CVE-2012-3386
The "make distcheck" rule in GNU Automake before 1.11.6 and 1.12.x before 1.12.2 grants world...
CVE-2012-3386 is a medium vulnerability (CVSS 4.4) in Gnu Automake, published August 7, 2012. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.47%, the 41st percentile. Fixed in automake 1:1.4-p6-13.1.
The "make distcheck" rule in GNU Automake before 1.11.6 and 1.12.x before 1.12.2 grants world-writable permissions to the extraction directory, which introduces a race condition that allows local users to execute arbitrary code via unspecified vectors.
Exploit likelihood
What each source reports
NVD Score used
4.4
The "make distcheck" rule in GNU Automake before 1.11.6 and 1.12.x before 1.12.2 grants world-writable permissions to the extraction directory, which introduces a race condition that allows local users to execute arbitrary code via unspecified vectors.
- Record
CVE-2012-3386- CVSS 2.0
- 4.4 Medium
AV:L/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-264, CWE-362
- Updated
- 2026-11-02
CVE List No score
The "make distcheck" rule in GNU Automake before 1.11.6 and 1.12.x before 1.12.2 grants world-writable permissions to the extraction directory, which introduces a race condition that allows local users to execute arbitrary code via unspecified vectors.
- Record
CVE-2012-3386- Updated
- 2026-11-02
EUVDEUVD-2012-3358 No score
The "make distcheck" rule in GNU Automake before 1.11.6 and 1.12.x before 1.12.2 grants world-writable permissions to the extraction directory, which introduces a race condition that allows local users to execute arbitrary code via unspecified vectors.
- Record
EUVD-2012-3358- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-mr65-r935-qjpj No score
The "make distcheck" rule in GNU Automake before 1.11.6 and 1.12.x before 1.12.2 grants world...
The "make distcheck" rule in GNU Automake before 1.11.6 and 1.12.x before 1.12.2 grants world-writable permissions to the extraction directory, which introduces a race condition that allows local users to execute arbitrary code via unspecified vectors.
- Record
GHSA-mr65-r935-qjpj- Updated
- 2026-11-02
OSV No score
The "make distcheck" rule in GNU Automake before 1.11.6 and 1.12.x before 1.12.2 grants world-writable permissions to the extraction directory, which introduces a race condition that allows local users to execute arbitrary code via unspecified vectors.
- Record
CVE-2012-3386- Updated
- 2026-11-02
OSVDEBIAN-CVE-2012-3386 No score
The "make distcheck" rule in GNU Automake before 1.11.6 and 1.12.x before 1.12.2 grants world-writable permissions to the extraction directory, which introduces a race condition that allows local users to execute arbitrary code via unspecified vectors.
- Record
DEBIAN-CVE-2012-3386- Updated
- 2026-11-02
Show 4 moreShow less
OSVopenSUSE-SU-2022:10031-1 No score
Security update for wdiff
This update for wdiff fixes the following issues:
This update ships wdiff.
Updated to 1.2.2:
- Updated Vietnamese, Swedish, Estonian, Chinese (traditional), Brazilian Portuguese and Russian translations.
- Updated gnulib.
- Used more recent autotools: autoconf 2.69 and automake 1.14.1.
updated to 1.2.1:
- Added Esperanto translation.
- Updated Czech, German, Spanish, Finnish, Galician, Italian, Dutch, Polish, Slovenian, Serbian, Swedish, Ukrainian and Vietnamese translations.
- Updated gnulib.
- Recreated build system using recent versions of autotools. This will avoid security issues in 'make distcheck' target. (CVE-2012-3386)
updated to 1.1.2:
- Backport gnulib change to deal with removal of gets function. This is a build-time-only fix. (Mentioned in Fedora bug #821791)
- Added Serbian translation.
- Updated Danish and Vietnamese translations.
- Work around a bug in the formatting of the man page. (Debian bug #669340)
- Updated Czech, German, Spanish, Finnish, Dutch, Polish, Slovenian, Swedish and Ukrainian translations.
- Fix several issue with the use of screen in the test suite.
- Allow WDIFF_PAGER to override PAGER environment variable.
- Do not autodetect less, so we don't auto-enable less-mode. This should improve things for UTF8 text. (Savannah bug #34224) Less-mode is considered deprecated, as it isn't fit for multi-byte encodings. Nevertheless it can still be enabled on the command line.
- Introduces use of ngettext to allow correct handling of plural forms
updated to 1.0.1:
- Updated Polish, Ukrainian, Slovenian, Dutch, Finnish, Swedish and Czech translations
- Changed major version to 1 to reflect maturity of the package
- Updated Dutch, French, Danish and Slovenian translations
- Added Ukrainian translation
- Improved error reporting in case a child process has problems
- Added tests to the test suite
- Updated gnulib
updated to 0.6.5:
- Never initialize or deinitialize terminals, as we do no cursor movement
- Deprecated --no-init-term (-K) command line option
- Avoid relative path in man pages
- Updated gnulib, might be particularly important for uClibc users
updated to 0.6.4:
- Updated Catalan translations
- Updated gnulib
update to 0.6.3:
- `wdiff -d' to read input from single unified diff, perhaps stdin.
- Updated texinfo documentation taking experimental switch into account.
- Experimental programs (mdiff & friends) and a configure switch --enable-experimental to control them.
- Recent imports from gnulib, use of recent autotools.
- Improved autodetection of termcap library like ncurses.
- Reformatted translations, still a number of fuzzy translations.
- Changed from CVS to bzr for source code version control.
- Various bug fixes. See ChangeLog for a more exhaustive list.
- Introduce --with-default-pager=PAGER configure switch.
- Fix missing newline in info dir entry list.
- Fix shell syntax in configure script
- Updated gnulib and gettext, the latter to 0.18
- Updated Dutch translation
- Fixed a number of portability issues reported by maint.mk syntax checks
- Updated Italian and Swedish translations
- Updated gnulib
- Record
openSUSE-SU-2022:10031-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10184-1 No score
libpng12-0-1.2.56-1.5 on GA media
These are all security issues fixed in the libpng12-0-1.2.56-1.5 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10184-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10293-1 No score
cppi-1.18-2.4 on GA media
These are all security issues fixed in the cppi-1.18-2.4 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10293-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10576-1 No score
gv-3.7.4-3.8 on GA media
These are all security issues fixed in the gv-3.7.4-3.8 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10576-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
automakeDebian:14 |
before 1:1.4-p6-13.1, plus listed versions 1.0-01.0-11.0-41.3-11.3-2 Show 7 moreShow less1.4-81:1.4-p4-1.11:1.4-p6-101:1.4-p6-111:1.4-p6-121:1.4-p6-131:1.4-p6-9 |
1:1.4-p6-13.1 |
automake1.11Debian:12 |
before 1:1.11.6-1 | 1:1.11.6-1 |
automakeRed Hat:enterprise_linux:6::client |
before 0:1.11.1-4.el6 | 0:1.11.1-4.el6 |
automakeRed Hat:enterprise_linux:6::computenode |
before 0:1.11.1-4.el6 | 0:1.11.1-4.el6 |
automakeRed Hat:enterprise_linux:6::server |
before 0:1.11.1-4.el6 | 0:1.11.1-4.el6 |
automakeRed Hat:enterprise_linux:6::workstation |
before 0:1.11.1-4.el6 | 0:1.11.1-4.el6 |
automakeRed Hat:enterprise_linux:5::client_workstation |
before 0:1.9.6-3.el5 | 0:1.9.6-3.el5 |
automakeRed Hat:enterprise_linux:5::server |
before 0:1.9.6-3.el5 | 0:1.9.6-3.el5 |
wdiffSUSE:Package Hub 15 SP4 |
before 1.2.2-bp154.2.1 | 1.2.2-bp154.2.1 |
wdiffopenSUSE:Leap 15.4 |
before 1.2.2-bp154.2.1 | 1.2.2-bp154.2.1 |
gvopenSUSE:Tumbleweed |
before 1.2.2-5.5 | 1.2.2-5.5 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
lists.fedoraproject.org/pipermail/package-announce/2012-October/089187.html
mandriva.com/security/advisories?name=MDVSA-2012:103
lists.opensuse.org/opensuse-updates/2012-11/msg00038.html
lists.fedoraproject.org/pipermail/package-announce/2012-September/087538.html
rhn.redhat.com/errata/RHSA-2013-0526.html
lists.gnu.org/archive/html/automake/2012-07/msg00021.html
Show 29 moreShow less
lists.gnu.org/archive/html/automake/2012-07/msg00022.html
lists.gnu.org/archive/html/automake/2012-07/msg00023.html
git.savannah.gnu.org/cgit/automake.git/commit?id=784b3e6ccc7c72a1c95c340cbbe8897d6b689d76
lists.fedoraproject.org/pipermail/package-announce/2012-September/087665.html
nvd.nist.gov/vuln/detail/CVE-2012-3386
access.redhat.com/errata/RHSA-2013:0526
access.redhat.com/errata/RHSA-2014:1243
access.redhat.com/security/cve/CVE-2012-3386
bugzilla.redhat.com/show_bug.cgi?id=838286
github.com/advisories/GHSA-mr65-r935-qjpj
security-tracker.debian.org/tracker/CVE-2012-3386
access.redhat.com/security/updates/classification
security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_0526.json
cve.org/CVERecord?id=CVE-2012-3386
security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_1243.json
lists.opensuse.org/archives/list/[email protected]/thread/RHVSBRLGJ5C5MYYVH2AXVEQBTRVMVFRD
suse.com/security/cve/CVE-2012-3386
suse.com/security/cve/CVE-2010-1205
suse.com/security/cve/CVE-2011-2501
suse.com/security/cve/CVE-2011-3026
suse.com/security/cve/CVE-2011-3045
suse.com/security/cve/CVE-2011-3048
suse.com/security/cve/CVE-2013-7353
suse.com/security/cve/CVE-2013-7354
suse.com/security/cve/CVE-2014-9495
suse.com/security/cve/CVE-2015-0973
suse.com/security/cve/CVE-2015-8126
suse.com/security/cve/CVE-2015-8540
suse.com/security/cve/CVE-2009-4029