CVE-2012-3488 [Medium] | Information Disclosure in Postgresql

The libxslt support in contrib/xml2 in PostgreSQL 8.3 before 8.3.20, 8.4 before 8.4.13, 9.0 before 9.0.9, and 9.1 before 9.1.5 does not properly restrict access to files and URLs, which allows remote authenticated users to modify data, obtain sensitive information, or trigger outbound traffic to arbitrary external hosts by leveraging (1) stylesheet commands that are permitted by the libxslt security options or (2) an xslt_process feature, related to an XML External Entity (aka XXE) issue.

#	Date	Old EPSS score	New EPSS score	Delta (New - Old)
1	2026-06-15	0.11%	3.30%	+3.19%
2	2026-06-08	0.20%	0.11%	-0.09%
3	2026-01-18	—	0.20%	—

Date

Old EPSS score

New EPSS score

Delta (New - Old)

2026-06-15

0.11%

3.30%

+3.19%

2026-06-08

0.20%

0.11%

-0.09%

2026-01-18

—

0.20%

—

Base score	Version	Severity	Vector	Exploitability	Impact	Score source
4.9	2.0	MEDIUM	`AV:N/AC:M/Au:S/C:P/I:P/A:N` Click to expand Access vector (AV:N) Can be exploited remotely over network reachability. Access complexity (AC:M) Exploitation needs some favorable conditions, but not exceptional ones. Authentication (AU:S) A single authentication is required. Confidentiality impact (C:P) Partial confidentiality impact. Integrity impact (I:P) Partial integrity impact. Availability impact (A:N) No availability impact.	6.8	4.9	[email protected]

Base score

Version

Severity

Vector

Exploitability

Impact

Score source

4.9

2.0

MEDIUM

AV:N/AC:M/Au:S/C:P/I:P/A:N Click to expand

Access vector (AV:N): Can be exploited remotely over network reachability.
Access complexity (AC:M): Exploitation needs some favorable conditions, but not exceptional ones.
Authentication (AU:S): A single authentication is required.
Confidentiality impact (C:P): Partial confidentiality impact.
Integrity impact (I:P): Partial integrity impact.
Availability impact (A:N): No availability impact.

6.8

4.9

[email protected]

OS Trackers for CVE-2012-3488

vendor	priority	summary	link
`gentoo`	normal	CVE-2012-3488: 1 GLSA(s) (201209-24), 1 atom(s) (dev-db/postgresql-server); latest impact normal.	https://bugs.gentoo.org/buglist.cgi?quicksearch=CVE-2012-3488
`redhat`	medium	—	https://access.redhat.com/security/cve/CVE-2012-3488
`ubuntu`	medium	CVE-2012-3488 medium priority: Ubuntu including 4 source packages (postgresql-8.2, postgresql-8.3, postgresql-8.4, postgresql-9.1), 44 status rows across 11 suites (hardy, lucid, natty, oneiric, precise, quantal, raring, saucy, trusty, upstream, utopic): DNE 29, released 7, needs-triage 3, not-affected 3, ignored 2.	https://ubuntu.com/security/CVE-2012-3488

Affected software / configurations for CVE-2012-3488

Vendor	Product	Version	Raw CPE
postgresql	postgresql	9.1	cpe:2.3:a:postgresql:postgresql:9.1:::::::*
postgresql	postgresql	9.1.1	cpe:2.3:a:postgresql:postgresql:9.1.1:::::::*
postgresql	postgresql	9.1.2	cpe:2.3:a:postgresql:postgresql:9.1.2:::::::*
postgresql	postgresql	9.1.3	cpe:2.3:a:postgresql:postgresql:9.1.3:::::::*
postgresql	postgresql	9.1.4	cpe:2.3:a:postgresql:postgresql:9.1.4:::::::*
postgresql	postgresql	8.4	cpe:2.3:a:postgresql:postgresql:8.4:::::::*
postgresql	postgresql	8.4.1	cpe:2.3:a:postgresql:postgresql:8.4.1:::::::*
postgresql	postgresql	8.4.2	cpe:2.3:a:postgresql:postgresql:8.4.2:::::::*
postgresql	postgresql	8.4.3	cpe:2.3:a:postgresql:postgresql:8.4.3:::::::*
postgresql	postgresql	8.4.4	cpe:2.3:a:postgresql:postgresql:8.4.4:::::::*
postgresql	postgresql	8.4.5	cpe:2.3:a:postgresql:postgresql:8.4.5:::::::*
postgresql	postgresql	8.4.6	cpe:2.3:a:postgresql:postgresql:8.4.6:::::::*
postgresql	postgresql	8.4.7	cpe:2.3:a:postgresql:postgresql:8.4.7:::::::*
postgresql	postgresql	8.4.8	cpe:2.3:a:postgresql:postgresql:8.4.8:::::::*
postgresql	postgresql	8.4.9	cpe:2.3:a:postgresql:postgresql:8.4.9:::::::*
postgresql	postgresql	8.4.10	cpe:2.3:a:postgresql:postgresql:8.4.10:::::::*
postgresql	postgresql	8.4.11	cpe:2.3:a:postgresql:postgresql:8.4.11:::::::*
postgresql	postgresql	8.4.12	cpe:2.3:a:postgresql:postgresql:8.4.12:::::::*
postgresql	postgresql	8.3	cpe:2.3:a:postgresql:postgresql:8.3:::::::*
postgresql	postgresql	8.3.1	cpe:2.3:a:postgresql:postgresql:8.3.1:::::::*
postgresql	postgresql	8.3.2	cpe:2.3:a:postgresql:postgresql:8.3.2:::::::*
postgresql	postgresql	8.3.3	cpe:2.3:a:postgresql:postgresql:8.3.3:::::::*
postgresql	postgresql	8.3.4	cpe:2.3:a:postgresql:postgresql:8.3.4:::::::*
postgresql	postgresql	8.3.5	cpe:2.3:a:postgresql:postgresql:8.3.5:::::::*
postgresql	postgresql	8.3.6	cpe:2.3:a:postgresql:postgresql:8.3.6:::::::*
postgresql	postgresql	8.3.7	cpe:2.3:a:postgresql:postgresql:8.3.7:::::::*
postgresql	postgresql	8.3.8	cpe:2.3:a:postgresql:postgresql:8.3.8:::::::*
postgresql	postgresql	8.3.9	cpe:2.3:a:postgresql:postgresql:8.3.9:::::::*
postgresql	postgresql	8.3.10	cpe:2.3:a:postgresql:postgresql:8.3.10:::::::*
postgresql	postgresql	8.3.11	cpe:2.3:a:postgresql:postgresql:8.3.11:::::::*
postgresql	postgresql	8.3.12	cpe:2.3:a:postgresql:postgresql:8.3.12:::::::*
postgresql	postgresql	8.3.13	cpe:2.3:a:postgresql:postgresql:8.3.13:::::::*
postgresql	postgresql	8.3.14	cpe:2.3:a:postgresql:postgresql:8.3.14:::::::*
postgresql	postgresql	8.3.15	cpe:2.3:a:postgresql:postgresql:8.3.15:::::::*
postgresql	postgresql	8.3.16	cpe:2.3:a:postgresql:postgresql:8.3.16:::::::*
postgresql	postgresql	8.3.17	cpe:2.3:a:postgresql:postgresql:8.3.17:::::::*
postgresql	postgresql	8.3.18	cpe:2.3:a:postgresql:postgresql:8.3.18:::::::*
postgresql	postgresql	8.3.19	cpe:2.3:a:postgresql:postgresql:8.3.19:::::::*
postgresql	postgresql	9.0	cpe:2.3:a:postgresql:postgresql:9.0:::::::*
postgresql	postgresql	9.0.1	cpe:2.3:a:postgresql:postgresql:9.0.1:::::::*
postgresql	postgresql	9.0.2	cpe:2.3:a:postgresql:postgresql:9.0.2:::::::*
postgresql	postgresql	9.0.3	cpe:2.3:a:postgresql:postgresql:9.0.3:::::::*
postgresql	postgresql	9.0.4	cpe:2.3:a:postgresql:postgresql:9.0.4:::::::*
postgresql	postgresql	9.0.5	cpe:2.3:a:postgresql:postgresql:9.0.5:::::::*
postgresql	postgresql	9.0.6	cpe:2.3:a:postgresql:postgresql:9.0.6:::::::*
postgresql	postgresql	9.0.7	cpe:2.3:a:postgresql:postgresql:9.0.7:::::::*
postgresql	postgresql	9.0.8	cpe:2.3:a:postgresql:postgresql:9.0.8:::::::*

References for CVE-2012-3488

URL	Tags
http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705
http://lists.apple.com/archives/security-announce/2013/Mar/msg00002.html
http://lists.opensuse.org/opensuse-updates/2012-09/msg00102.html
http://lists.opensuse.org/opensuse-updates/2012-10/msg00013.html
http://lists.opensuse.org/opensuse-updates/2012-10/msg00024.html
http://rhn.redhat.com/errata/RHSA-2012-1263.html
http://rhn.redhat.com/errata/RHSA-2012-1264.html
http://secunia.com/advisories/50635
http://secunia.com/advisories/50636
http://secunia.com/advisories/50718
http://secunia.com/advisories/50859
http://secunia.com/advisories/50946
http://www.debian.org/security/2012/dsa-2534
http://www.mandriva.com/security/advisories?name=MDVSA-2012:139
http://www.postgresql.org/about/news/1407/	Vendor Advisory
http://www.postgresql.org/docs/8.3/static/release-8-3-20.html
http://www.postgresql.org/docs/8.4/static/release-8-4-13.html
http://www.postgresql.org/docs/9.0/static/release-9-0-9.html
http://www.postgresql.org/docs/9.1/static/release-9-1-5.html
http://www.postgresql.org/support/security/	Vendor Advisory
http://www.securityfocus.com/bid/55072
http://www.ubuntu.com/usn/USN-1542-1
https://blogs.oracle.com/sunsecurity/entry/multiple_vulnerabilities_in_postgresql2
https://bugzilla.redhat.com/show_bug.cgi?id=849172

URL

CVE-2012-3488

Exploit prediction scoring system (EPSS) score for CVE-2012-3488

Common vulnerability scoring system (CVSS) metrics for CVE-2012-3488

Weakness enumeration for CVE-2012-3488

OS Trackers for CVE-2012-3488

Affected software / configurations for CVE-2012-3488

References for CVE-2012-3488