CVE-2012-2967 Caucho Quercus, as distributed in Resin, does not properly implement the `==` operator for comparisons
Caucho Quercus improperly implements the equality operator, leading to unspecified security impacts in applications using this Java-based PHP engine.
- Exploited in the wild
- Not known
- Login needed
- Not stated
- Attackable
- Not stated
- Victim action needed
- Not stated
- Fix
- Available
What is CVE-2012-2967?
CVE-2012-2967 is a high-severity vulnerability in n/a, published on 12 Aug 2012.
Official description
Caucho Quercus, as distributed in Resin before 4.0.29, does not properly implement the == (equals sign equals sign) operator for comparisons, which has unspecified impact and context-dependent attack vectors.
Which versions are affected by CVE-2012-2967?
2 open source packages ship an affected version, including com.caucho:resin. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
com.caucho:resin Maven | All versions | 4.0.29 |
com.caucho:resin Maven | All versions | 4.0.29 |
Products include Caucho Resin.
How do I fix CVE-2012-2967?
Upgrade com.caucho:resin to 4.0.29 or later.
Is CVE-2012-2967 being exploited?
There is no known exploitation of CVE-2012-2967 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2021-44138 Path Traversal in Caucho Resin
- CVE-2012-2965 Caucho Quercus, as distributed in Resin, does not properly handle unspecified characters in the names of variables
- CVE-2012-2966 Caucho Quercus, as distributed in Resin, overwrites entries in SERVER superglobal array on basis of POST parameters
- CVE-2012-2969 Path traversal in n/a
- CVE-2014-2966 Security feature bypass in n/a
Sources
Also known as GHSA-2qr7-8fp8-4xxr.