p PatchFirst

CVE-2012-6112

CVE-2012-6112

This page contains facts from public vulnerability sources. Check the original advisory before updating.

classes/GoogleSpell.php in the PHP Spellchecker (aka Google Spellchecker) addon before 2.0.6.1 for TinyMCE, as used in Moodle 2.1.x before 2.1.10, 2.2.x before 2.2.7, 2.3.x before 2.3.4, and 2.4.x before 2.4.1 and other products, does not properly handle control characters, which allows remote attackers to trigger arbitrary outbound HTTP requests via a crafted string.

EPSS 2.3% · Fix available

Published
Updated

Stack: system · php

Affected products and versions

  • n/a

    Versions
    • n/a: Affected

    No fix published

  • wordpress Debian:12

    Affected ranges
    • ECOSYSTEM: < 3.5.1+dfsg-2

    Update to 3.5.1+dfsg-2

  • wordpress Debian:13

    Affected ranges
    • ECOSYSTEM: < 3.5.1+dfsg-2

    Update to 3.5.1+dfsg-2

  • wordpress Debian:14

    Affected ranges
    • ECOSYSTEM: < 3.5.1+dfsg-2

    Update to 3.5.1+dfsg-2

  • moodle/moodle Packagist

    Affected ranges
    • ECOSYSTEM: ≥ 2.1.0, < 2.1.10

    Update to 2.1.10

  • moodle/moodle Packagist

    Affected ranges
    • ECOSYSTEM: ≥ 2.2.0, < 2.2.7

    Update to 2.2.7

  • moodle/moodle Packagist

    Affected ranges
    • ECOSYSTEM: ≥ 2.3.0, < 2.3.4

    Update to 2.3.4

  • moodle/moodle Packagist

    Versions
    • 2.4.0
    • v2.4.0
    Affected ranges
    • ECOSYSTEM: ≥ 2.4.0, < 2.4.1

    Update to 2.4.1

  • tinymce Ubuntu:16.04:LTS

    Versions
    • 3.4.8+dfsg0-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • tinymce Ubuntu:18.04:LTS

    Versions
    • 3.4.8+dfsg0-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • tinymce Ubuntu:20.04:LTS

    Versions
    • 3.4.8+dfsg0-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →