{"id":"CVE-2012-3386","aliases":["DEBIAN-CVE-2012-3386","EUVD-2012-3358","GHSA-mr65-r935-qjpj","RHSA-2013:0526","RHSA-2014:1243","openSUSE-SU-2022:10031-1","openSUSE-SU-2024:10184-1","openSUSE-SU-2024:10293-1","openSUSE-SU-2024:10576-1"],"status":"published","title":"The \"make distcheck\" rule in GNU Automake before 1.11.6 and 1.12.x before 1.12.2 grants world...","description":"The \"make distcheck\" rule in GNU Automake before 1.11.6 and 1.12.x before 1.12.2 grants world-writable permissions to the extraction directory, which introduces a race condition that allows local users to execute arbitrary code via unspecified vectors.","severity":{"version":"2.0","score":4.4,"vector":"AV:L/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.00474,"percentile":0.4127,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-264","CWE-362"],"published":"2012-08-07T21:00:00Z","modified":"2026-10-23T17:47:31Z","fixes":[{"ecosystem":"Debian:14","package":"automake","fixed_in":["1:1.4-p6-13.1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"automake1.11","fixed_in":["1:1.11.6-1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"automake","fixed_in":["0:1.11.1-4.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"automake","fixed_in":["0:1.11.1-4.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"automake","fixed_in":["0:1.11.1-4.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"automake","fixed_in":["0:1.11.1-4.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::client_workstation","package":"automake","fixed_in":["0:1.9.6-3.el5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::server","package":"automake","fixed_in":["0:1.9.6-3.el5"],"sources":["osv"]},{"ecosystem":"SUSE:Package Hub 15 SP4","package":"wdiff","fixed_in":["1.2.2-bp154.2.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.4","package":"wdiff","fixed_in":["1.2.2-bp154.2.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"gv","fixed_in":["1.2.2-5.5"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:14","package":"automake","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.4-p6-13.1"}]}],"versions":["1.0-0","1.0-1","1.0-4","1.3-1","1.3-2","1.4-8","1:1.4-p4-1.1","1:1.4-p6-10","1:1.4-p6-11","1:1.4-p6-12","1:1.4-p6-13","1:1.4-p6-9"]},{"source":"osv","ecosystem":"Debian:12","package":"automake1.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.11.6-1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"automake","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.11.1-4.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"automake","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.11.1-4.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"automake","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.11.1-4.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"automake","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.11.1-4.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client_workstation","package":"automake","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.6-3.el5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"automake","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.6-3.el5"}]}]},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP4","package":"wdiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.2-bp154.2.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"wdiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.2-bp154.2.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"gv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.2-5.5"}]}]}],"products":[{"vendor":"gnu","product":"automake"}],"references":[{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2012-October/089187.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2012:103","tags":["vendor-advisory","x_refsource_MANDRIVA","x_transferred","advisory"]},{"url":"http://lists.opensuse.org/opensuse-updates/2012-11/msg00038.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2012-September/087538.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2013-0526.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory"]},{"url":"https://lists.gnu.org/archive/html/automake/2012-07/msg00021.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Patch","fix"]},{"url":"https://lists.gnu.org/archive/html/automake/2012-07/msg00022.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Patch","fix"]},{"url":"https://lists.gnu.org/archive/html/automake/2012-07/msg00023.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Patch","fix"]},{"url":"http://git.savannah.gnu.org/cgit/automake.git/commit/?id=784b3e6ccc7c72a1c95c340cbbe8897d6b689d76","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Patch","evidence","fix"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2012-September/087665.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2012-3386","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2013:0526","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2014:1243","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2012-3386","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=838286","tags":["report"]},{"url":"https://github.com/advisories/GHSA-mr65-r935-qjpj"},{"url":"https://security-tracker.debian.org/tracker/CVE-2012-3386","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#low","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_0526.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2012-3386","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_1243.json","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/RHVSBRLGJ5C5MYYVH2AXVEQBTRVMVFRD/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2012-3386","tags":["web"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2010-1205","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-2501","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-3026","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-3045","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-3048","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-7353","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-7354","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9495","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-0973","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8126","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8540","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2009-4029","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2012-3386","description":"The \"make distcheck\" rule in GNU Automake before 1.11.6 and 1.12.x before 1.12.2 grants world-writable permissions to the extraction directory, which introduces a race condition that allows local users to execute arbitrary code via unspecified vectors.","status":"published","published":"2012-08-07T21:00:00Z","modified":"2024-08-06T20:05:12.403Z","updated_at":"2026-11-02T14:34:50.615647Z"}],"euvd":[{"id":"EUVD-2012-3358","description":"The \"make distcheck\" rule in GNU Automake before 1.11.6 and 1.12.x before 1.12.2 grants world-writable permissions to the extraction directory, which introduces a race condition that allows local users to execute arbitrary code via unspecified vectors.","status":"published","published":"2012-08-07T21:00:00Z","modified":"2024-08-06T20:05:12Z","updated_at":"2026-11-03T01:56:11.327216Z"}],"ghsa":[{"id":"GHSA-mr65-r935-qjpj","title":"The \"make distcheck\" rule in GNU Automake before 1.11.6 and 1.12.x before 1.12.2 grants world...","description":"The \"make distcheck\" rule in GNU Automake before 1.11.6 and 1.12.x before 1.12.2 grants world-writable permissions to the extraction directory, which introduces a race condition that allows local users to execute arbitrary code via unspecified vectors.","status":"published","published":"2022-05-17T05:12:10Z","modified":"2023-02-10T05:06:56Z","updated_at":"2026-11-02T14:54:03.327923Z"}],"nvd":[{"id":"CVE-2012-3386","description":"The \"make distcheck\" rule in GNU Automake before 1.11.6 and 1.12.x before 1.12.2 grants world-writable permissions to the extraction directory, which introduces a race condition that allows local users to execute arbitrary code via unspecified vectors.","status":"published","published":"2012-08-07T21:55:01.42Z","modified":"2026-06-16T23:43:07.307Z","cvss":[{"version":"2.0","score":4.4,"vector":"AV:L/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-264","CWE-362"],"updated_at":"2026-11-02T14:02:15.188652Z"}],"osv":[{"id":"CVE-2012-3386","description":"The \"make distcheck\" rule in GNU Automake before 1.11.6 and 1.12.x before 1.12.2 grants world-writable permissions to the extraction directory, which introduces a race condition that allows local users to execute arbitrary code via unspecified vectors.","status":"published","published":"2012-08-07T21:55:01Z","modified":"2026-04-10T03:44:17.029189Z","updated_at":"2026-11-02T15:43:58.537032Z"},{"id":"DEBIAN-CVE-2012-3386","description":"The \"make distcheck\" rule in GNU Automake before 1.11.6 and 1.12.x before 1.12.2 grants world-writable permissions to the extraction directory, which introduces a race condition that allows local users to execute arbitrary code via unspecified vectors.","status":"published","published":"2012-08-07T21:55:01.42Z","modified":"2026-10-23T17:47:31.849204092Z","updated_at":"2026-11-02T15:45:24.92418Z"},{"id":"openSUSE-SU-2022:10031-1","title":"Security update for wdiff","description":"This update for wdiff fixes the following issues:\n\nThis update ships wdiff.\n\nUpdated to 1.2.2:\n\n  * Updated Vietnamese, Swedish, Estonian, Chinese (traditional),\n    Brazilian Portuguese and Russian translations.\n  * Updated gnulib.\n  * Used more recent autotools: autoconf 2.69 and automake 1.14.1.\n\nupdated to 1.2.1:\n\n  * Added Esperanto translation.\n  * Updated Czech, German, Spanish, Finnish, Galician, Italian, Dutch,\n    Polish, Slovenian, Serbian, Swedish, Ukrainian and Vietnamese\n    translations.\n  * Updated gnulib.\n  * Recreated build system using recent versions of autotools.\n    This will avoid security issues in 'make distcheck' target.\n    (CVE-2012-3386)\n\nupdated to 1.1.2:\n\n  * Backport gnulib change to deal with removal of gets function.\n    This is a build-time-only fix. (Mentioned in Fedora bug #821791)\n  * Added Serbian translation.\n  * Updated Danish and Vietnamese translations.\n  * Work around a bug in the formatting of the man page.\n    (Debian bug #669340)\n  * Updated Czech, German, Spanish, Finnish, Dutch, Polish, Slovenian,\n    Swedish and Ukrainian translations.\n  * Fix several issue with the use of screen in the test suite.\n  * Allow WDIFF_PAGER to override PAGER environment variable.\n  * Do not autodetect less, so we don't auto-enable less-mode.\n    This should improve things for UTF8 text. (Savannah bug #34224)\n    Less-mode is considered deprecated, as it isn't fit for multi-byte\n    encodings. Nevertheless it can still be enabled on the command line.\n  * Introduces use of ngettext to allow correct handling of plural forms\n\nupdated to 1.0.1:\n\n  * Updated Polish, Ukrainian, Slovenian, Dutch, Finnish, Swedish and\n    Czech translations\n  * Changed major version to 1 to reflect maturity of the package\n  * Updated Dutch, French, Danish and Slovenian translations\n  * Added Ukrainian translation\n  * Improved error reporting in case a child process has problems\n  * Added tests to the test suite\n  * Updated gnulib\n\nupdated to 0.6.5:\n\n  * Never initialize or deinitialize terminals, as we do no cursor \n    movement\n  * Deprecated --no-init-term (-K) command line option\n  * Avoid relative path in man pages\n  * Updated gnulib, might be particularly important for uClibc \n    users\n\nupdated to 0.6.4:\n\n  * Updated Catalan translations\n  * Updated gnulib\n\nupdate to 0.6.3:\n\n  * `wdiff -d' to read input from single unified diff, perhaps stdin.\n  * Updated texinfo documentation taking experimental switch into account.\n  * Experimental programs (mdiff \u0026 friends) and a configure switch\n    --enable-experimental to control them.\n  * Recent imports from gnulib, use of recent autotools.\n  * Improved autodetection of termcap library like ncurses.\n  * Reformatted translations, still a number of fuzzy translations.\n  * Changed from CVS to bzr for source code version control.\n  * Various bug fixes. See ChangeLog for a more exhaustive list.\n  * Introduce --with-default-pager=PAGER configure switch.\n  * Fix missing newline in info dir entry list.\n  * Fix shell syntax in configure script\n  * Updated gnulib and gettext, the latter to 0.18\n  * Updated Dutch translation\n  * Fixed a number of portability issues reported by maint.mk syntax checks\n  * Updated Italian and Swedish translations\n  * Updated gnulib\n","status":"published","published":"2022-06-25T18:01:15Z","modified":"2026-02-04T03:38:39.451702Z","updated_at":"2026-11-02T16:58:32.653274Z"},{"id":"openSUSE-SU-2024:10184-1","title":"libpng12-0-1.2.56-1.5 on GA media","description":"These are all security issues fixed in the libpng12-0-1.2.56-1.5 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2025-05-07T18:08:35.318501Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"openSUSE-SU-2024:10293-1","title":"cppi-1.18-2.4 on GA media","description":"These are all security issues fixed in the cppi-1.18-2.4 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:26:27.26937Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"openSUSE-SU-2024:10576-1","title":"gv-3.7.4-3.8 on GA media","description":"These are all security issues fixed in the gv-3.7.4-3.8 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:29:26.367625Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"RHSA-2013:0526","title":"Red Hat Security Advisory: automake security update","status":"published","published":"2024-09-15T20:29:07Z","modified":"2025-11-22T10:42:18Z","updated_at":"2026-11-02T15:53:01.993625Z"},{"id":"RHSA-2014:1243","title":"Red Hat Security Advisory: automake security update","status":"published","published":"2024-09-15T20:29:12Z","modified":"2025-11-22T10:53:49Z","updated_at":"2026-11-02T15:53:02.532052Z"}]}}