CVE-2010-1447
HIGH severity · CVSS 8.5 · CWE-264
8.5CVSS HIGH
Summary
The Safe (aka Safe.pm) module 2.26, and certain earlier versions, for Perl, as used in PostgreSQL 7.4 before 7.4.29, 8.0 before 8.0.25, 8.1 before 8.1.21, 8.2 before 8.2.17, 8.3 before 8.3.11, 8.4 before 8.4.4, and 9.0 Beta before 9.0 Beta 2, allows context-dependent attackers to bypass intended (1) Safe::reval and (2) Safe::rdo access restrictions, and inject and execute arbitrary code, via vectors involving subroutine references and delayed execution.
Impact & exploitability
Attack vectorNetwork
Attack complexity—
Privileges required—
User interaction—
Confidentiality impact—
Integrity impact—
Availability impact—
Exploit probability (EPSS)3%
AV:N/AC:M/Au:S/C:C/I:C/A:C
Affected products we track (1)
Recommendation
Apply the vendor fix promptly. Open any affected product above for its exact safe version.
Additional information
- NVD record
- http://secunia.com/advisories/39845Advisory
- http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705
- http://osvdb.org/64756
- http://secunia.com/advisories/40049
- http://secunia.com/advisories/40052
- http://security-tracker.debian.org/tracker/CVE-2010-1447
- http://www.debian.org/security/2011/dsa-2267
- http://www.mandriva.com/security/advisories?name=MDVSA-2010:115