CVE-2012-6329

NameCVE-2012-6329
DescriptionThe _compile function in Maketext.pm in the Locale::Maketext implementation in Perl before 5.17.7 does not properly handle backslashes and fully qualified method names during compilation of bracket notation, which allows context-dependent attackers to execute arbitrary commands via crafted input to an application that accepts translation strings from users, as demonstrated by the TWiki application before 5.1.3, and the Foswiki application 1.0.x through 1.0.10 and 1.1.x through 1.1.6.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
NVD severityhigh (attack range: remote)
Debian Bugs509864, 695224

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
perl (PTS)jessie5.20.2-3+deb8u11fixed
jessie (security)5.20.2-3+deb8u12fixed
stretch5.24.1-3+deb9u4fixed
stretch (security)5.24.1-3+deb9u5fixed
buster5.28.1-1fixed
sid5.28.1-3fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
foswikiITP509864
perlsource(unstable)5.14.2-16high695224
perlsourcesqueeze5.10.1-17squeeze5high

Search for package or bug name: Reporting problems