TI-2012-05088 Aliases CVE-2012-6124 GHSA-59j9-qv68-3xx5

A casting error in Chicken before 4.8.0 on 64-bit platform caused the random number…

LOW 27CWE-338Published 2019-10-31 · Updated 2024-08-06

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: None · Low · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

A casting error in Chicken before 4.8.0 on 64-bit platform caused the random number generator to return a constant value. NOTE: the vendor states "This function wasn't used for security purposes (and is advertised as being unsuitable)."

Why it matters now

EPSS 0.0126 69th percentileScored 2026-11-07

Fix Fixed chicken (chicken): 4.8.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
chicken	chicken	before 4.8.0	4.8.0	Patch available	CNA

chicken Vendorchicken Affected before 4.8.0 Fixed in 4.8.0 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:call-cc:chicken:::::::x64:*	before 4.8.0	Vulnerable	chicken

cpe:2.3:a:call-cc:chicken:*:*:*:*:*:*:x64:* Versions before 4.8.0 Vulnerable ·chicken

Remediation

Fix · CNA chicken (chicken) Fixed in 4.8.0

Timeline

2026-10-02 Threatist record created from CVE-2012-6124
2026-10-03 Alias added: GHSA-59j9-qv68-3xx5

References

Patch 2

Advisory 1

https://security-tracker.debian.org/tracker/CVE-2012-6124

Other 1

https://access.redhat.com/security/cve/cve-2012-6124

TI-2022-22220 egg-compile.scm in CHICKEN 5.x before 5.3.1 allows arbitrary OS command execution during… CVSS 3.1CRITICAL 9.8
TI-2014-05188 Buffer overflow in CHICKEN 4.9.0 and 4.9.0.1 may allow remote attackers to execute… CVSS 3.1CRITICAL 9.8
TI-2016-05868 The "process-execute" and "process-spawn" procedures in CHICKEN Scheme used fixed-size… CVSS 3.0CRITICAL 9.8
TI-2012-05089 Chicken before 4.8.0 is susceptible to algorithmic complexity attacks related to hash table collisions. CVSS 3.1CRITICAL 9.8
TI-2013-01796 OS command injection vulnerability in the "qs" procedure from the "utils" module in Chicken before 4.9.0. CVSS 3.1HIGH 8.8
TI-2013-01846 Buffer overflow in chicken CVSS 3.1HIGH 8.8

See all 17 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences