vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2012-2143

N/A
Published: July 5, 2012 at 02:00 PM UTC
Updated: June 16, 2026 at 11:41 PM UTC
4 products affected across 4 vendorsDebian LinuxPHPFreeBSD

Using N/A by N/A?

Get instant alerts when new vulnerabilities affect N/A - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
N/A
Exploit prediction
EPSS 6%

Description

The crypt_des (aka DES-based crypt) function in FreeBSD before 9.0-RELEASE-p2, as used in PHP, PostgreSQL, and other products, does not process the complete cleartext password if this password contains a 0x80 character, which makes it easier for context-dependent attackers to obtain access via an authentication attempt with an initial substring of the intended password, as demonstrated by a Unicode password.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Debian Linux· Debiandrupal
95%
6.0
FreeBSD· Freebsd
95%
v ≤ 9.01.01.11.1.51.1.5.12.02.0.52.12.1.52.1.62.1.72.22.2.12.2.22.2.52.2.62.2.72.2.83.03.13.23.33.43.54.04.14.1.14.104.114.24.34.44.54.64.6.24.74.84.95.05.15.25.2.15.35.45.56.06.16.26.36.47.07.17.27.37.48.08.18.28.3
PHP· PHPdrupal
95%
v < 5.3.145.4.0 ≤ v < 5.4.4
Affected range stops below 5.3.14, so it looks safe — our inference, not a vendor statement
Affected range stops below 5.4.4, so it looks safe — our inference, not a vendor statement
PostgreSQL· PostgreSQL
95%
8.3 ≤ v < 8.3.198.4 ≤ v < 8.4.129.0 ≤ v < 9.0.89.1 ≤ v < 9.1.4
Affected range stops below 8.3.19, so it looks safe — our inference, not a vendor statement
Affected range stops below 8.4.12, so it looks safe — our inference, not a vendor statement
Affected range stops below 9.0.8, so it looks safe — our inference, not a vendor statement
Affected range stops below 9.1.4, so it looks safe — our inference, not a vendor statement

References (25)

x_refsource_CONFIRMBroken LinkPatch
Source: [email protected]
http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=aab49e934de1fff046e659cbec46e3d053b41c34
x_refsource_CONFIRMVendor Advisory
Source: [email protected]
http://git.postgresql.org/gitweb/?p=postgresql.git&a=commit&h=932ded2ed51e8333852e370c7a6dad75d9f236f9
x_refsource_CONFIRMThird Party Advisory
Source: [email protected]
http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705
Vendor Advisoryx_refsource_APPLEMailing ListThird Party Advisory
Source: [email protected]
http://lists.apple.com/archives/security-announce/2012/Sep/msg00004.html
Vendor Advisoryx_refsource_FEDORAMailing ListThird Party Advisory
Source: [email protected]
http://lists.fedoraproject.org/pipermail/package-announce/2012-June/082258.html
Vendor Advisoryx_refsource_FEDORAMailing ListThird Party Advisory
Source: [email protected]
http://lists.fedoraproject.org/pipermail/package-announce/2012-June/082292.html
Vendor Advisoryx_refsource_FEDORAMailing ListThird Party Advisory
Source: [email protected]
http://lists.fedoraproject.org/pipermail/package-announce/2012-June/082294.html
Vendor Advisoryx_refsource_SUSEMailing ListThird Party Advisory
Source: [email protected]
http://lists.opensuse.org/opensuse-security-announce/2012-07/msg00003.html

CVSS

4.3MEDIUM[email protected]
Confidentiality
NONE
Integrity
PARTIAL
Availability
NONE
Vector?

Quick Info

StatusMODIFIED
CWE
CWE-310

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card