triggers a heap-based buffer overflow. NOTE: some of these details are obtained from third party information. Additional Analyst Notes: - CVE Program Container: References: - http://lists.opensuse.org/opensuse-security-ann
mation. Additional Analyst Notes: - CVE Program Container: References: - http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00023.html - http://www.ubuntu.com/usn/USN-1559-1 - http://rhn.redhat.com/errata/RHSA-2012-1180.html - http://www.securitytracker.com/id?1027411 - http://rhn.redhat.com/errata/RHSA-2012-1181.html - https://bugzilla.novell.com/show_bug.cgi?id=776572 - http://www.securityfocus.com/bid/55101 - http://www.mandriva.com/security/advisories?name=MDVSA-2013:082 - http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00000.html - http://lists.opensuse.org/opensuse-updates/2012-09/msg00043.html - https://bugzilla.redhat.com/show_bug.cgi?id=847303 - http://w
ists.opensuse.org/opensuse-updates/2012-09/msg00043.html - https://bugzilla.redhat.com/show_bug.cgi?id=847303 - http://www.mandriva.com/security/advisories?name=MDVSA-2012:142 - http://secunia.com/advisories/50296 - http://www.openwall.com/lists/oss-security/2012/08/20/8
CVE ID: CVE-2012-3482 State: PUBLISHED Published: 2012-12-21T02:00:00 Last Updated: 2024-08-06T20:05:12.577Z Vendors: n/a Products: n/a Problem Types: n/a Description: Fetchmail 5.0.8 through 6.3.21, when using NTLM authentication in debug mode, allows remote NTLM servers to (1) cause a denial of service (crash and delayed delivery of inbound mail) via a crafted NTLM response that triggers an out-of-bounds read in the base64 decoder, or (2) obtain sensitive information from memory via an NTLM Type 2 message with a crafted Target Name structure, which triggers an out-of-bounds read. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/oss-sec/2012/q3/232 - http
ds read. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/oss-sec/2012/q3/232 - http://seclists.org/oss-sec/2012/q3/230 - http://www.securityfocus.com/bid/54987 - https://blogs.oracle.com/sunsecurity/entry/multiple_vulnerabilities_in_fetchmail - http://lists.fedoraproject.org/pipermail/package-announce/2012-October/088871.html - http://lists.fedoraproject.org/pipermail/package-announce/2012-October/088836.html - http://www.fetchmail.info/fetchmail-SA-2012-02.txt
CVE ID: CVE-2012-3483 State: PUBLISHED Published: 2012-08-26T19:00:00Z Last Updated: 2024-09-17T02:51:35.834Z Vendors: n/a Products: n/a Problem Types: n/a Description: Race condition in the runScript function in Tunnelblick 3.3beta20 and earlier allows local users to gain privileges by replacing a script file. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2012/08/14/1 - http://code.google.com/p/tunnelblick/issues/detail?id=212 - http://git.zx2c4.com/Pwnnel-Blicker/tree/pwnnel-blicker.c - http://archives.neohapsis.com/archives/fulldisclosure/2012-08/0122.html
CVE ID: CVE-2012-3484 State: PUBLISHED Published: 2012-08-26T19:00:00Z Last Updated: 2024-09-16T16:59:08.117Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tunnelblick 3.3beta20 and earlier relies on a test for specific ownership and permissions to determine whether a program can be safely executed, which allows local users to bypass intended access restrictions and gain privileges via a (1) user-mountable image or (2) network share. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2012/08/14/1 - http://code.google.com/p/tunnelblick/issues/detail?id=212 - http://archives.neohapsis.com/archives/fulldisclosure/2012-08/0122
/code.google.com/p/tunnelblick/issues/detail?id=212 - http://archives.neohapsis.com/archives/fulldisclosure/2012-08/0122.html
CVE ID: CVE-2012-3485 State: PUBLISHED Published: 2012-08-26T19:00:00 Last Updated: 2024-08-06T20:05:12.644Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tunnelblick 3.3beta20 and earlier relies on argv[0] to determine the name of an appropriate (1) kernel module pathname or (2) executable file pathname, which allows local users to gain privileges via an execl system call. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2012/08/14/1 - http://git.zx2c4.com/Pwnnel-Blicker/tree/pwnnel-blicker-for-kids.sh - http://code.google.com/p/tunnelblick/issues/detail?id=212 - http://archives.neohapsis.com/archives/fulldisclosure/201
- http://code.google.com/p/tunnelblick/issues/detail?id=212 - http://archives.neohapsis.com/archives/fulldisclosure/2012-08/0122.html - http://www.exploit-db.com/exploits/24578
CVE ID: CVE-2012-3486 State: PUBLISHED Published: 2012-08-26T19:00:00Z Last Updated: 2024-09-16T20:51:44.436Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tunnelblick 3.3beta20 and earlier allows local users to gain privileges via an OpenVPN configuration file that specifies execution of a script upon occurrence of an OpenVPN event. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2012/08/14/1 - http://code.google.com/p/tunnelblick/issues/detail?id=212 - http://archives.neohapsis.com/archives/fulldisclosure/2012-08/0122.html
CVE ID: CVE-2012-3487 State: PUBLISHED Published: 2012-08-26T19:00:00Z Last Updated: 2024-09-17T03:42:57.974Z Vendors: n/a Products: n/a Problem Types: n/a Description: Race condition in Tunnelblick 3.3beta20 and earlier allows local users to kill unintended processes by waiting for a specific PID value to be assigned to a target process. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2012/08/14/1 - http://code.google.com/p/tunnelblick/issues/detail?id=212 - http://archives.neohapsis.com/archives/fulldisclosure/2012-08/0122.html
CVE ID: CVE-2012-3488 State: PUBLISHED Published: 2012-10-03T21:00:00 Last Updated: 2024-08-06T20:05:12.671Z Vendors: n/a Products: n/a Problem Types: n/a Description: The libxslt support in contrib/xml2 in PostgreSQL 8.3 before 8.3.20, 8.4 before 8.4.13, 9.0 before 9.0.9, and 9.1 before 9.1.5 does not properly restrict access to files and URLs, which allows remote authenticated users to modify data, obtain sensitive information, or trigger outbound traffic to arbitrary external hosts by leveraging (1) stylesheet commands that are permitted by the libxslt security options or (2) an xslt_process feature, related to an XML External Entity (aka XXE) issue. Additional Analyst Notes: - CVE Progra
r (2) an xslt_process feature, related to an XML External Entity (aka XXE) issue. Additional Analyst Notes: - CVE Program Container: References: - http://rhn.redhat.com/errata/RHSA-2012-1263.html - http://www.postgresql.org/docs/9.0/static/release-9-0-9.html - http://www.mandriva.com/security/advisories?name=MDVSA-2012:139 - http://secunia.com/advisories/50636 - https://bugzilla.redhat.com/show_bug.cgi?id=849172 - http://www.ubuntu.com/usn/USN-1542-1 - http://secunia.com/advisories/50718 - http://www.postgresql.org/docs/9.1/static/release-9-1-5.html - https://blogs.oracle.com/sunsecurity/entry/multiple_vulnerabilities_in_postgresql2 - http://www.postgresql.org/docs/8.4/static/release-8-4-13.
om/sunsecurity/entry/multiple_vulnerabilities_in_postgresql2 - http://www.postgresql.org/docs/8.4/static/release-8-4-13.html - http://www.postgresql.org/docs/8.3/static/release-8-3-20.html - http://www.postgresql.org/about/news/1407/ - http://secunia.com/advisories/50635 - http://www.postgresql.org/support/security/ - http://lists.apple.com/archives/security-announce/2013/Mar/msg00002.html - http://secunia.com/advisories/50946 - http://www.securityfocus.com/bid/55072 - http://www.debian.org/security/2012/dsa-2534 - http://rhn.redhat.com/errata/RHSA-2012-1264.html - http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705 - http://lists.opensuse.org/opensuse-updates/2012-09/msg00102.ht
b.juniper.net/InfoCenter/index?page=content&id=JSA10705 - http://lists.opensuse.org/opensuse-updates/2012-09/msg00102.html - http://lists.opensuse.org/opensuse-updates/2012-10/msg00013.html - http://secunia.com/advisories/50859 - http://lists.opensuse.org/opensuse-updates/2012-10/msg00024.html
CVE ID: CVE-2012-3489 State: PUBLISHED Published: 2012-10-03T21:00:00 Last Updated: 2024-08-06T20:05:12.659Z Vendors: n/a Products: n/a Problem Types: n/a Description: The xml_parse function in the libxml2 support in the core server component in PostgreSQL 8.3 before 8.3.20, 8.4 before 8.4.13, 9.0 before 9.0.9, and 9.1 before 9.1.5 allows remote authenticated users to determine the existence of arbitrary files or URLs, and possibly obtain file or URL content that triggers a parsing error, via an XML value that refers to (1) a DTD or (2) an entity, related to an XML External Entity (aka XXE) issue. Additional Analyst Notes: - CVE Program Container: References: - http://rhn.redhat.com/errata/R
Entity (aka XXE) issue. Additional Analyst Notes: - CVE Program Container: References: - http://rhn.redhat.com/errata/RHSA-2012-1263.html - http://www.securityfocus.com/bid/55074 - http://www.postgresql.org/docs/9.0/static/release-9-0-9.html - http://www.mandriva.com/security/advisories?name=MDVSA-2012:139 - http://www.ubuntu.com/usn/USN-1542-1 - http://secunia.com/advisories/50718 - http://www.postgresql.org/docs/9.1/static/release-9-1-5.html - https://blogs.oracle.com/sunsecurity/entry/multiple_vulnerabilities_in_postgresql2 - http://www.postgresql.org/docs/8.4/static/release-8-4-13.html - http://www.postgresql.org/docs/8.3/static/release-8-3-20.html - http://www.postgresql.org/about/news