CVE

Id
49399  
CVE No.
CVE-2011-1487  
Status
Candidate  
Description
The (1) lc, (2) lcfirst, (3) uc, and (4) ucfirst functions in Perl 5.10.x, 5.11.x, and 5.12.x through 5.12.3, and 5.13.x through 5.13.11, do not apply the taint attribute to the return value upon processing tainted input, which might allow context-dependent attackers to bypass the taint protection mechanism via a crafted string.  
Phase
Assigned (20110321)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
536218 49399 CVE-2011-1487 MLIST:[oss-security] 20110401 CVE Request -- perl -- lc(), uc() routines are laundering tainted data  View
536219 49399 CVE-2011-1487 URL:http://openwall.com/lists/oss-security/2011/04/01/3  View
536220 49399 CVE-2011-1487 MLIST:[oss-security] 20110404 Re: CVE Request -- perl -- lc(), uc() routines are laundering tainted data  View
536221 49399 CVE-2011-1487 URL:http://openwall.com/lists/oss-security/2011/04/04/35  View
536222 49399 CVE-2011-1487 CONFIRM:http://perl5.git.perl.org/perl.git/commit/539689e74a3bcb04d29e4cd9396de91a81045b99  View
536223 49399 CVE-2011-1487 CONFIRM:http://rt.perl.org/rt3/Public/Bug/Display.html?id=87336  View
536224 49399 CVE-2011-1487 CONFIRM:https://bugzilla.redhat.com/show_bug.cgi?id=692844  View
536225 49399 CVE-2011-1487 CONFIRM:https://bugzilla.redhat.com/show_bug.cgi?id=692898  View
536226 49399 CVE-2011-1487 DEBIAN:DSA-2265  View
536227 49399 CVE-2011-1487 URL:http://www.debian.org/security/2011/dsa-2265  View
536228 49399 CVE-2011-1487 FEDORA:FEDORA-2011-4610  View
536229 49399 CVE-2011-1487 URL:http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057891.html  View
536230 49399 CVE-2011-1487 FEDORA:FEDORA-2011-4631  View
536231 49399 CVE-2011-1487 URL:http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057971.html  View
536232 49399 CVE-2011-1487 MANDRIVA:MDVSA-2011:091  View
536233 49399 CVE-2011-1487 URL:http://www.mandriva.com/security/advisories?name=MDVSA-2011:091  View
536234 49399 CVE-2011-1487 SUSE:SUSE-SR:2011:009  View
536235 49399 CVE-2011-1487 URL:http://lists.opensuse.org/opensuse-security-announce/2011-05/msg00005.html  View
536236 49399 CVE-2011-1487 BID:47124  View
536237 49399 CVE-2011-1487 URL:http://www.securityfocus.com/bid/47124  View
536238 49399 CVE-2011-1487 SECUNIA:43921  View
536239 49399 CVE-2011-1487 URL:http://secunia.com/advisories/43921  View
536240 49399 CVE-2011-1487 SECUNIA:44168  View
536241 49399 CVE-2011-1487 URL:http://secunia.com/advisories/44168  View
536242 49399 CVE-2011-1487 XF:perl-laundering-security-bypass(66528)  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
34162 JVNDB-2011-004404 Roundcube Webmail の steps/utils/modcss.inc における重要な情報を取得される脆弱性 Roundcube Webmail の steps/utils/modcss.inc には、サーバから任意の TCP 接続を発信され、重要な情報を取得される脆弱性が存在します。 CVE-2011-1492 49399 5.5 http://jvndb.jvn.jp/ja/contents/2011/JVNDB-2011-004404.html  View