CVE-2012-6329 Code injection in n/a

What is CVE-2012-6329?

CVE-2012-6329 is a high-severity code injection vulnerability in n/a, published on 4 Jan 2013. It can be exploited over the network, and only if a user opens a file or follows a link.

Official description

The _compile function in Maketext.pm in the Locale::Maketext implementation in Perl before 5.17.7 does not properly handle backslashes and fully qualified method names during compilation of bracket notation, which allows context-dependent attackers to execute arbitrary commands via crafted input to an application that accepts translation strings from users, as demonstrated by the TWiki application before 5.1.3, and the Foswiki application 1.0.x through 1.0.10 and 1.1.x through 1.1.6.

Weakness: CWE-94

Which versions are affected by CVE-2012-6329?

It affects 1 product.

Products include Perl Perl.

How do I fix CVE-2012-6329?

Upgrade to a fixed version.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2012-6329 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2012-6329 exists.

Public exploit code: 2 Metasploit modules and 2 Exploit-DB entries.

Other vulnerabilities in n/a

• CVE-2026-4176 Supply chain in perl Critical 9.8
• CVE-2022-48522 Memory corruption in n/a Critical 9.8
• CVE-2017-12814 Memory corruption in n/a Critical 9.8
• CVE-2015-8608 Memory corruption in n/a Critical 9.8
• CVE-2026-13221 Integer overflow in perl:perl Critical 9.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2012-6329, GHSA-g4g2-w92h-7fjc, RHSA-2026:80394.