CVE-2011-1487

perl: lc(), uc() routines are laundering tainted data

Published Apr 11, 2011 CVSS 2.0 · 5.0 Medium EPSS 10.6% KEV · Not listed
Description
The (1) lc, (2) lcfirst, (3) uc, and (4) ucfirst functions in Perl 5.10.x, 5.11.x, and 5.12.x through 5.12.3, and 5.13.x through 5.13.11, do not apply the taint attribute to the return value upon processing tainted input, which might allow context-dependent attackers to bypass the taint protection mechanism via a crafted string.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Debian DSA Debian DSA DSA-2265-1 perl security update
EUVD EUVD EUVD-2011-1490 The (1) lc, (2) lcfirst, (3) uc, and (4) ucfirst functions in Perl 5.10.x, 5.11.x, and 5.12.x through 5.12.3, and 5.13.x through 5.13.11, do not apply the taint attribute to the return value upon processing tainted input, which might allow context-dependent attackers to bypass the taint protection mechanism via a crafted string.
Ubuntu USN Ubuntu USN USN-1129-1 Perl vulnerabilities
History

No history.

Weaknesses

Sources

Status
PUBLISHED
Assigner
redhat
Published
Updated
Aug 6, 2024, 10:28 PM
Reserved
Mar 21, 2011, 12:00 AM
Status
Modified
Published
Apr 11, 2011, 6:55 PM
Modified
Jun 16, 2026, 11:29 PM
Severity
Low
Public date
Mar 30, 2011, 12:00 AM