CVE-2012-5578

MediumCVSS 6.2/10Last modified Jun 16, 2026

Description

Python keyring has insecure permissions on new databases allowing world-readable files to be created

Metrics

CVSS 3.1 6.2/10CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-276

Affected software

Vendor	Product	Versions
Python	Python keyring	<= 0.10

References

http://www.openwall.com/lists/oss-security/2012/11/27/4Mailing List, Third Party Advisory
https://access.redhat.com/security/cve/cve-2012-5578Third Party Advisory
https://bugs.launchpad.net/ubuntu/+source/python-keyring/+bug/1031465Issue Tracking, Patch, Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2012-5578Issue Tracking, Third Party Advisory
https://bugzilla.suse.com/show_bug.cgi?id=CVE-2012-5578Issue Tracking, Third Party Advisory
https://security-tracker.debian.org/tracker/CVE-2012-5578Third Party Advisory
http://www.openwall.com/lists/oss-security/2012/11/27/4Mailing List, Third Party Advisory
https://access.redhat.com/security/cve/cve-2012-5578Third Party Advisory
https://bugs.launchpad.net/ubuntu/+source/python-keyring/+bug/1031465Issue Tracking, Patch, Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2012-5578Issue Tracking, Third Party Advisory
https://bugzilla.suse.com/show_bug.cgi?id=CVE-2012-5578Issue Tracking, Third Party Advisory
https://security-tracker.debian.org/tracker/CVE-2012-5578Third Party Advisory

Timeline

Published: Nov 25, 2019
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2012

CVE-2012-55807.5Format string vulnerability in the print_proxies function in bin/proxy.c in libproxy 0.3.1 might allow context-dependent attackers to cause CVE-2012-55816.8Stack-based buffer overflow in tif_dir.c in LibTIFF before 4.0.2 allows remote attackers to cause a denial of service (crash) and possibly e CVE-2012-55829.8opendnssec misuses libcurl API CVE-2012-55835.8phpCAS before 1.3.2 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field CVE-2012-55844.3The Table of Contents module 6.x-3.x before 6.x-3.8 for Drupal does not properly check node permissions, which allows remote attackers to re CVE-2012-55852.1Cross-site scripting (XSS) vulnerability in the Mixpanel module 6.x-1.x before 6.x-1.1 in Drupal allows remote authenticated users with the CVE-2012-55862.1The Services module 6.x-3.x before 6.x-3.3 and 7.x-3.x before 7.x-3.3 for Drupal allows remote authenticated users with the "access user pro CVE-2012-55874.3Cross-site scripting (XSS) vulnerability in the Email Field module 6.x-1.x before 6.x-1.3 for Drupal allows remote attackers to inject arbit CVE-2012-55882.6The Email Field module 6.x-1.x before 6.x-1.3 for Drupal, when using a field permission module and the field contact field formatter is set CVE-2012-55893.5The MultiLink module 6.x-2.x before 6.x-2.7 and 7.x-2.x before 7.x-2.7 for Drupal does not properly check node permissions when generating a CVE-2012-55907.5SQL injection vulnerability in the Webmail Plus module for Drupal allows remote attackers to execute arbitrary SQL commands via unspecified CVE-2012-55914.3Cross-site scripting (XSS) vulnerability in the Zero Point module 6.x-1.x before 6.x-1.18 and 7.x-1.x before 7.x-1.4 for Drupal allows remot