CVE-2012-6123

MediumCVSS 6.5/10Last modified Jun 16, 2026

Description

Chicken before 4.8.0 does not properly handle NUL bytes in certain strings, which allows an attacker to conduct "poisoned NUL byte attack."

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
chicken	chicken	before 4.8.0

References

http://www.openwall.com/lists/oss-security/2013/02/08/2Mailing List, Third Party Advisory
https://access.redhat.com/security/cve/cve-2012-6123Broken Link
https://security-tracker.debian.org/tracker/CVE-2012-6123Third Party Advisory
http://www.openwall.com/lists/oss-security/2013/02/08/2Mailing List, Third Party Advisory
https://access.redhat.com/security/cve/cve-2012-6123Broken Link
https://security-tracker.debian.org/tracker/CVE-2012-6123Third Party Advisory

Timeline

Published: Oct 31, 2019
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2012

CVE-2012-61245.3A casting error in Chicken before 4.8.0 on 64-bit platform caused the random number generator to return a constant value. NOTE: the vendor s CVE-2012-61259.8Chicken before 4.8.0 is susceptible to algorithmic complexity attacks related to hash table collisions.CVE-2012-61285.0Multiple stack-based buffer overflows in http.c in OpenConnect before 4.08 allow remote VPN gateways to cause a denial of service (applicati CVE-2012-61297.5Stack-based buffer overflow in utp.cpp in libutp, as used in Transmission before 2.74 and possibly other products, allows remote attackers t CVE-2012-61304.3Cross-site scripting (XSS) vulnerability in the history display in Roundup before 1.4.20 allows remote attackers to inject arbitrary web scr CVE-2012-61314.3Cross-site scripting (XSS) vulnerability in cgi/client.py in Roundup before 1.4.20 allows remote attackers to inject arbitrary web script or CVE-2012-61324.3Cross-site scripting (XSS) vulnerability in Roundup before 1.4.20 allows remote attackers to inject arbitrary web script or HTML via the otk CVE-2012-61336.1Multiple cross-site scripting (XSS) vulnerabilities in Roundup before 1.4.20 allow remote attackers to inject arbitrary web script or HTML v CVE-2012-61346.8Cross-site request forgery (CSRF) vulnerability in the omniauth-oauth2 gem 1.1.1 and earlier for Ruby allows remote attackers to hijack the CVE-2012-61357.5RubyGems passenger 4.0.0 betas 1 and 2 allows remote attackers to delete arbitrary files during the startup process.CVE-2012-61365.5tuned 2.10.0 creates its PID file with insecure permissions which allows local users to kill arbitrary processes.CVE-2012-61374.3rhn-migrate-classic-to-rhsm tool in Red Hat subscription-manager does not verify the Red Hat Network Classic server's X.509 certificate when