cvelistv5 - cve-2012-3489

CVE-2012-3489 (GCVE-0-2012-3489)

Vulnerability from cvelistv5

Published

2012-10-03 21:00

Modified

2024-08-06 20:05

Severity ?

CWE

Summary

The xml_parse function in the libxml2 support in the core server component in PostgreSQL 8.3 before 8.3.20, 8.4 before 8.4.13, 9.0 before 9.0.9, and 9.1 before 9.1.5 allows remote authenticated users to determine the existence of arbitrary files or URLs, and possibly obtain file or URL content that triggers a parsing error, via an XML value that refers to (1) a DTD or (2) an entity, related to an XML External Entity (aka XXE) issue.

References

URL

Tags

	http://rhn.redhat.com/errata/RHSA-2012-1263.html	vendor-advisory, x_refsource_REDHAT
	http://www.securityfocus.com/bid/55074	vdb-entry, x_refsource_BID
	http://www.postgresql.org/docs/9.0/static/release-9-0-9.html	x_refsource_CONFIRM
	http://www.mandriva.com/security/advisories?name=MDVSA-2012:139	vendor-advisory, x_refsource_MANDRIVA
	http://www.ubuntu.com/usn/USN-1542-1	vendor-advisory, x_refsource_UBUNTU
	http://secunia.com/advisories/50718	third-party-advisory, x_refsource_SECUNIA
	http://www.postgresql.org/docs/9.1/static/release-9-1-5.html	x_refsource_CONFIRM
	https://blogs.oracle.com/sunsecurity/entry/multiple_vulnerabilities_in_postgresql2	x_refsource_CONFIRM
	http://www.postgresql.org/docs/8.4/static/release-8-4-13.html	x_refsource_CONFIRM
	http://www.postgresql.org/docs/8.3/static/release-8-3-20.html	x_refsource_CONFIRM
	http://www.postgresql.org/about/news/1407/	x_refsource_CONFIRM
	http://secunia.com/advisories/50635	third-party-advisory, x_refsource_SECUNIA
	http://www.postgresql.org/support/security/	x_refsource_CONFIRM
	http://lists.apple.com/archives/security-announce/2013/Mar/msg00002.html	vendor-advisory, x_refsource_APPLE
	http://secunia.com/advisories/50946	third-party-advisory, x_refsource_SECUNIA
	https://bugzilla.redhat.com/show_bug.cgi?id=849173	x_refsource_CONFIRM
	http://www.debian.org/security/2012/dsa-2534	vendor-advisory, x_refsource_DEBIAN
	http://lists.opensuse.org/opensuse-updates/2012-09/msg00102.html	vendor-advisory, x_refsource_SUSE
	http://lists.opensuse.org/opensuse-updates/2012-10/msg00013.html	vendor-advisory, x_refsource_SUSE
	http://secunia.com/advisories/50859	third-party-advisory, x_refsource_SECUNIA
	http://lists.opensuse.org/opensuse-updates/2012-10/msg00024.html	vendor-advisory, x_refsource_SUSE

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T20:05:12.659Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "RHSA-2012:1263",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2012-1263.html"
          },
          {
            "name": "55074",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/55074"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.postgresql.org/docs/9.0/static/release-9-0-9.html"
          },
          {
            "name": "MDVSA-2012:139",
            "tags": [
              "vendor-advisory",
              "x_refsource_MANDRIVA",
              "x_transferred"
            ],
            "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2012:139"
          },
          {
            "name": "USN-1542-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "http://www.ubuntu.com/usn/USN-1542-1"
          },
          {
            "name": "50718",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/50718"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.postgresql.org/docs/9.1/static/release-9-1-5.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://blogs.oracle.com/sunsecurity/entry/multiple_vulnerabilities_in_postgresql2"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.postgresql.org/docs/8.4/static/release-8-4-13.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.postgresql.org/docs/8.3/static/release-8-3-20.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.postgresql.org/about/news/1407/"
          },
          {
            "name": "50635",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/50635"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.postgresql.org/support/security/"
          },
          {
            "name": "APPLE-SA-2013-03-14-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_APPLE",
              "x_transferred"
            ],
            "url": "http://lists.apple.com/archives/security-announce/2013/Mar/msg00002.html"
          },
          {
            "name": "50946",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/50946"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=849173"
          },
          {
            "name": "DSA-2534",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2012/dsa-2534"
          },
          {
            "name": "openSUSE-SU-2012:1251",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-updates/2012-09/msg00102.html"
          },
          {
            "name": "openSUSE-SU-2012:1288",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-updates/2012-10/msg00013.html"
          },
          {
            "name": "50859",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/50859"
          },
          {
            "name": "openSUSE-SU-2012:1299",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-updates/2012-10/msg00024.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2012-08-17T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "The xml_parse function in the libxml2 support in the core server component in PostgreSQL 8.3 before 8.3.20, 8.4 before 8.4.13, 9.0 before 9.0.9, and 9.1 before 9.1.5 allows remote authenticated users to determine the existence of arbitrary files or URLs, and possibly obtain file or URL content that triggers a parsing error, via an XML value that refers to (1) a DTD or (2) an entity, related to an XML External Entity (aka XXE) issue."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2012-10-13T09:00:00.000Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "RHSA-2012:1263",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2012-1263.html"
        },
        {
          "name": "55074",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/55074"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.postgresql.org/docs/9.0/static/release-9-0-9.html"
        },
        {
          "name": "MDVSA-2012:139",
          "tags": [
            "vendor-advisory",
            "x_refsource_MANDRIVA"
          ],
          "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2012:139"
        },
        {
          "name": "USN-1542-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "http://www.ubuntu.com/usn/USN-1542-1"
        },
        {
          "name": "50718",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/50718"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.postgresql.org/docs/9.1/static/release-9-1-5.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://blogs.oracle.com/sunsecurity/entry/multiple_vulnerabilities_in_postgresql2"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.postgresql.org/docs/8.4/static/release-8-4-13.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.postgresql.org/docs/8.3/static/release-8-3-20.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.postgresql.org/about/news/1407/"
        },
        {
          "name": "50635",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/50635"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.postgresql.org/support/security/"
        },
        {
          "name": "APPLE-SA-2013-03-14-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_APPLE"
          ],
          "url": "http://lists.apple.com/archives/security-announce/2013/Mar/msg00002.html"
        },
        {
          "name": "50946",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/50946"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=849173"
        },
        {
          "name": "DSA-2534",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2012/dsa-2534"
        },
        {
          "name": "openSUSE-SU-2012:1251",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-updates/2012-09/msg00102.html"
        },
        {
          "name": "openSUSE-SU-2012:1288",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-updates/2012-10/msg00013.html"
        },
        {
          "name": "50859",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/50859"
        },
        {
          "name": "openSUSE-SU-2012:1299",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-updates/2012-10/msg00024.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert@redhat.com",
          "ID": "CVE-2012-3489",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The xml_parse function in the libxml2 support in the core server component in PostgreSQL 8.3 before 8.3.20, 8.4 before 8.4.13, 9.0 before 9.0.9, and 9.1 before 9.1.5 allows remote authenticated users to determine the existence of arbitrary files or URLs, and possibly obtain file or URL content that triggers a parsing error, via an XML value that refers to (1) a DTD or (2) an entity, related to an XML External Entity (aka XXE) issue."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "RHSA-2012:1263",
              "refsource": "REDHAT",
              "url": "http://rhn.redhat.com/errata/RHSA-2012-1263.html"
            },
            {
              "name": "55074",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/55074"
            },
            {
              "name": "http://www.postgresql.org/docs/9.0/static/release-9-0-9.html",
              "refsource": "CONFIRM",
              "url": "http://www.postgresql.org/docs/9.0/static/release-9-0-9.html"
            },
            {
              "name": "MDVSA-2012:139",
              "refsource": "MANDRIVA",
              "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2012:139"
            },
            {
              "name": "USN-1542-1",
              "refsource": "UBUNTU",
              "url": "http://www.ubuntu.com/usn/USN-1542-1"
            },
            {
              "name": "50718",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/50718"
            },
            {
              "name": "http://www.postgresql.org/docs/9.1/static/release-9-1-5.html",
              "refsource": "CONFIRM",
              "url": "http://www.postgresql.org/docs/9.1/static/release-9-1-5.html"
            },
            {
              "name": "https://blogs.oracle.com/sunsecurity/entry/multiple_vulnerabilities_in_postgresql2",
              "refsource": "CONFIRM",
              "url": "https://blogs.oracle.com/sunsecurity/entry/multiple_vulnerabilities_in_postgresql2"
            },
            {
              "name": "http://www.postgresql.org/docs/8.4/static/release-8-4-13.html",
              "refsource": "CONFIRM",
              "url": "http://www.postgresql.org/docs/8.4/static/release-8-4-13.html"
            },
            {
              "name": "http://www.postgresql.org/docs/8.3/static/release-8-3-20.html",
              "refsource": "CONFIRM",
              "url": "http://www.postgresql.org/docs/8.3/static/release-8-3-20.html"
            },
            {
              "name": "http://www.postgresql.org/about/news/1407/",
              "refsource": "CONFIRM",
              "url": "http://www.postgresql.org/about/news/1407/"
            },
            {
              "name": "50635",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/50635"
            },
            {
              "name": "http://www.postgresql.org/support/security/",
              "refsource": "CONFIRM",
              "url": "http://www.postgresql.org/support/security/"
            },
            {
              "name": "APPLE-SA-2013-03-14-1",
              "refsource": "APPLE",
              "url": "http://lists.apple.com/archives/security-announce/2013/Mar/msg00002.html"
            },
            {
              "name": "50946",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/50946"
            },
            {
              "name": "https://bugzilla.redhat.com/show_bug.cgi?id=849173",
              "refsource": "CONFIRM",
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=849173"
            },
            {
              "name": "DSA-2534",
              "refsource": "DEBIAN",
              "url": "http://www.debian.org/security/2012/dsa-2534"
            },
            {
              "name": "openSUSE-SU-2012:1251",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-updates/2012-09/msg00102.html"
            },
            {
              "name": "openSUSE-SU-2012:1288",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-updates/2012-10/msg00013.html"
            },
            {
              "name": "50859",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/50859"
            },
            {
              "name": "openSUSE-SU-2012:1299",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-updates/2012-10/msg00024.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2012-3489",
    "datePublished": "2012-10-03T21:00:00.000Z",
    "dateReserved": "2012-06-14T00:00:00.000Z",
    "dateUpdated": "2024-08-06T20:05:12.659Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CERTA-2014-AVI-008

Vulnerability from certfr_avis

De multiples vulnérabilités ont été corrigées dans Avaya Experience Portal. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et un déni de service.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Avaya Experience Portal versions antérieures à 7.0

Impacted products

	Vendor	Product	Description

References

Title

Publication Time

Tags

Bulletin de sécurité Avaya ASA-2012-482 du 08 janvier 2014	None	vendor-advisory
Bulletin de sécurité Avaya ASA-2013-041 du 08 janvier 2014	None	vendor-advisory
Bulletin de sécurité Avaya ASA-2012-479 du 08 janvier 2014	None	vendor-advisory
Bulletin de sécurité Avaya ASA-2012-448 du 08 janvier 2014	None	vendor-advisory
Bulletin de sécurité Avaya ASA-2012-371 du 08 janvier 2014	None	vendor-advisory
Bulletin de sécurité Avaya ASA-2012-444 du 08 janvier 2014	None	vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [],
  "affected_systems_content": "\u003cP\u003eAvaya Experience Portal versions ant\u00e9rieures \u00e0 7.0\u003c/P\u003e",
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2012-4244",
      "url": "https://www.cve.org/CVERecord?id=CVE-2012-4244"
    },
    {
      "name": "CVE-2012-3511",
      "url": "https://www.cve.org/CVERecord?id=CVE-2012-3511"
    },
    {
      "name": "CVE-2012-4405",
      "url": "https://www.cve.org/CVERecord?id=CVE-2012-4405"
    },
    {
      "name": "CVE-2011-3970",
      "url": "https://www.cve.org/CVERecord?id=CVE-2011-3970"
    },
    {
      "name": "CVE-2012-3400",
      "url": "https://www.cve.org/CVERecord?id=CVE-2012-3400"
    },
    {
      "name": "CVE-2012-2871",
      "url": "https://www.cve.org/CVERecord?id=CVE-2012-2871"
    },
    {
      "name": "CVE-2012-2870",
      "url": "https://www.cve.org/CVERecord?id=CVE-2012-2870"
    },
    {
      "name": "CVE-2012-2133",
      "url": "https://www.cve.org/CVERecord?id=CVE-2012-2133"
    },
    {
      "name": "CVE-2012-3488",
      "url": "https://www.cve.org/CVERecord?id=CVE-2012-3488"
    },
    {
      "name": "CVE-2012-1568",
      "url": "https://www.cve.org/CVERecord?id=CVE-2012-1568"
    },
    {
      "name": "CVE-2012-2893",
      "url": "https://www.cve.org/CVERecord?id=CVE-2012-2893"
    },
    {
      "name": "CVE-2012-3546",
      "url": "https://www.cve.org/CVERecord?id=CVE-2012-3546"
    },
    {
      "name": "CVE-2012-3489",
      "url": "https://www.cve.org/CVERecord?id=CVE-2012-3489"
    },
    {
      "name": "CVE-2011-1202",
      "url": "https://www.cve.org/CVERecord?id=CVE-2011-1202"
    },
    {
      "name": "CVE-2012-2825",
      "url": "https://www.cve.org/CVERecord?id=CVE-2012-2825"
    }
  ],
  "initial_release_date": "2014-01-10T00:00:00",
  "last_revision_date": "2014-01-10T00:00:00",
  "links": [],
  "reference": "CERTA-2014-AVI-008",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2014-01-10T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "D\u00e9ni de service"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 corrig\u00e9es dans \u003cspan\nclass=\"textit\"\u003eAvaya Experience Portal\u003c/span\u003e. Certaines d\u0027entre elles\npermettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire\n\u00e0 distance, un d\u00e9ni de service \u00e0 distance et un d\u00e9ni de service.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans Avaya Experience Portal",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Avaya ASA-2012-482 du 08 janvier 2014",
      "url": "https://downloads.avaya.com/css/P8/documents/100167760"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Avaya ASA-2013-041 du 08 janvier 2014",
      "url": "https://downloads.avaya.com/css/P8/documents/100169684"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Avaya ASA-2012-479 du 08 janvier 2014",
      "url": "https://downloads.avaya.com/css/P8/documents/100167733"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Avaya ASA-2012-448 du 08 janvier 2014",
      "url": "https://downloads.avaya.com/css/P8/documents/100167395"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Avaya ASA-2012-371 du 08 janvier 2014",
      "url": "https://downloads.avaya.com/css/P8/documents/100166061"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Avaya ASA-2012-444 du 08 janvier 2014",
      "url": "https://downloads.avaya.com/css/P8/documents/100167374"
    }
  ]
}

CERTA-2012-AVI-546

Vulnerability from certfr_avis

De multiples vulnérabilités ont été corrigées dans Apple OS X Server 2.1.1. Elles concernent le serveur de messagerie Jabber et la base de données PostgreSQL. Elles permettent une atteinte à la confidentialité des données et un déni de service à distance.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Versions antérieures à OS X Server version 2.1.1

Impacted products

	Vendor	Product	Description

References

Title

Publication Time

Tags

Bulletin de sécurité Apple HT5533 du 03 octobre 2012

None

vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [],
  "affected_systems_content": "\u003cP\u003eVersions ant\u00e9rieures \u00e0 OS X Server version 2.1.1\u003c/P\u003e",
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2012-3488",
      "url": "https://www.cve.org/CVERecord?id=CVE-2012-3488"
    },
    {
      "name": "CVE-2012-3489",
      "url": "https://www.cve.org/CVERecord?id=CVE-2012-3489"
    },
    {
      "name": "CVE-2012-3525",
      "url": "https://www.cve.org/CVERecord?id=CVE-2012-3525"
    }
  ],
  "initial_release_date": "2012-10-05T00:00:00",
  "last_revision_date": "2012-10-05T00:00:00",
  "links": [],
  "reference": "CERTA-2012-AVI-546",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2012-10-05T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 corrig\u00e9es dans \u003cspan\nclass=\"textit\"\u003eApple OS X Server 2.1.1\u003c/span\u003e. Elles concernent le\nserveur de messagerie \u003cspan class=\"textit\"\u003eJabber\u003c/span\u003e et la base de\ndonn\u00e9es \u003cspan class=\"textit\"\u003ePostgreSQL\u003c/span\u003e. Elles permettent une\natteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es et un d\u00e9ni de service \u00e0\ndistance.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans Apple OS X Server",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Apple HT5533 du 03 octobre 2012",
      "url": "http://support.apple.com/kb/HT5533"
    }
  ]
}

CERTA-2012-AVI-455

Vulnerability from certfr_avis

Deux vulnérabilités ont été corrigées dans PostgreSQL. Leur exploitation réussie permet notamment de contourner la politique de sécurité et accéder en lecture/écriture de façon illégitime à des fichiers du serveur.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None

Impacted products

Vendor	Product	Description
PostgreSQL	PostgreSQL	PostgreSQL 8.3.20 et versions antérieures.
PostgreSQL	PostgreSQL	PostgreSQL 8.4.13 et versions antérieures ;
PostgreSQL	PostgreSQL	PostgreSQL 9.0.9 et versions antérieures ;
PostgreSQL	PostgreSQL	PostgreSQL 9.1.5 et versions antérieures ;

References

Title

Publication Time

Tags

Annonce de sécurité PostgreSQL du 17 août 2012	None	vendor-advisory
Bulletin de sécurité PostgreSQL du 17 août 2012 :	-	other

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "PostgreSQL 8.3.20 et versions ant\u00e9rieures.",
      "product": {
        "name": "PostgreSQL",
        "vendor": {
          "name": "PostgreSQL",
          "scada": false
        }
      }
    },
    {
      "description": "PostgreSQL 8.4.13 et versions ant\u00e9rieures ;",
      "product": {
        "name": "PostgreSQL",
        "vendor": {
          "name": "PostgreSQL",
          "scada": false
        }
      }
    },
    {
      "description": "PostgreSQL 9.0.9 et versions ant\u00e9rieures ;",
      "product": {
        "name": "PostgreSQL",
        "vendor": {
          "name": "PostgreSQL",
          "scada": false
        }
      }
    },
    {
      "description": "PostgreSQL 9.1.5 et versions ant\u00e9rieures ;",
      "product": {
        "name": "PostgreSQL",
        "vendor": {
          "name": "PostgreSQL",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2012-3488",
      "url": "https://www.cve.org/CVERecord?id=CVE-2012-3488"
    },
    {
      "name": "CVE-2012-3489",
      "url": "https://www.cve.org/CVERecord?id=CVE-2012-3489"
    }
  ],
  "initial_release_date": "2012-08-20T00:00:00",
  "last_revision_date": "2012-08-20T00:00:00",
  "links": [
    {
      "title": "Bulletin de s\u00e9curit\u00e9 PostgreSQL du 17 ao\u00fbt 2012 :",
      "url": "http://www.postgresql.org/about/news/1407"
    }
  ],
  "reference": "CERTA-2012-AVI-455",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2012-08-20T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "Deux vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 corrig\u00e9es dans \u003cspan\nclass=\"textit\"\u003ePostgreSQL\u003c/span\u003e. Leur exploitation r\u00e9ussie permet\nnotamment de contourner la politique de s\u00e9curit\u00e9 et acc\u00e9der en\nlecture/\u00e9criture de fa\u00e7on ill\u00e9gitime \u00e0 des fichiers du serveur.\n",
  "title": "Vuln\u00e9rabilit\u00e9s dans PostgreSQL",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Annonce de s\u00e9curit\u00e9 PostgreSQL du 17 ao\u00fbt 2012",
      "url": null
    }
  ]
}

CERTA-2013-AVI-204

Vulnerability from certfr_avis

De multiples vulnérabilités ont été corrigées dans Google Chrome. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et un contournement de la politique de sécurité.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Google Chrome versions antérieures à 26.0.1410.43

Impacted products

	Vendor	Product	Description

References

Title

Publication Time

Tags

Bulletin de sécurité Google du 26 mars 2013

None

vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [],
  "affected_systems_content": "\u003cP\u003eGoogle Chrome versions ant\u00e9rieures \u00e0 26.0.1410.43\u003c/P\u003e",
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2013-0976",
      "url": "https://www.cve.org/CVERecord?id=CVE-2013-0976"
    },
    {
      "name": "CVE-2013-0971",
      "url": "https://www.cve.org/CVERecord?id=CVE-2013-0971"
    },
    {
      "name": "CVE-2013-0969",
      "url": "https://www.cve.org/CVERecord?id=CVE-2013-0969"
    },
    {
      "name": "CVE-2013-0156",
      "url": "https://www.cve.org/CVERecord?id=CVE-2013-0156"
    },
    {
      "name": "CVE-2012-2088",
      "url": "https://www.cve.org/CVERecord?id=CVE-2012-2088"
    },
    {
      "name": "CVE-2012-3756",
      "url": "https://www.cve.org/CVERecord?id=CVE-2012-3756"
    },
    {
      "name": "CVE-2013-0963",
      "url": "https://www.cve.org/CVERecord?id=CVE-2013-0963"
    },
    {
      "name": "CVE-2012-3488",
      "url": "https://www.cve.org/CVERecord?id=CVE-2012-3488"
    },
    {
      "name": "CVE-2012-3749",
      "url": "https://www.cve.org/CVERecord?id=CVE-2012-3749"
    },
    {
      "name": "CVE-2011-3058",
      "url": "https://www.cve.org/CVERecord?id=CVE-2011-3058"
    },
    {
      "name": "CVE-2013-0970",
      "url": "https://www.cve.org/CVERecord?id=CVE-2013-0970"
    },
    {
      "name": "CVE-2013-0973",
      "url": "https://www.cve.org/CVERecord?id=CVE-2013-0973"
    },
    {
      "name": "CVE-2012-3489",
      "url": "https://www.cve.org/CVERecord?id=CVE-2012-3489"
    },
    {
      "name": "CVE-2012-3525",
      "url": "https://www.cve.org/CVERecord?id=CVE-2012-3525"
    },
    {
      "name": "CVE-2013-0967",
      "url": "https://www.cve.org/CVERecord?id=CVE-2013-0967"
    },
    {
      "name": "CVE-2013-0333",
      "url": "https://www.cve.org/CVERecord?id=CVE-2013-0333"
    },
    {
      "name": "CVE-2013-0966",
      "url": "https://www.cve.org/CVERecord?id=CVE-2013-0966"
    }
  ],
  "initial_release_date": "2013-03-27T00:00:00",
  "last_revision_date": "2013-03-27T00:00:00",
  "links": [],
  "reference": "CERTA-2013-AVI-204",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2013-03-27T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 corrig\u00e9es dans \u003cspan\nclass=\"textit\"\u003eGoogle Chrome\u003c/span\u003e. Certaines d\u0027entre elles permettent\n\u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance,\nun d\u00e9ni de service \u00e0 distance et un contournement de la politique de\ns\u00e9curit\u00e9.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans Google Chrome",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Google du 26 mars 2013",
      "url": "http://googlechromereleases.blogspot.fr/2013/03/stable-channel-update_26.html"
    }
  ]
}

CERTA-2013-AVI-187

Vulnerability from certfr_avis

De multiples vulnérabilités ont été corrigées dans Apple OS X Mountain Lion. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un contournement de la politique de sécurité et une atteinte à la confidentialité des données.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Versions antérieures à OS X Mountain Lion v10.8.3

Impacted products

	Vendor	Product	Description

References

Title

Publication Time

Tags

Bulletin de sécurité Apple HT5672 du 14 mars 2013

None

vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [],
  "affected_systems_content": "\u003cP\u003eVersions ant\u00e9rieures \u00e0 OS X Mountain Lion v10.8.3\u003c/P\u003e",
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2013-0976",
      "url": "https://www.cve.org/CVERecord?id=CVE-2013-0976"
    },
    {
      "name": "CVE-2013-0971",
      "url": "https://www.cve.org/CVERecord?id=CVE-2013-0971"
    },
    {
      "name": "CVE-2013-0969",
      "url": "https://www.cve.org/CVERecord?id=CVE-2013-0969"
    },
    {
      "name": "CVE-2013-0156",
      "url": "https://www.cve.org/CVERecord?id=CVE-2013-0156"
    },
    {
      "name": "CVE-2012-2088",
      "url": "https://www.cve.org/CVERecord?id=CVE-2012-2088"
    },
    {
      "name": "CVE-2012-3756",
      "url": "https://www.cve.org/CVERecord?id=CVE-2012-3756"
    },
    {
      "name": "CVE-2013-0963",
      "url": "https://www.cve.org/CVERecord?id=CVE-2013-0963"
    },
    {
      "name": "CVE-2012-3488",
      "url": "https://www.cve.org/CVERecord?id=CVE-2012-3488"
    },
    {
      "name": "CVE-2012-3749",
      "url": "https://www.cve.org/CVERecord?id=CVE-2012-3749"
    },
    {
      "name": "CVE-2011-3058",
      "url": "https://www.cve.org/CVERecord?id=CVE-2011-3058"
    },
    {
      "name": "CVE-2013-0970",
      "url": "https://www.cve.org/CVERecord?id=CVE-2013-0970"
    },
    {
      "name": "CVE-2013-0973",
      "url": "https://www.cve.org/CVERecord?id=CVE-2013-0973"
    },
    {
      "name": "CVE-2012-3489",
      "url": "https://www.cve.org/CVERecord?id=CVE-2012-3489"
    },
    {
      "name": "CVE-2012-3525",
      "url": "https://www.cve.org/CVERecord?id=CVE-2012-3525"
    },
    {
      "name": "CVE-2013-0967",
      "url": "https://www.cve.org/CVERecord?id=CVE-2013-0967"
    },
    {
      "name": "CVE-2013-0333",
      "url": "https://www.cve.org/CVERecord?id=CVE-2013-0333"
    },
    {
      "name": "CVE-2013-0966",
      "url": "https://www.cve.org/CVERecord?id=CVE-2013-0966"
    }
  ],
  "initial_release_date": "2013-03-18T00:00:00",
  "last_revision_date": "2013-03-18T00:00:00",
  "links": [],
  "reference": "CERTA-2013-AVI-187",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2013-03-18T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    },
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 corrig\u00e9es dans \u003cspan\nclass=\"textit\"\u003eApple OS X Mountain Lion\u003c/span\u003e. Certaines d\u0027entre elles\npermettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire\n\u00e0 distance, un contournement de la politique de s\u00e9curit\u00e9 et une atteinte\n\u00e0 la confidentialit\u00e9 des donn\u00e9es.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans Apple OS X Mountain Lion",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Apple HT5672 du 14 mars 2013",
      "url": "http://support.apple.com/kb/HT5672"
    }
  ]
}

Tags

Taxonomy of the tags.

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

CVE-2012-3489 (GCVE-0-2012-3489)

Vulnerability from cvelistv5

CERTA-2014-AVI-008

Vulnerability from certfr_avis

Solution

CERTA-2012-AVI-546

Vulnerability from certfr_avis

Solution

CERTA-2012-AVI-455

Vulnerability from certfr_avis

Solution

CERTA-2013-AVI-204

Vulnerability from certfr_avis

Solution

CERTA-2013-AVI-187

Vulnerability from certfr_avis

Solution

Tags

Sightings

Nomenclature