CVE-2012-6112
First published: Sun Jan 27 2013(Updated: )
classes/GoogleSpell.php in the PHP Spellchecker (aka Google Spellchecker) addon before 2.0.6.1 for TinyMCE, as used in Moodle 2.1.x before 2.1.10, 2.2.x before 2.2.7, 2.3.x before 2.3.4, and 2.4.x before 2.4.1 and other products, does not properly handle control characters, which allows remote attackers to trigger arbitrary outbound HTTP requests via a crafted string.
Credit: secalert@redhat.com secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Tinymce Spellchecker Php | =2.0 | |
| Tinymce Spellchecker Php | =2.0-a1 | |
| Tinymce Spellchecker Php | =2.0-a2 | |
| Tinymce Spellchecker Php | =2.0-b1 | |
| Tinymce Spellchecker Php | =2.0-b2 | |
| Tinymce Spellchecker Php | =2.0-b3 | |
| Tinymce Spellchecker Php | =2.0-rc1 | |
| Tinymce Spellchecker Php | =2.0.1 | |
| Tinymce Spellchecker Php | =2.0.2 | |
| Tinymce Spellchecker Php | =2.0.3 | |
| Tinymce Spellchecker Php | =2.0.6 | |
| Moodle Moodle | =2.1.0 | |
| Moodle Moodle | =2.1.1 | |
| Moodle Moodle | =2.1.2 | |
| Moodle Moodle | =2.1.3 | |
| Moodle Moodle | =2.1.4 | |
| Moodle Moodle | =2.1.5 | |
| Moodle Moodle | =2.1.6 | |
| Moodle Moodle | =2.1.7 | |
| Moodle Moodle | =2.1.8 | |
| Moodle Moodle | =2.1.9 | |
| Moodle Moodle | =2.2.0 | |
| Moodle Moodle | =2.2.1 | |
| Moodle Moodle | =2.2.2 | |
| Moodle Moodle | =2.2.3 | |
| Moodle Moodle | =2.2.4 | |
| Moodle Moodle | =2.2.5 | |
| Moodle Moodle | =2.2.6 | |
| Moodle Moodle | =2.3.0 | |
| Moodle Moodle | =2.3.1 | |
| Moodle Moodle | =2.3.2 | |
| Moodle Moodle | =2.3.3 | |
| Moodle Moodle | =2.4.0 | |
| composer/moodle/moodle | =2.4.0 | 2.4.1 |
| composer/moodle/moodle | >=2.3.0<2.3.4 | 2.3.4 |
| composer/moodle/moodle | >=2.2.0<2.2.7 | 2.2.7 |
| composer/moodle/moodle | >=2.1.0<2.1.10 | 2.1.10 |
| =2.0 | ||
| =2.0-a1 | ||
| =2.0-a2 | ||
| =2.0-b1 | ||
| =2.0-b2 | ||
| =2.0-b3 | ||
| =2.0-rc1 | ||
| =2.0.1 | ||
| =2.0.2 | ||
| =2.0.3 | ||
| =2.0.6 | ||
| =2.1.0 | ||
| =2.1.1 | ||
| =2.1.2 | ||
| =2.1.3 | ||
| =2.1.4 | ||
| =2.1.5 | ||
| =2.1.6 | ||
| =2.1.7 | ||
| =2.1.8 | ||
| =2.1.9 | ||
| =2.2.0 | ||
| =2.2.1 | ||
| =2.2.2 | ||
| =2.2.3 | ||
| =2.2.4 | ||
| =2.2.5 | ||
| =2.2.6 | ||
| =2.3.0 | ||
| =2.3.1 | ||
| =2.3.2 | ||
| =2.3.3 | ||
| =2.4.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-37283
- http://openwall.com/lists/oss-security/2013/01/21/1
- http://www.tinymce.com/develop/changelog/?type=phpspell
- http://www.tinymce.com/forum/viewtopic.php?id=30036
- https://github.com/tinymce/tinymce_spellchecker_php/commit/22910187bfb9edae90c26e10100d8145b505b974
- https://moodle.org/mod/forum/discuss.php?d=220157
- https://nvd.nist.gov/vuln/detail/CVE-2012-6112
- https://github.com/moodle/moodle/commit/6fac8f7f04c9fe7f8bbb54a9c00ec5f9ea4f09e0
- https://github.com/moodle/moodle/commit/9803d8fc3ce08c8f8b88ad3a95d9a7c97678a3e3
- https://github.com/moodle/moodle/commit/a3243760c243ddad76e91840134009c3681cb16a
- https://github.com/moodle/moodle/commit/f938b1a89b8f381129120a37915d1b345333b3fb
- https://web.archive.org/web/20121015010345/http://www.tinymce.com/develop/changelog/?type=phpspell
- https://web.archive.org/web/20121129021911/http://www.tinymce.com/forum/viewtopic.php?id=30036
- https://github.com/advisories/GHSA-fx5h-3786-h2w6 (Advisory)
- collector/nvd-index
- agent/type
- agent/first-publish-date
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-fx5h-3786-h2w6
- alias/CVE-2012-6112
- agent/software-canonical-lookup
- agent/weakness
- agent/severity
- agent/last-modified-date
- agent/references
- agent/description
- agent/author
- agent/softwarecombine
- agent/event
- collector/nvd-cve
- source/NVD
- collector/github-advisory
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/tinymce
- canonical/tinymce spellchecker php
- version/tinymce spellchecker php/2.0
- version/tinymce spellchecker php/2.0-a1
- version/tinymce spellchecker php/2.0-a2
- version/tinymce spellchecker php/2.0-b1
- version/tinymce spellchecker php/2.0-b2
- version/tinymce spellchecker php/2.0-b3
- version/tinymce spellchecker php/2.0-rc1
- version/tinymce spellchecker php/2.0.1
- version/tinymce spellchecker php/2.0.2
- version/tinymce spellchecker php/2.0.3
- version/tinymce spellchecker php/2.0.6
- vendor/moodle
- canonical/moodle moodle
- version/moodle moodle/2.1.0
- version/moodle moodle/2.1.1
- version/moodle moodle/2.1.2
- version/moodle moodle/2.1.3
- version/moodle moodle/2.1.4
- version/moodle moodle/2.1.5
- version/moodle moodle/2.1.6
- version/moodle moodle/2.1.7
- version/moodle moodle/2.1.8
- version/moodle moodle/2.1.9
- version/moodle moodle/2.2.0
- version/moodle moodle/2.2.1
- version/moodle moodle/2.2.2
- version/moodle moodle/2.2.3
- version/moodle moodle/2.2.4
- version/moodle moodle/2.2.5
- version/moodle moodle/2.2.6
- version/moodle moodle/2.3.0
- version/moodle moodle/2.3.1
- version/moodle moodle/2.3.2
- version/moodle moodle/2.3.3
- version/moodle moodle/2.4.0
- package-manager/composer