CVE-2012-6329
HIGH 7.5
En bref
- Source
- NVD
- EPSS
- EPSS 63.74 % · centile 99 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- mitre
- Statut NVD
- Modified
Description
The _compile function in Maketext.pm in the Locale::Maketext implementation in Perl before 5.17.7 does not properly handle backslashes and fully qualified method names during compilation of bracket notation, which allows context-dependent attackers to execute arbitrary commands via crafted input to an application that accepts translation strings from users, as demonstrated by the TWiki application before 5.1.3, and the Foswiki application 1.0.x through 1.0.10 and 1.1.x through 1.1.6.
Faiblesses (CWE)
- CWE-94 — Injection de code
Références
- http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html
- http://www.mandriva.com/security/advisories?name=MDVSA-2013:113
- http://twiki.org/cgi-bin/view/Codev/SecurityAlert-CVE-2012-6329
- http://sourceforge.net/mailarchive/message.php?msg_id=30219695
- http://perl5.git.perl.org/perl.git/commit/1735f6f53ca19f99c6e9e39496c486af323ba6a8
- http://perl5.git.perl.org/perl.git/blob/HEAD:/pod/perl5177delta.pod
- http://code.activestate.com/lists/perl5-porters/187763/
- http://openwall.com/lists/oss-security/2012/12/11/4
- https://bugzilla.redhat.com/show_bug.cgi?id=884354
- https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0032
- http://www.ubuntu.com/usn/USN-2099-1
- http://code.activestate.com/lists/perl5-porters/187746/
- http://rhn.redhat.com/errata/RHSA-2013-0685.html
- http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705
- http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10735
- http://www.securityfocus.com/bid/56950
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=695224
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 2.0 | HIGH 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P | NVD · nvd@nist.gov (Primary) |
Références européennes
- ENISA EUVD · EUVD-2012-6184
- GCVE · GCVE-0-2012-6329
Avis du CERT-FR
- CERTFR-2016-AVI-128 — Multiples vulnérabilités dans les produits Juniper · cert.ssi.gouv.fr
- CERTFR-2015-AVI-431 — Multiples vulnérabilités dans les produits Juniper · cert.ssi.gouv.fr
- CERTA-2013-AVI-593 — Multiples vulnérabilités dans Oracle Solaris · cert.ssi.gouv.fr
- CERTA-2013-AVI-416 — Multiples vulnérabilités dans Oracle Solaris · cert.ssi.gouv.fr
- CERTA-2013-AVI-387 — Multiples vulnérabilités dans Oracle Solaris · cert.ssi.gouv.fr
- CERTA-2012-AVI-740 — Vulnérabilité dans TWiki · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:a:perl:perl:*:*:*:*:*:*:*:*≤ 5.16.2cpe:2.3:a:perl:perl:5.10:*:*:*:*:*:*:*cpe:2.3:a:perl:perl:5.10.0:*:*:*:*:*:*:*cpe:2.3:a:perl:perl:5.10.0:rc1:*:*:*:*:*:*cpe:2.3:a:perl:perl:5.10.0:rc2:*:*:*:*:*:*cpe:2.3:a:perl:perl:5.10.1:*:*:*:*:*:*:*cpe:2.3:a:perl:perl:5.10.1:rc1:*:*:*:*:*:*cpe:2.3:a:perl:perl:5.10.1:rc2:*:*:*:*:*:*cpe:2.3:a:perl:perl:5.11.0:*:*:*:*:*:*:*cpe:2.3:a:perl:perl:5.11.1:*:*:*:*:*:*:*cpe:2.3:a:perl:perl:5.11.2:*:*:*:*:*:*:*cpe:2.3:a:perl:perl:5.11.3:*:*:*:*:*:*:*cpe:2.3:a:perl:perl:5.11.4:*:*:*:*:*:*:*cpe:2.3:a:perl:perl:5.11.5:*:*:*:*:*:*:*cpe:2.3:a:perl:perl:5.12.0:*:*:*:*:*:*:*cpe:2.3:a:perl:perl:5.12.0:rc0:*:*:*:*:*:*cpe:2.3:a:perl:perl:5.12.0:rc1:*:*:*:*:*:*cpe:2.3:a:perl:perl:5.12.0:rc2:*:*:*:*:*:*cpe:2.3:a:perl:perl:5.12.0:rc3:*:*:*:*:*:*cpe:2.3:a:perl:perl:5.12.0:rc4:*:*:*:*:*:*cpe:2.3:a:perl:perl:5.12.0:rc5:*:*:*:*:*:*cpe:2.3:a:perl:perl:5.12.1:*:*:*:*:*:*:*cpe:2.3:a:perl:perl:5.12.1:rc1:*:*:*:*:*:*cpe:2.3:a:perl:perl:5.12.1:rc2:*:*:*:*:*:*cpe:2.3:a:perl:perl:5.12.2:*:*:*:*:*:*:*cpe:2.3:a:perl:perl:5.12.2:rc1:*:*:*:*:*:*cpe:2.3:a:perl:perl:5.12.3:*:*:*:*:*:*:*cpe:2.3:a:perl:perl:5.12.3:rc1:*:*:*:*:*:*cpe:2.3:a:perl:perl:5.12.3:rc2:*:*:*:*:*:*cpe:2.3:a:perl:perl:5.12.3:rc3:*:*:*:*:*:*cpe:2.3:a:perl:perl:5.13.0:*:*:*:*:*:*:*cpe:2.3:a:perl:perl:5.13.1:*:*:*:*:*:*:*cpe:2.3:a:perl:perl:5.13.2:*:*:*:*:*:*:*cpe:2.3:a:perl:perl:5.13.3:*:*:*:*:*:*:*cpe:2.3:a:perl:perl:5.13.4:*:*:*:*:*:*:*cpe:2.3:a:perl:perl:5.13.5:*:*:*:*:*:*:*cpe:2.3:a:perl:perl:5.13.6:*:*:*:*:*:*:*cpe:2.3:a:perl:perl:5.13.7:*:*:*:*:*:*:*cpe:2.3:a:perl:perl:5.13.8:*:*:*:*:*:*:*cpe:2.3:a:perl:perl:5.13.9:*:*:*:*:*:*:*- +11 autres
Produits affectés
| Produit | Versions |
|---|---|
| affected n/a |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |