CVE-2012-6329
At a glance
- Source
- NVD
- EPSS
- EPSS 63.74 % · percentile 99 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- mitre
- NVD status
- Modified
Description
The _compile function in Maketext.pm in the Locale::Maketext implementation in Perl before 5.17.7 does not properly handle backslashes and fully qualified method names during compilation of bracket notation, which allows context-dependent attackers to execute arbitrary commands via crafted input to an application that accepts translation strings from users, as demonstrated by the TWiki application before 5.1.3, and the Foswiki application 1.0.x through 1.0.10 and 1.1.x through 1.1.6.
Weaknesses (CWE)
- CWE-94 — Improper Control of Generation of Code
References
- http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html
- http://www.mandriva.com/security/advisories?name=MDVSA-2013:113
- http://twiki.org/cgi-bin/view/Codev/SecurityAlert-CVE-2012-6329
- http://sourceforge.net/mailarchive/message.php?msg_id=30219695
- http://perl5.git.perl.org/perl.git/commit/1735f6f53ca19f99c6e9e39496c486af323ba6a8
- http://perl5.git.perl.org/perl.git/blob/HEAD:/pod/perl5177delta.pod
- http://code.activestate.com/lists/perl5-porters/187763/
- http://openwall.com/lists/oss-security/2012/12/11/4
- https://bugzilla.redhat.com/show_bug.cgi?id=884354
- https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0032
- http://www.ubuntu.com/usn/USN-2099-1
- http://code.activestate.com/lists/perl5-porters/187746/
- http://rhn.redhat.com/errata/RHSA-2013-0685.html
- http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705
- http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10735
- http://www.securityfocus.com/bid/56950
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=695224
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 2.0 | HIGH 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2012-6184
- GCVE · GCVE-0-2012-6329
CERT-FR advisories
- CERTFR-2016-AVI-128 — Multiples vulnérabilités dans les produits Juniper · cert.ssi.gouv.fr
- CERTFR-2015-AVI-431 — Multiples vulnérabilités dans les produits Juniper · cert.ssi.gouv.fr
- CERTA-2013-AVI-593 — Multiples vulnérabilités dans Oracle Solaris · cert.ssi.gouv.fr
- CERTA-2013-AVI-416 — Multiples vulnérabilités dans Oracle Solaris · cert.ssi.gouv.fr
- CERTA-2013-AVI-387 — Multiples vulnérabilités dans Oracle Solaris · cert.ssi.gouv.fr
- CERTA-2012-AVI-740 — Vulnérabilité dans TWiki · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:perl:perl:*:*:*:*:*:*:*:*≤ 5.16.2cpe:2.3:a:perl:perl:5.10:*:*:*:*:*:*:*cpe:2.3:a:perl:perl:5.10.0:*:*:*:*:*:*:*cpe:2.3:a:perl:perl:5.10.0:rc1:*:*:*:*:*:*cpe:2.3:a:perl:perl:5.10.0:rc2:*:*:*:*:*:*cpe:2.3:a:perl:perl:5.10.1:*:*:*:*:*:*:*cpe:2.3:a:perl:perl:5.10.1:rc1:*:*:*:*:*:*cpe:2.3:a:perl:perl:5.10.1:rc2:*:*:*:*:*:*cpe:2.3:a:perl:perl:5.11.0:*:*:*:*:*:*:*cpe:2.3:a:perl:perl:5.11.1:*:*:*:*:*:*:*cpe:2.3:a:perl:perl:5.11.2:*:*:*:*:*:*:*cpe:2.3:a:perl:perl:5.11.3:*:*:*:*:*:*:*cpe:2.3:a:perl:perl:5.11.4:*:*:*:*:*:*:*cpe:2.3:a:perl:perl:5.11.5:*:*:*:*:*:*:*cpe:2.3:a:perl:perl:5.12.0:*:*:*:*:*:*:*cpe:2.3:a:perl:perl:5.12.0:rc0:*:*:*:*:*:*cpe:2.3:a:perl:perl:5.12.0:rc1:*:*:*:*:*:*cpe:2.3:a:perl:perl:5.12.0:rc2:*:*:*:*:*:*cpe:2.3:a:perl:perl:5.12.0:rc3:*:*:*:*:*:*cpe:2.3:a:perl:perl:5.12.0:rc4:*:*:*:*:*:*cpe:2.3:a:perl:perl:5.12.0:rc5:*:*:*:*:*:*cpe:2.3:a:perl:perl:5.12.1:*:*:*:*:*:*:*cpe:2.3:a:perl:perl:5.12.1:rc1:*:*:*:*:*:*cpe:2.3:a:perl:perl:5.12.1:rc2:*:*:*:*:*:*cpe:2.3:a:perl:perl:5.12.2:*:*:*:*:*:*:*cpe:2.3:a:perl:perl:5.12.2:rc1:*:*:*:*:*:*cpe:2.3:a:perl:perl:5.12.3:*:*:*:*:*:*:*cpe:2.3:a:perl:perl:5.12.3:rc1:*:*:*:*:*:*cpe:2.3:a:perl:perl:5.12.3:rc2:*:*:*:*:*:*cpe:2.3:a:perl:perl:5.12.3:rc3:*:*:*:*:*:*cpe:2.3:a:perl:perl:5.13.0:*:*:*:*:*:*:*cpe:2.3:a:perl:perl:5.13.1:*:*:*:*:*:*:*cpe:2.3:a:perl:perl:5.13.2:*:*:*:*:*:*:*cpe:2.3:a:perl:perl:5.13.3:*:*:*:*:*:*:*cpe:2.3:a:perl:perl:5.13.4:*:*:*:*:*:*:*cpe:2.3:a:perl:perl:5.13.5:*:*:*:*:*:*:*cpe:2.3:a:perl:perl:5.13.6:*:*:*:*:*:*:*cpe:2.3:a:perl:perl:5.13.7:*:*:*:*:*:*:*cpe:2.3:a:perl:perl:5.13.8:*:*:*:*:*:*:*cpe:2.3:a:perl:perl:5.13.9:*:*:*:*:*:*:*- +11 more
Affected products
| Product | Versions |
|---|---|
| affected n/a |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |