The (1) lc, (2) lcfirst, (3) uc, and (4) ucfirst functions in Perl 5.10.x, 5.11.x, and 5.12.x through 5.12.3, and 5.13.x through 5.13.11, do not apply the taint attribute to the return value upon processing tainted input, which might allow context-dependent attackers to bypass the taint protection mechanism via a crafted string.
CVSS Details
- CVSS 3.1 Base Score: 8.2
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade perl | Jul 30, 2024 | Apr 11, 2011 |
| Gentoo Linux | — | Upgrade dev-lang/perl. | Oct 30, 2017 | Apr 11, 2011 |
| Oracle_linux | — | Upgrade perl-Pod-SimpleUpgrade perl-Test-HarnessUpgrade perl-CPANUpgrade perl-libsUpgrade perl-Compress-ZlibUpgrade perl-Digest-SHAUpgrade perl-develUpgrade perl-IO-Compress-BaseUpgrade perlUpgrade perl-Term-UIUpgrade perl-Module-BuildUpgrade perl-Test-SimpleUpgrade perl-IO-ZlibUpgrade perl-IPC-CmdUpgrade perl-Module-PluggableUpgrade perl-ExtUtils-ParseXSUpgrade perl-Module-Load-ConditionalUpgrade perl-versionUpgrade perl-Module-LoadedUpgrade perl-Archive-TarUpgrade perl-CPANPLUSUpgrade perl-Module-LoadUpgrade perl-Object-AccessorUpgrade perl-Archive-ExtractUpgrade perl-Compress-Raw-ZlibUpgrade perl-Locale-Maketext-SimpleUpgrade perl-coreUpgrade perl-ExtUtils-EmbedUpgrade perl-CGIUpgrade perl-Log-MessageUpgrade perl-Params-CheckUpgrade perl-Time-PieceUpgrade perl-File-FetchUpgrade perl-Pod-EscapesUpgrade perl-Module-CoreListUpgrade perl-ExtUtils-MakeMakerUpgrade perl-Log-Message-SimpleUpgrade perl-Package-ConstantsUpgrade perl-Parse-CPAN-MetaUpgrade perl-ExtUtils-CBuilderUpgrade perl-suidperlUpgrade perl-Time-HiResUpgrade perl-IO-Compress-ZlibUpgrade perl-parent | Oct 16, 2024 | Apr 11, 2011 |
| Suse | — | Upgrade perl-Test-SimpleUpgrade perl-Module-BuildUpgrade perl-docUpgrade perlUpgrade perl-base-32bitUpgrade perl-x86Upgrade perl-baseUpgrade perl-32bit | Feb 17, 2015 | Jun 28, 2013 |
| Ubuntu | — | Upgrade perl | Nov 8, 2024 | Apr 11, 2011 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub