Vulnerability in core server (CVE-2012-3489)

xmlparse DTD validation can be used to read arbitrary files...

[SECURITY] Fedora 18 Update: ocaml-xml-light-2.3-0.1.svn234.fc18

Xml-Light is a minimal XML parser & printer for OCaml. It provides functions to parse an XML document into an OCaml data structure, work with it, and print it back to an XML document. It support also DTD parsing and checking, and is entirely written in OCaml, hence it does not require additional ...

postgresql: File disclosure through XXE in xmlparse by DTD validation

The xmlparse function in the libxml2 support in the core server component in PostgreSQL 8.3 before 8.3.20, 8.4 before 8.4.13, 9.0 before 9.0.9, and 9.1 before 9.1.5 allows remote authenticated users to determine the existence of arbitrary files or URLs, and possibly obtain file or URL content tha...

libxslt: DoS when reading unexpected DTD nodes in XSLT

The XSL implementation in Google Chrome before 20.0.1132.43 allows remote attackers to cause a denial of service incorrect read operation via unspecified vectors...

[SECURITY] Fedora 17 Update: ocaml-xml-light-2.3-0.1.svn234.fc17

Xml-Light is a minimal XML parser & printer for OCaml. It provides functions to parse an XML document into an OCaml data structure, work with it, and print it back to an XML document. It support also DTD parsing and checking, and is entirely written in OCaml, hence it does not require additional ...

PostgreSQL 'xml_parse()'任意文件访问漏洞

Bugtraq ID:55074 CVE ID: CVE-2012-3489 PostgreSQL是一款对象关系型数据库管理系统，支持扩展的SQL标准子集。 PostgreSQL解析XML文档中的DTD数据时"xmlparse"函数存在错误，可被利用读取任意文件。 0 PostgreSQL 8.x PostgreSQL 9.x 厂商解决方案 PostgreSQL 9.1.5, 9.0.9, 8.4.13或8.3.20已经修复此漏洞，建议用户下载使用： http://www.postgresql.org...

FreeBSD : databases/postgresql*-server -- multiple vulnerabilities (07234e78-e899-11e1-b38d-0023ae8e59f0)

The PostgreSQL Global Development Group reports : The PostgreSQL Global Development Group today released security updates for all active branches of the PostgreSQL database system, including versions 9.1.5, 9.0.9, 8.4.13 and 8.3.20. This update patches security holes associated with libxml2 and...

Scientific Linux Security Update : xerces-j2 on SL6.x i386/x86_64

The xerces-j2 packages provide the Apache Xerces2 Java Parser, a high-performance XML parser. A Document Type Definition DTD defines the legal syntax and also which elements can be used for certain types of files, such as XML files. A flaw was found in the way the Apache Xerces2 Java Parser...

Scientific Linux Security Update : libxml and libxml2 on SL3.x, SL4.x, SL5.x i386/x86_64

CVE-2009-2414 libxml, libxml2, mingw32-libxml2: Stack overflow by parsing root XML element DTD definition CVE-2009-2416 libxml, libxml2, mingw32-libxml2: Pointer use-after-free flaws by parsing Notation and Enumeration attribute types A stack overflow flaw was found in the way libxml processes th...

CVE-2012-0037: libraptor - XXE in RDF/XML File Interpretation (Multiple office products affected)

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 VSR Security Advisory http://www.vsecurity.com/ =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= Advisory Name: libraptor - XXE in RDF/XML File Interpretation Release Date: 2012-03-24 Applications: libraptor / librdf...

Important: Red Hat Security Advisory: jbossas security update

Updated jbossas packages that fix one security issue are now available for JBoss Enterprise Application Platform 4.2.0.CP09 for Red Hat Enterprise Linux 4 and 5. The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System CVS...

Important: Red Hat Security Advisory: jbossws-common security update

An updated jbossws-common package that fixes one security issue is now available for JBoss Enterprise Application Platform 5.1.1 for Red Hat Enterprise Linux 4, 5, and 6. The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring...

CentOS Update for xerces-j2 CESA-2009:1615 centos5 i386

The remote host is missing an update for the SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptxrefname:"URL",...

CentOS Update for libxml CESA-2009:1206 centos3 i386

The remote host is missing an update for the SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptxrefname:"URL",...

SAP NetWeaver SPML - XML External Entity

Application: SAP NetWeaver JAVA Versions Affected: 6.40/7.02 maybe others Vendor URL: http://www.sap.com Bugs: XML External Entity Exploits: YES Reported: 08.04.2011 Vendor response: 09.04.2011 Patched by SAP: 11.09.2012 Date of Public Advisory: 15.12.2012 Reference: SAP Security Note 1621534...

SAP Netweaver CCMS - XML External Entity

Application: SAP NetWeaver ABAP Versions Affected: SAP NetWeaver ABAP Vendor URL: http://www.sap.com Bugs: XML External Entity Exploits: YES Reported: 07.12.2011 Vendor response: 08.12.2011 Date of Public Advisory: 13.11.2012 Reference: SAP Security Note 1715040 Authors: Alexey Tyurin ERPScan...

Moderate: Red Hat Security Advisory: xerces-j2 security update

Updated xerces-j2 packages that fix one security issue are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

SAP Netweaver CCMS - XML Entity Expansion DOS

Application: SAP NetWeaver Vendor URL: Bugs: DOS Risk: High Exploits: YES Reported: 13.05.2011 Vendor response: 15.05.2011 Patched: 13.11.2011 Date of Public Advisory: 13.03.2012 Reference: SAP Security Note 1594475 Author: Alexey Tyurin ERPScan Description SAP Netweaver – XML Entity Expansion It...

CVE-2010-3260

oxf/xml/xerces/XercesSAXParserFactoryImpl.java in the xforms-server component in the XForms service in Orbeon Forms before 3.9 does not properly restrict DTDs in Ajax requests, which allows remote attackers to read arbitrary files or send HTTP requests to intranet servers via an entity declaratio...

[SECURITY] Fedora 14 Update: libxml2-2.7.7-3.fc14

This library allows to manipulate XML files. It includes support to read, modify and write XML and HTML files. There is DTDs support this includes parsing and validation even with complex DtDs, either at parse time or later once the document has been modified. The output can be a simple SAX strea...