Vulnerability-Lookup

CVE-2012-2451 (GCVE-0-2012-2451)

Vulnerability from cvelistv5 – Published: 2012-06-27 21:00 – Updated: 2024-08-06 19:34

Summary

The Config::IniFiles module before 2.71 for Perl creates temporary files with predictable names, which allows local users to overwrite arbitrary files via a symlink attack. NOTE: some of these details are obtained from third party information. NOTE: it has been reported that this might only be exploitable by writing in the same directory as the .ini file. If this is the case, then this issue might not cross privilege boundaries.

Severity

No CVSS data available.

CWE

Assigner

mitre

References

11 references

URL	Tags
https://bugzilla.redhat.com/show_bug.cgi?id=818386	x_refsource_MISC
https://bitbucket.org/shlomif/perl-config-inifile…	x_refsource_CONFIRM
https://exchange.xforce.ibmcloud.com/vulnerabilit…	vdb-entryx_refsource_XF
http://lists.fedoraproject.org/pipermail/package-…	vendor-advisoryx_refsource_FEDORA
http://lists.fedoraproject.org/pipermail/package-…	vendor-advisoryx_refsource_FEDORA
http://secunia.com/advisories/48990	third-party-advisoryx_refsource_SECUNIA
http://www.ubuntu.com/usn/USN-1543-1	vendor-advisoryx_refsource_UBUNTU
http://www.osvdb.org/81671	vdb-entryx_refsource_OSVDB
http://www.openwall.com/lists/oss-security/2012/05/02/6	mailing-listx_refsource_MLIST
http://www.securityfocus.com/bid/53361	vdb-entryx_refsource_BID
http://lists.fedoraproject.org/pipermail/package-…	vendor-advisoryx_refsource_FEDORA

Date Public

2012-05-02 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T19:34:25.715Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=818386"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bitbucket.org/shlomif/perl-config-inifiles/changeset/a08fa26f4f59"
          },
          {
            "name": "config-inifiles-symlink(75328)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/75328"
          },
          {
            "name": "FEDORA-2012-7802",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080713.html"
          },
          {
            "name": "FEDORA-2012-7763",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-May/081207.html"
          },
          {
            "name": "48990",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/48990"
          },
          {
            "name": "USN-1543-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "http://www.ubuntu.com/usn/USN-1543-1"
          },
          {
            "name": "81671",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://www.osvdb.org/81671"
          },
          {
            "name": "[oss-security] 20120502 temporary file issue in Config::IniFiles Config-IniFiles perl-Config-IniFiles",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2012/05/02/6"
          },
          {
            "name": "53361",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/53361"
          },
          {
            "name": "FEDORA-2012-7777",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080716.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2012-05-02T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "The Config::IniFiles module before 2.71 for Perl creates temporary files with predictable names, which allows local users to overwrite arbitrary files via a symlink attack.  NOTE: some of these details are obtained from third party information.  NOTE: it has been reported that this might only be exploitable by writing in the same directory as the .ini file. If this is the case, then this issue might not cross privilege boundaries."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-08-28T12:57:01.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=818386"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bitbucket.org/shlomif/perl-config-inifiles/changeset/a08fa26f4f59"
        },
        {
          "name": "config-inifiles-symlink(75328)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/75328"
        },
        {
          "name": "FEDORA-2012-7802",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080713.html"
        },
        {
          "name": "FEDORA-2012-7763",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-May/081207.html"
        },
        {
          "name": "48990",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/48990"
        },
        {
          "name": "USN-1543-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "http://www.ubuntu.com/usn/USN-1543-1"
        },
        {
          "name": "81671",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://www.osvdb.org/81671"
        },
        {
          "name": "[oss-security] 20120502 temporary file issue in Config::IniFiles Config-IniFiles perl-Config-IniFiles",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2012/05/02/6"
        },
        {
          "name": "53361",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/53361"
        },
        {
          "name": "FEDORA-2012-7777",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080716.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2012-2451",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The Config::IniFiles module before 2.71 for Perl creates temporary files with predictable names, which allows local users to overwrite arbitrary files via a symlink attack.  NOTE: some of these details are obtained from third party information.  NOTE: it has been reported that this might only be exploitable by writing in the same directory as the .ini file. If this is the case, then this issue might not cross privilege boundaries."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://bugzilla.redhat.com/show_bug.cgi?id=818386",
              "refsource": "MISC",
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=818386"
            },
            {
              "name": "https://bitbucket.org/shlomif/perl-config-inifiles/changeset/a08fa26f4f59",
              "refsource": "CONFIRM",
              "url": "https://bitbucket.org/shlomif/perl-config-inifiles/changeset/a08fa26f4f59"
            },
            {
              "name": "config-inifiles-symlink(75328)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/75328"
            },
            {
              "name": "FEDORA-2012-7802",
              "refsource": "FEDORA",
              "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080713.html"
            },
            {
              "name": "FEDORA-2012-7763",
              "refsource": "FEDORA",
              "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-May/081207.html"
            },
            {
              "name": "48990",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/48990"
            },
            {
              "name": "USN-1543-1",
              "refsource": "UBUNTU",
              "url": "http://www.ubuntu.com/usn/USN-1543-1"
            },
            {
              "name": "81671",
              "refsource": "OSVDB",
              "url": "http://www.osvdb.org/81671"
            },
            {
              "name": "[oss-security] 20120502 temporary file issue in Config::IniFiles Config-IniFiles perl-Config-IniFiles",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2012/05/02/6"
            },
            {
              "name": "53361",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/53361"
            },
            {
              "name": "FEDORA-2012-7777",
              "refsource": "FEDORA",
              "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080716.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2012-2451",
    "datePublished": "2012-06-27T21:00:00.000Z",
    "dateReserved": "2012-05-02T00:00:00.000Z",
    "dateUpdated": "2024-08-06T19:34:25.715Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2012-2451",
      "date": "2026-08-01",
      "epss": "0.00504",
      "percentile": "0.40309"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:shlomi_fish:config-inifiles:*:*:*:*:*:*:*:*\", \"versionEndIncluding\": \"2.70\", \"matchCriteriaId\": \"1DB8AB2E-7986-470B-A510-0B340F5540BA\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"The Config::IniFiles module before 2.71 for Perl creates temporary files with predictable names, which allows local users to overwrite arbitrary files via a symlink attack.  NOTE: some of these details are obtained from third party information.  NOTE: it has been reported that this might only be exploitable by writing in the same directory as the .ini file. If this is the case, then this issue might not cross privilege boundaries.\"}, {\"lang\": \"es\", \"value\": \"El m\\u00f3dulo Config::IniFiles antes de v2.71 para Perl crea archivos temporales con nombres predecibles, lo que permite a usuarios locales sobreescribir ficheros de su elecci\\u00f3n mediante un ataque de enlace simb\\u00f3lico. NOTA: algunos de estos detalles han sido obtenidos de informaci\\u00f3n de terceros. NOTA: se ha informado de que esto s\\u00f3lo podr\\u00eda ser objeto de explotaci\\u00f3n escribiendo en el mismo directorio que el archivo .INI. Si este es el caso, entonces este problema no puede cruzar los l\\u00edmites de privilegios.\"}]",
      "id": "CVE-2012-2451",
      "lastModified": "2024-11-21T01:39:07.727",
      "metrics": "{\"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:L/AC:L/Au:N/C:N/I:P/A:P\", \"baseScore\": 3.6, \"accessVector\": \"LOCAL\", \"accessComplexity\": \"LOW\", \"authentication\": \"NONE\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"PARTIAL\", \"availabilityImpact\": \"PARTIAL\"}, \"baseSeverity\": \"LOW\", \"exploitabilityScore\": 3.9, \"impactScore\": 4.9, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": false, \"userInteractionRequired\": false}]}",
      "published": "2012-06-27T21:55:03.097",
      "references": "[{\"url\": \"http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080713.html\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080716.html\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://lists.fedoraproject.org/pipermail/package-announce/2012-May/081207.html\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://secunia.com/advisories/48990\", \"source\": \"cve@mitre.org\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"http://www.openwall.com/lists/oss-security/2012/05/02/6\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://www.osvdb.org/81671\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://www.securityfocus.com/bid/53361\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://www.ubuntu.com/usn/USN-1543-1\", \"source\": \"cve@mitre.org\"}, {\"url\": \"https://bitbucket.org/shlomif/perl-config-inifiles/changeset/a08fa26f4f59\", \"source\": \"cve@mitre.org\", \"tags\": [\"Exploit\", \"Patch\"]}, {\"url\": \"https://bugzilla.redhat.com/show_bug.cgi?id=818386\", \"source\": \"cve@mitre.org\"}, {\"url\": \"https://exchange.xforce.ibmcloud.com/vulnerabilities/75328\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080713.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080716.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://lists.fedoraproject.org/pipermail/package-announce/2012-May/081207.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://secunia.com/advisories/48990\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"http://www.openwall.com/lists/oss-security/2012/05/02/6\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://www.osvdb.org/81671\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://www.securityfocus.com/bid/53361\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://www.ubuntu.com/usn/USN-1543-1\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://bitbucket.org/shlomif/perl-config-inifiles/changeset/a08fa26f4f59\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Exploit\", \"Patch\"]}, {\"url\": \"https://bugzilla.redhat.com/show_bug.cgi?id=818386\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://exchange.xforce.ibmcloud.com/vulnerabilities/75328\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "cve@mitre.org",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"NVD-CWE-Other\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2012-2451\",\"sourceIdentifier\":\"cve@mitre.org\",\"published\":\"2012-06-27T21:55:03.097\",\"lastModified\":\"2026-04-29T01:13:23.040\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"The Config::IniFiles module before 2.71 for Perl creates temporary files with predictable names, which allows local users to overwrite arbitrary files via a symlink attack.  NOTE: some of these details are obtained from third party information.  NOTE: it has been reported that this might only be exploitable by writing in the same directory as the .ini file. If this is the case, then this issue might not cross privilege boundaries.\"},{\"lang\":\"es\",\"value\":\"El m\u00f3dulo Config::IniFiles antes de v2.71 para Perl crea archivos temporales con nombres predecibles, lo que permite a usuarios locales sobreescribir ficheros de su elecci\u00f3n mediante un ataque de enlace simb\u00f3lico. NOTA: algunos de estos detalles han sido obtenidos de informaci\u00f3n de terceros. NOTA: se ha informado de que esto s\u00f3lo podr\u00eda ser objeto de explotaci\u00f3n escribiendo en el mismo directorio que el archivo .INI. Si este es el caso, entonces este problema no puede cruzar los l\u00edmites de privilegios.\"}],\"metrics\":{\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:L/AC:L/Au:N/C:N/I:P/A:P\",\"baseScore\":3.6,\"accessVector\":\"LOCAL\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"PARTIAL\"},\"baseSeverity\":\"LOW\",\"exploitabilityScore\":3.9,\"impactScore\":4.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-Other\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:shlomi_fish:config-inifiles:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"2.70\",\"matchCriteriaId\":\"1DB8AB2E-7986-470B-A510-0B340F5540BA\"}]}]}],\"references\":[{\"url\":\"http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080713.html\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080716.html\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://lists.fedoraproject.org/pipermail/package-announce/2012-May/081207.html\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://secunia.com/advisories/48990\",\"source\":\"cve@mitre.org\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://www.openwall.com/lists/oss-security/2012/05/02/6\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.osvdb.org/81671\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.securityfocus.com/bid/53361\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.ubuntu.com/usn/USN-1543-1\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://bitbucket.org/shlomif/perl-config-inifiles/changeset/a08fa26f4f59\",\"source\":\"cve@mitre.org\",\"tags\":[\"Exploit\",\"Patch\"]},{\"url\":\"https://bugzilla.redhat.com/show_bug.cgi?id=818386\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://exchange.xforce.ibmcloud.com/vulnerabilities/75328\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080713.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080716.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://lists.fedoraproject.org/pipermail/package-announce/2012-May/081207.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://secunia.com/advisories/48990\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://www.openwall.com/lists/oss-security/2012/05/02/6\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.osvdb.org/81671\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.securityfocus.com/bid/53361\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.ubuntu.com/usn/USN-1543-1\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://bitbucket.org/shlomif/perl-config-inifiles/changeset/a08fa26f4f59\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"Patch\"]},{\"url\":\"https://bugzilla.redhat.com/show_bug.cgi?id=818386\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://exchange.xforce.ibmcloud.com/vulnerabilities/75328\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "redhat_vex": {
      "current_release_date": "2026-01-28T23:00:00+00:00",
      "cve": "CVE-2012-2451",
      "id": "CVE-2012-2451",
      "initial_release_date": "2012-05-02T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "perl-Config-IniFiles: insecure temporary file usage",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2012/cve-2012-2451.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "low",
      "current_release_date": "2026-07-26T01:47:24Z",
      "cve": "CVE-2012-2451",
      "id": "CVE-2012-2451",
      "initial_release_date": "2023-02-15T05:46:58Z",
      "product_status:recommended": "77",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2012-2451",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2012-2451.json",
      "version": "10"
    }
  }
}

FKIE_CVE-2012-2451

Vulnerability from fkie_nvd - Published: 2012-06-27 21:55 - Updated: 2026-06-16 23:41

Severity

Summary

References

URL	Tags
cve@mitre.org	http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080713.html
cve@mitre.org	http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080716.html
cve@mitre.org	http://lists.fedoraproject.org/pipermail/package-announce/2012-May/081207.html
cve@mitre.org	http://secunia.com/advisories/48990	Vendor Advisory
cve@mitre.org	http://www.openwall.com/lists/oss-security/2012/05/02/6
cve@mitre.org	http://www.osvdb.org/81671
cve@mitre.org	http://www.securityfocus.com/bid/53361
cve@mitre.org	http://www.ubuntu.com/usn/USN-1543-1
cve@mitre.org	https://bitbucket.org/shlomif/perl-config-inifiles/changeset/a08fa26f4f59	Exploit, Patch
cve@mitre.org	https://bugzilla.redhat.com/show_bug.cgi?id=818386
cve@mitre.org	https://exchange.xforce.ibmcloud.com/vulnerabilities/75328
af854a3a-2127-422b-91ae-364da2661108	http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080713.html
af854a3a-2127-422b-91ae-364da2661108	http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080716.html
af854a3a-2127-422b-91ae-364da2661108	http://lists.fedoraproject.org/pipermail/package-announce/2012-May/081207.html
af854a3a-2127-422b-91ae-364da2661108	http://secunia.com/advisories/48990	Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	http://www.openwall.com/lists/oss-security/2012/05/02/6
af854a3a-2127-422b-91ae-364da2661108	http://www.osvdb.org/81671
af854a3a-2127-422b-91ae-364da2661108	http://www.securityfocus.com/bid/53361
af854a3a-2127-422b-91ae-364da2661108	http://www.ubuntu.com/usn/USN-1543-1
af854a3a-2127-422b-91ae-364da2661108	https://bitbucket.org/shlomif/perl-config-inifiles/changeset/a08fa26f4f59	Exploit, Patch
af854a3a-2127-422b-91ae-364da2661108	https://bugzilla.redhat.com/show_bug.cgi?id=818386
af854a3a-2127-422b-91ae-364da2661108	https://exchange.xforce.ibmcloud.com/vulnerabilities/75328

Impacted products

	Vendor	Product	Version
	shlomi_fish	config-inifiles	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "source": "cve@mitre.org"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:shlomi_fish:config-inifiles:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "1DB8AB2E-7986-470B-A510-0B340F5540BA",
              "versionEndIncluding": "2.70",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Config::IniFiles module before 2.71 for Perl creates temporary files with predictable names, which allows local users to overwrite arbitrary files via a symlink attack.  NOTE: some of these details are obtained from third party information.  NOTE: it has been reported that this might only be exploitable by writing in the same directory as the .ini file. If this is the case, then this issue might not cross privilege boundaries."
    },
    {
      "lang": "es",
      "value": "El m\u00f3dulo Config::IniFiles antes de v2.71 para Perl crea archivos temporales con nombres predecibles, lo que permite a usuarios locales sobreescribir ficheros de su elecci\u00f3n mediante un ataque de enlace simb\u00f3lico. NOTA: algunos de estos detalles han sido obtenidos de informaci\u00f3n de terceros. NOTA: se ha informado de que esto s\u00f3lo podr\u00eda ser objeto de explotaci\u00f3n escribiendo en el mismo directorio que el archivo .INI. Si este es el caso, entonces este problema no puede cruzar los l\u00edmites de privilegios."
    }
  ],
  "id": "CVE-2012-2451",
  "lastModified": "2026-06-16T23:41:35.050",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "LOW",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "LOCAL",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 3.6,
          "confidentialityImpact": "NONE",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:L/AC:L/Au:N/C:N/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 4.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2012-06-27T21:55:03.097",
  "references": [
    {
      "source": "cve@mitre.org",
      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080713.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080716.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-May/081207.html"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/48990"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.openwall.com/lists/oss-security/2012/05/02/6"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.osvdb.org/81671"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/bid/53361"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.ubuntu.com/usn/USN-1543-1"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit",
        "Patch"
      ],
      "url": "https://bitbucket.org/shlomif/perl-config-inifiles/changeset/a08fa26f4f59"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=818386"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/75328"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080713.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080716.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-May/081207.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/48990"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.openwall.com/lists/oss-security/2012/05/02/6"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.osvdb.org/81671"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/bid/53361"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.ubuntu.com/usn/USN-1543-1"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Patch"
      ],
      "url": "https://bitbucket.org/shlomif/perl-config-inifiles/changeset/a08fa26f4f59"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=818386"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/75328"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

GHSA-G533-VRRR-6J8R

Vulnerability from github – Published: 2022-05-17 01:46 – Updated: 2022-05-17 01:46

Details

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2012-2451"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2012-06-27T21:55:00Z",
    "severity": "LOW"
  },
  "details": "The Config::IniFiles module before 2.71 for Perl creates temporary files with predictable names, which allows local users to overwrite arbitrary files via a symlink attack.  NOTE: some of these details are obtained from third party information.  NOTE: it has been reported that this might only be exploitable by writing in the same directory as the .ini file. If this is the case, then this issue might not cross privilege boundaries.",
  "id": "GHSA-g533-vrrr-6j8r",
  "modified": "2022-05-17T01:46:04Z",
  "published": "2022-05-17T01:46:04Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-2451"
    },
    {
      "type": "WEB",
      "url": "https://bitbucket.org/shlomif/perl-config-inifiles/changeset/a08fa26f4f59"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=818386"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/75328"
    },
    {
      "type": "WEB",
      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080713.html"
    },
    {
      "type": "WEB",
      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080716.html"
    },
    {
      "type": "WEB",
      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-May/081207.html"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/48990"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2012/05/02/6"
    },
    {
      "type": "WEB",
      "url": "http://www.osvdb.org/81671"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/53361"
    },
    {
      "type": "WEB",
      "url": "http://www.ubuntu.com/usn/USN-1543-1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

GSD-2012-2451

Vulnerability from gsd - Updated: 2023-12-13 01:20

Details

Aliases

CVE-2012-2451

Aliases

CVE-2012-2451

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2012-2451",
    "description": "The Config::IniFiles module before 2.71 for Perl creates temporary files with predictable names, which allows local users to overwrite arbitrary files via a symlink attack.  NOTE: some of these details are obtained from third party information.  NOTE: it has been reported that this might only be exploitable by writing in the same directory as the .ini file. If this is the case, then this issue might not cross privilege boundaries.",
    "id": "GSD-2012-2451",
    "references": [
      "https://www.suse.com/security/cve/CVE-2012-2451.html"
    ]
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2012-2451"
      ],
      "details": "The Config::IniFiles module before 2.71 for Perl creates temporary files with predictable names, which allows local users to overwrite arbitrary files via a symlink attack.  NOTE: some of these details are obtained from third party information.  NOTE: it has been reported that this might only be exploitable by writing in the same directory as the .ini file. If this is the case, then this issue might not cross privilege boundaries.",
      "id": "GSD-2012-2451",
      "modified": "2023-12-13T01:20:16.608242Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "cve@mitre.org",
        "ID": "CVE-2012-2451",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "n/a",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "n/a"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "n/a"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "The Config::IniFiles module before 2.71 for Perl creates temporary files with predictable names, which allows local users to overwrite arbitrary files via a symlink attack.  NOTE: some of these details are obtained from third party information.  NOTE: it has been reported that this might only be exploitable by writing in the same directory as the .ini file. If this is the case, then this issue might not cross privilege boundaries."
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "n/a"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://bugzilla.redhat.com/show_bug.cgi?id=818386",
            "refsource": "MISC",
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=818386"
          },
          {
            "name": "https://bitbucket.org/shlomif/perl-config-inifiles/changeset/a08fa26f4f59",
            "refsource": "CONFIRM",
            "url": "https://bitbucket.org/shlomif/perl-config-inifiles/changeset/a08fa26f4f59"
          },
          {
            "name": "config-inifiles-symlink(75328)",
            "refsource": "XF",
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/75328"
          },
          {
            "name": "FEDORA-2012-7802",
            "refsource": "FEDORA",
            "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080713.html"
          },
          {
            "name": "FEDORA-2012-7763",
            "refsource": "FEDORA",
            "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-May/081207.html"
          },
          {
            "name": "48990",
            "refsource": "SECUNIA",
            "url": "http://secunia.com/advisories/48990"
          },
          {
            "name": "USN-1543-1",
            "refsource": "UBUNTU",
            "url": "http://www.ubuntu.com/usn/USN-1543-1"
          },
          {
            "name": "81671",
            "refsource": "OSVDB",
            "url": "http://www.osvdb.org/81671"
          },
          {
            "name": "[oss-security] 20120502 temporary file issue in Config::IniFiles Config-IniFiles perl-Config-IniFiles",
            "refsource": "MLIST",
            "url": "http://www.openwall.com/lists/oss-security/2012/05/02/6"
          },
          {
            "name": "53361",
            "refsource": "BID",
            "url": "http://www.securityfocus.com/bid/53361"
          },
          {
            "name": "FEDORA-2012-7777",
            "refsource": "FEDORA",
            "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080716.html"
          }
        ]
      }
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:shlomi_fish:config-inifiles:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndIncluding": "2.70",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2012-2451"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "The Config::IniFiles module before 2.71 for Perl creates temporary files with predictable names, which allows local users to overwrite arbitrary files via a symlink attack.  NOTE: some of these details are obtained from third party information.  NOTE: it has been reported that this might only be exploitable by writing in the same directory as the .ini file. If this is the case, then this issue might not cross privilege boundaries."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "NVD-CWE-Other"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "[oss-security] 20120502 temporary file issue in Config::IniFiles Config-IniFiles perl-Config-IniFiles",
              "refsource": "MLIST",
              "tags": [],
              "url": "http://www.openwall.com/lists/oss-security/2012/05/02/6"
            },
            {
              "name": "81671",
              "refsource": "OSVDB",
              "tags": [],
              "url": "http://www.osvdb.org/81671"
            },
            {
              "name": "48990",
              "refsource": "SECUNIA",
              "tags": [
                "Vendor Advisory"
              ],
              "url": "http://secunia.com/advisories/48990"
            },
            {
              "name": "https://bitbucket.org/shlomif/perl-config-inifiles/changeset/a08fa26f4f59",
              "refsource": "CONFIRM",
              "tags": [
                "Exploit",
                "Patch"
              ],
              "url": "https://bitbucket.org/shlomif/perl-config-inifiles/changeset/a08fa26f4f59"
            },
            {
              "name": "https://bugzilla.redhat.com/show_bug.cgi?id=818386",
              "refsource": "MISC",
              "tags": [],
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=818386"
            },
            {
              "name": "FEDORA-2012-7802",
              "refsource": "FEDORA",
              "tags": [],
              "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080713.html"
            },
            {
              "name": "FEDORA-2012-7777",
              "refsource": "FEDORA",
              "tags": [],
              "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080716.html"
            },
            {
              "name": "FEDORA-2012-7763",
              "refsource": "FEDORA",
              "tags": [],
              "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-May/081207.html"
            },
            {
              "name": "53361",
              "refsource": "BID",
              "tags": [],
              "url": "http://www.securityfocus.com/bid/53361"
            },
            {
              "name": "USN-1543-1",
              "refsource": "UBUNTU",
              "tags": [],
              "url": "http://www.ubuntu.com/usn/USN-1543-1"
            },
            {
              "name": "config-inifiles-symlink(75328)",
              "refsource": "XF",
              "tags": [],
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/75328"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV2": {
          "cvssV2": {
            "accessComplexity": "LOW",
            "accessVector": "LOCAL",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 3.6,
            "confidentialityImpact": "NONE",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:L/AC:L/Au:N/C:N/I:P/A:P",
            "version": "2.0"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 4.9,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "severity": "LOW",
          "userInteractionRequired": false
        }
      },
      "lastModifiedDate": "2017-08-29T01:31Z",
      "publishedDate": "2012-06-27T21:55Z"
    }
  }
}

OPENSUSE-SU-2024:10146-1

Vulnerability from csaf_opensuse - Published: 2024-06-15 00:00 - Updated: 2024-06-15 00:00

Summary

perl-Config-IniFiles-2.94-1.1 on GA media

Severity

Moderate

Notes

Title of the patch: perl-Config-IniFiles-2.94-1.1 on GA media

Description of the patch: These are all security issues fixed in the perl-Config-IniFiles-2.94-1.1 package on the GA media of openSUSE Tumbleweed.

Patchnames: openSUSE-Tumbleweed-2024-10146

CVE-2012-2451

Affected products

Recommended 4 products

Product	Version	Remediation
Unresolved product id: openSUSE Tumbleweed:perl-Config-IniFiles-2.94-1.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:perl-Config-IniFiles-2.94-1.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:perl-Config-IniFiles-2.94-1.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:perl-Config-IniFiles-2.94-1.1.x86_64	—	Vendor Fix

Threats

Impact low

References

5 references

URL	Category
https://www.suse.com/support/security/rating/	external
https://ftp.suse.com/pub/projects/security/csaf/o…	self
https://www.suse.com/security/cve/CVE-2012-2451/	self
https://www.suse.com/security/cve/CVE-2012-2451	external
https://bugzilla.suse.com/760459	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "perl-Config-IniFiles-2.94-1.1 on GA media",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "These are all security issues fixed in the perl-Config-IniFiles-2.94-1.1 package on the GA media of openSUSE Tumbleweed.",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-Tumbleweed-2024-10146",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2024_10146-1.json"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2012-2451 page",
        "url": "https://www.suse.com/security/cve/CVE-2012-2451/"
      }
    ],
    "title": "perl-Config-IniFiles-2.94-1.1 on GA media",
    "tracking": {
      "current_release_date": "2024-06-15T00:00:00Z",
      "generator": {
        "date": "2024-06-15T00:00:00Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2024:10146-1",
      "initial_release_date": "2024-06-15T00:00:00Z",
      "revision_history": [
        {
          "date": "2024-06-15T00:00:00Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "perl-Config-IniFiles-2.94-1.1.aarch64",
                "product": {
                  "name": "perl-Config-IniFiles-2.94-1.1.aarch64",
                  "product_id": "perl-Config-IniFiles-2.94-1.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "perl-Config-IniFiles-2.94-1.1.ppc64le",
                "product": {
                  "name": "perl-Config-IniFiles-2.94-1.1.ppc64le",
                  "product_id": "perl-Config-IniFiles-2.94-1.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "perl-Config-IniFiles-2.94-1.1.s390x",
                "product": {
                  "name": "perl-Config-IniFiles-2.94-1.1.s390x",
                  "product_id": "perl-Config-IniFiles-2.94-1.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "perl-Config-IniFiles-2.94-1.1.x86_64",
                "product": {
                  "name": "perl-Config-IniFiles-2.94-1.1.x86_64",
                  "product_id": "perl-Config-IniFiles-2.94-1.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Tumbleweed",
                "product": {
                  "name": "openSUSE Tumbleweed",
                  "product_id": "openSUSE Tumbleweed",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:tumbleweed"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "perl-Config-IniFiles-2.94-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:perl-Config-IniFiles-2.94-1.1.aarch64"
        },
        "product_reference": "perl-Config-IniFiles-2.94-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "perl-Config-IniFiles-2.94-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:perl-Config-IniFiles-2.94-1.1.ppc64le"
        },
        "product_reference": "perl-Config-IniFiles-2.94-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "perl-Config-IniFiles-2.94-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:perl-Config-IniFiles-2.94-1.1.s390x"
        },
        "product_reference": "perl-Config-IniFiles-2.94-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "perl-Config-IniFiles-2.94-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:perl-Config-IniFiles-2.94-1.1.x86_64"
        },
        "product_reference": "perl-Config-IniFiles-2.94-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2012-2451",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2012-2451"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The Config::IniFiles module before 2.71 for Perl creates temporary files with predictable names, which allows local users to overwrite arbitrary files via a symlink attack.  NOTE: some of these details are obtained from third party information.  NOTE: it has been reported that this might only be exploitable by writing in the same directory as the .ini file. If this is the case, then this issue might not cross privilege boundaries.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:perl-Config-IniFiles-2.94-1.1.aarch64",
          "openSUSE Tumbleweed:perl-Config-IniFiles-2.94-1.1.ppc64le",
          "openSUSE Tumbleweed:perl-Config-IniFiles-2.94-1.1.s390x",
          "openSUSE Tumbleweed:perl-Config-IniFiles-2.94-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2012-2451",
          "url": "https://www.suse.com/security/cve/CVE-2012-2451"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 760459 for CVE-2012-2451",
          "url": "https://bugzilla.suse.com/760459"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:perl-Config-IniFiles-2.94-1.1.aarch64",
            "openSUSE Tumbleweed:perl-Config-IniFiles-2.94-1.1.ppc64le",
            "openSUSE Tumbleweed:perl-Config-IniFiles-2.94-1.1.s390x",
            "openSUSE Tumbleweed:perl-Config-IniFiles-2.94-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-06-15T00:00:00Z",
          "details": "low"
        }
      ],
      "title": "CVE-2012-2451"
    }
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.

Action not permitted

CVE-2012-2451 (GCVE-0-2012-2451)

FKIE_CVE-2012-2451

GHSA-G533-VRRR-6J8R

GSD-2012-2451

OPENSUSE-SU-2024:10146-1

Tags

Sightings

Nomenclature