The _compile function in Maketext.pm in the Locale::Maketext implementation in Perl before 5.17.7 does not properly handle backslashes and fully qualified method names during compilation of bracket notation, which allows context-dependent attackers to execute arbitrary commands via crafted input to an application that accepts translation strings from users, as demonstrated by the TWiki application before 5.1.3, and the Foswiki application 1.0.x through 1.0.10 and 1.1.x through 1.1.6.
CVSS Details
- CVSS 3.1 Base Score: 9.8
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade perl-Archive-ExtractUpgrade perl-Object-AccessorUpgrade perl-Term-UIUpgrade perl-parentUpgrade perl-IO-Compress-ZlibUpgrade perl-ExtUtils-CBuilderUpgrade perl-ExtUtils-MakeMakerUpgrade perl-CGIUpgrade perl-Log-Message-SimpleUpgrade perl-Log-MessageUpgrade perl-Digest-SHAUpgrade perl-CPANPLUSUpgrade perl-Locale-Maketext-SimpleUpgrade perl-Package-ConstantsUpgrade perl-IO-Compress-Bzip2Upgrade perl-Time-HiResUpgrade perl-Module-PluggableUpgrade perl-Module-CoreListUpgrade perl-Params-CheckUpgrade perl-Time-PieceUpgrade perl-coreUpgrade perl-Pod-EscapesUpgrade perl-Archive-TarUpgrade perl-Compress-Raw-ZlibUpgrade perl-ExtUtils-EmbedUpgrade perl-Compress-Raw-Bzip2Upgrade perl-Module-LoadUpgrade perl-IPC-CmdUpgrade perl-develUpgrade perl-ExtUtils-ParseXSUpgrade perl-Module-BuildUpgrade perl-File-FetchUpgrade perl-Test-SimpleUpgrade perl-Test-HarnessUpgrade perl-Module-Load-ConditionalUpgrade perl-Compress-ZlibUpgrade perl-libsUpgrade perlUpgrade perl-Pod-SimpleUpgrade perl-IO-ZlibUpgrade perl-CPANUpgrade perl-Module-LoadedUpgrade perl-versionUpgrade perl-Parse-CPAN-MetaUpgrade perl-suidperlUpgrade perl-IO-Compress-Base | Dec 1, 2016 | Jan 4, 2013 |
| Debian | — | Upgrade perl | Jul 30, 2024 | Jan 4, 2013 |
| F5 Big Ip | — | Update F5 BIG-IP to the latest version | Jun 17, 2026 | Sep 15, 2015 |
| Gentoo Linux | — | Upgrade dev-lang/perl.Upgrade perl-core/Locale-Maketext. | Oct 30, 2017 | Jan 4, 2013 |
| Ibm Aix | — | Apply the fix or workaround for perl_advisory4 | Nov 30, 2017 | Jan 4, 2013 |
| Oracle Solaris | — | Upgrade runtime/perl-584/extra to version 5.8.4-0.175.1.7.0.5.2 on Solaris 11.1Upgrade runtime/perl-512 to version 5.12.5-0.175.1.7.0.2.0 on Solaris 11.1Upgrade runtime/perl-584 to version 5.8.4-0.175.1.7.0.5.2 on Solaris 11.1Upgrade consolidation/osnet/osnet-incorporation to version 0.5.11-0.175.2.0.0.42.2 on Solaris 11.2 | May 29, 2017 | Jan 4, 2013 |
| Oracle_linux | — | Upgrade perl-Package-ConstantsUpgrade perl-Time-PieceUpgrade perl-coreUpgrade perl-ExtUtils-EmbedUpgrade perl-ExtUtils-MakeMakerUpgrade perl-Compress-Raw-ZlibUpgrade perl-Module-BuildUpgrade perl-Params-CheckUpgrade perl-parentUpgrade perl-ExtUtils-ParseXSUpgrade perl-develUpgrade perlUpgrade perl-Test-SimpleUpgrade perl-Log-MessageUpgrade perl-suidperlUpgrade perl-Object-AccessorUpgrade perl-CGIUpgrade perl-Digest-SHAUpgrade perl-Test-HarnessUpgrade perl-Module-LoadUpgrade perl-Locale-Maketext-SimpleUpgrade perl-Module-PluggableUpgrade perl-IO-Compress-Bzip2Upgrade perl-libsUpgrade perl-Time-HiResUpgrade perl-IO-ZlibUpgrade perl-ExtUtils-CBuilderUpgrade perl-File-FetchUpgrade perl-Module-Load-ConditionalUpgrade perl-Archive-TarUpgrade perl-Parse-CPAN-MetaUpgrade perl-versionUpgrade perl-IO-Compress-BaseUpgrade perl-Pod-EscapesUpgrade perl-Compress-Raw-Bzip2Upgrade perl-Term-UIUpgrade perl-Archive-ExtractUpgrade perl-IPC-CmdUpgrade perl-Module-LoadedUpgrade perl-Compress-ZlibUpgrade perl-CPANUpgrade perl-Log-Message-SimpleUpgrade perl-IO-Compress-ZlibUpgrade perl-Module-CoreListUpgrade perl-Pod-SimpleUpgrade perl-CPANPLUS | Oct 16, 2024 | Jan 4, 2013 |
| Suse | — | Upgrade perl-Module-BuildUpgrade perl-baseUpgrade perl-32bitUpgrade perl-base-32bitUpgrade perl-Test-SimpleUpgrade perl-docUpgrade perl-x86Upgrade perl | Feb 17, 2015 | Jul 9, 2013 |
| Ubuntu | — | Upgrade perl-modules | Nov 8, 2024 | Jan 4, 2013 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub