CVE-2012-6329

CVSS V2 High 7.5 CVSS V3 None
Description
The _compile function in Maketext.pm in the Locale::Maketext implementation in Perl before 5.17.7 does not properly handle backslashes and fully qualified method names during compilation of bracket notation, which allows context-dependent attackers to execute arbitrary commands via crafted input to an application that accepts translation strings from users, as demonstrated by the TWiki application before 5.1.3, and the Foswiki application 1.0.x through 1.0.10 and 1.1.x through 1.1.6.
Overview
  • CVE ID
  • CVE-2012-6329
  • Assigner
  • cve@mitre.org
  • Vulnerability Status
  • Modified
  • Published Version
  • 2013-01-04T21:55:01
  • Last Modified Date
  • 2016-12-08T03:02:47
Weakness Enumerations
CWE URL
CWE-94 http://cwe.mitre.org/data/definitions/94.html
CPE Configuration (Product)
CPE Vulnerable Operator Version Start Version End
cpe:2.3:a:perl:perl:*:*:*:*:*:*:*:* 1 OR 5.16.2
cpe:2.3:a:perl:perl:5.10:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:perl:perl:5.10.0:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:perl:perl:5.10.0:rc1:*:*:*:*:*:* 1 OR
cpe:2.3:a:perl:perl:5.10.0:rc2:*:*:*:*:*:* 1 OR
cpe:2.3:a:perl:perl:5.10.1:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:perl:perl:5.10.1:rc1:*:*:*:*:*:* 1 OR
cpe:2.3:a:perl:perl:5.10.1:rc2:*:*:*:*:*:* 1 OR
cpe:2.3:a:perl:perl:5.11.0:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:perl:perl:5.11.1:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:perl:perl:5.11.2:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:perl:perl:5.11.3:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:perl:perl:5.11.4:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:perl:perl:5.11.5:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:perl:perl:5.12.0:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:perl:perl:5.12.0:rc0:*:*:*:*:*:* 1 OR
cpe:2.3:a:perl:perl:5.12.0:rc1:*:*:*:*:*:* 1 OR
cpe:2.3:a:perl:perl:5.12.0:rc2:*:*:*:*:*:* 1 OR
cpe:2.3:a:perl:perl:5.12.0:rc3:*:*:*:*:*:* 1 OR
cpe:2.3:a:perl:perl:5.12.0:rc4:*:*:*:*:*:* 1 OR
cpe:2.3:a:perl:perl:5.12.0:rc5:*:*:*:*:*:* 1 OR
cpe:2.3:a:perl:perl:5.12.1:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:perl:perl:5.12.1:rc1:*:*:*:*:*:* 1 OR
cpe:2.3:a:perl:perl:5.12.1:rc2:*:*:*:*:*:* 1 OR
cpe:2.3:a:perl:perl:5.12.2:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:perl:perl:5.12.2:rc1:*:*:*:*:*:* 1 OR
cpe:2.3:a:perl:perl:5.12.3:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:perl:perl:5.12.3:rc1:*:*:*:*:*:* 1 OR
cpe:2.3:a:perl:perl:5.12.3:rc2:*:*:*:*:*:* 1 OR
cpe:2.3:a:perl:perl:5.12.3:rc3:*:*:*:*:*:* 1 OR
cpe:2.3:a:perl:perl:5.13.0:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:perl:perl:5.13.1:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:perl:perl:5.13.2:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:perl:perl:5.13.3:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:perl:perl:5.13.4:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:perl:perl:5.13.5:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:perl:perl:5.13.6:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:perl:perl:5.13.7:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:perl:perl:5.13.8:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:perl:perl:5.13.9:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:perl:perl:5.13.10:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:perl:perl:5.13.11:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:perl:perl:5.14.0:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:perl:perl:5.14.0:rc1:*:*:*:*:*:* 1 OR
cpe:2.3:a:perl:perl:5.14.0:rc2:*:*:*:*:*:* 1 OR
cpe:2.3:a:perl:perl:5.14.0:rc3:*:*:*:*:*:* 1 OR
cpe:2.3:a:perl:perl:5.14.1:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:perl:perl:5.14.2:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:perl:perl:5.14.3:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:perl:perl:5.16.0:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:perl:perl:5.16.1:*:*:*:*:*:*:* 1 OR
CVSS Version 2
  • Version
  • 2.0
  • Vector String
  • AV:N/AC:L/Au:N/C:P/I:P/A:P
  • Access Vector
  • NETWORK
  • Access Compatibility
  • LOW
  • Authentication
  • NONE
  • Confidentiality Impact
  • PARTIAL
  • Integrity Impact
  • PARTIAL
  • Availability Impact
  • PARTIAL
  • Base Score
  • 7.5
  • Severity
  • HIGH
  • Exploitability Score
  • 10
  • Impact Score
  • 6.4
References
Reference URL Reference Tags
http://perl5.git.perl.org/perl.git/commit/1735f6f53ca19f99c6e9e39496c486af323ba6a8 Patch
http://sourceforge.net/mailarchive/message.php?msg_id=30219695
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=695224
http://twiki.org/cgi-bin/view/Codev/SecurityAlert-CVE-2012-6329
http://perl5.git.perl.org/perl.git/blob/HEAD:/pod/perl5177delta.pod
http://openwall.com/lists/oss-security/2012/12/11/4
http://code.activestate.com/lists/perl5-porters/187763/
http://code.activestate.com/lists/perl5-porters/187746/
https://bugzilla.redhat.com/show_bug.cgi?id=884354
http://rhn.redhat.com/errata/RHSA-2013-0685.html
http://www.mandriva.com/security/advisories?name=MDVSA-2013:113
https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0032
http://www.ubuntu.com/usn/USN-2099-1
http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html
http://www.securityfocus.com/bid/56950
http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10735
http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705
Sources
Source Name Source URL
NIST https://nvd.nist.gov/vuln/detail/CVE-2012-6329
MITRE https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-6329
History
Created Old Value New Value Data Type Notes
2022-05-10 09:57:52 Added to TrackCVE