CVE-2012-6329

HighCVSS 7.5/10Last modified Jun 16, 2026

Description

The _compile function in Maketext.pm in the Locale::Maketext implementation in Perl before 5.17.7 does not properly handle backslashes and fully qualified method names during compilation of bracket notation, which allows context-dependent attackers to execute arbitrary commands via crafted input to an application that accepts translation strings from users, as demonstrated by the TWiki application before 5.1.3, and the Foswiki application 1.0.x through 1.0.10 and 1.1.x through 1.1.6.

Metrics

CVSS 2.0 7.5/10AV:N/AC:L/Au:N/C:P/I:P/A:P

Weakness enumeration

CWE-94

Affected software

No affected versions have been published.

Timeline

Published: Jan 4, 2013
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2012

CVE-2012-63305.0The localization functionality in TWiki before 5.1.3, and Foswiki 1.0.x through 1.0.10 and 1.1.x through 1.1.6, allows remote attackers to c CVE-2012-63334.7Multiple HVM control operations in Xen 3.4 through 4.2 allow local HVM guest OS administrators to cause a denial of service (physical CPU co CVE-2012-63342.9The Track My Mobile feature in the SamsungDive subsystem for Android on Samsung Galaxy devices does not properly implement Location APIs, wh CVE-2012-63353.3The Anti-theft service in AVG AntiVirus for Android allows physically proximate attackers to provide arbitrary location data via a "commonly CVE-2012-63363.3The Missing Device feature in Lookout allows physically proximate attackers to provide arbitrary location data via a "commonly available sim CVE-2012-63373.3The Track My Mobile feature in the SamsungDive subsystem for Android on Samsung Galaxy devices shows the activation of remote tracking, whic CVE-2012-63394.3Multiple cross-site scripting (XSS) vulnerabilities in the administrative web interface in Cerberus FTP Server before 5.0.6.0 allow (1) remo CVE-2012-63404.6An Authentication vulnerability exists in NETGEAR WGR614 v7 and v9 due to a hardcoded credential used for serial programming, a related issu CVE-2012-63416.5An Information Disclosure vulnerability exists in the my config file in NEtGEAR WGR614 v7 and v9, which could let a malicious user recover a CVE-2012-63426.8Cross-site request forgery (CSRF) vulnerability in logout.action in Atlassian Confluence 3.4.6 allows remote attackers to hijack the authent CVE-2012-63446.1Novell ZENworks Configuration Management before 11.2.4 allows XSS.CVE-2012-63457.5Novell ZENworks Configuration Management before 11.2.4 allows obtaining sensitive trace information.