Detections
Analytics
FreeBSD : databases/postgresql*-server -- multiple vulnerabilities (07234e78-e899-11e1-b38d-0023ae8e59f0)
medium Nessus Plugin ID 61586
Language:
Synopsis
The remote FreeBSD host is missing one or more security-related updates.Description
The PostgreSQL Global Development Group reports :The PostgreSQL Global Development Group today released security updates for all active branches of the PostgreSQL database system, including versions 9.1.5, 9.0.9, 8.4.13 and 8.3.20. This update patches security holes associated with libxml2 and libxslt, similar to those affecting other open source projects. All users are urged to update their installations at the first available opportunity
Users who are relying on the built-in XML functionality to validate external DTDs will need to implement a workaround, as this security patch disables that functionality. Users who are using xslt_process() to fetch documents or stylesheets from external URLs will no longer be able to do so. The PostgreSQL project regrets the need to disable both of these features in order to maintain our security standards. These security issues with XML are substantially similar to issues patched recently by the Webkit (CVE-2011-1774), XMLsec (CVE-2011-1425) and PHP5 (CVE-2012-0057) projects.
Solution
Update the affected packages.See Also
Plugin Details
Severity: Medium
ID: 61586
File Name: freebsd_pkg_07234e78e89911e1b38d0023ae8e59f0.nasl
Version: 1.14
Type: local
Family: FreeBSD Local Security Checks
Published: 8/20/2012
Updated: 1/6/2021
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 6.5
CVSS v2
Risk Factor: Medium
Base Score: 4.9
Vector: CVSS2#AV:N/AC:M/Au:S/C:P/I:P/A:N
Vulnerability Information
CPE: p-cpe:/a:freebsd:freebsd:postgresql-server, cpe:/o:freebsd:freebsd
Required KB Items: Host/local_checks_enabled, Host/FreeBSD/release, Host/FreeBSD/pkg_info
Patch Publication Date: 8/17/2012
Vulnerability Publication Date: 8/17/2012
Reference Information
CVE: CVE-2012-3488, CVE-2012-3489