(1) cpan/Archive-Tar/bin/ptar, (2) cpan/Archive-Tar/bin/ptardiff, (3) cpan/Archive-Tar/bin/ptargrep, (4) cpan/CPAN/scripts/cpan, (5) cpan/Digest-SHA/shasum, (6) cpan/Encode/bin/enc2xs, (7) cpan/Encode/bin/encguess, (8) cpan/Encode/bin/piconv, (9) cpan/Encode/bin/ucmlint, (10) cpan/Encode/bin/unidump, (11) cpan/ExtUtils-MakeMaker/bin/instmodsh, (12) cpan/IO-Compress/bin/zipdetails, (13) cpan/JSON-PP/bin/json_pp, (14) cpan/Test-Harness/bin/prove, (15) dist/ExtUtils-ParseXS/lib/ExtUtils/xsubpp, (16) dist/Module-CoreList/corelist, (17) ext/Pod-Html/bin/pod2html, (18) utils/c2ph.PL, (19) utils/h2ph.PL, (20) utils/h2xs.PL, (21) utils/libnetcfg.PL, (22) utils/perlbug.PL, (23) utils/perldoc.PL, (24) utils/perlivp.PL, and (25) utils/splain.PL in Perl 5.x before 5.22.3-RC2 and 5.24 before 5.24.1-RC2 do not properly remove . (period) characters from the end of the includes directory array, which might allow local users to gain privileges via a Trojan horse module under the current working directory.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade spamassassinUpgrade perl | Oct 25, 2017 | Aug 2, 2016 |
| Debian | — | Upgrade libsys-syslog-perlUpgrade perl | Jul 26, 2016 | Jul 25, 2016 |
| Freebsd | — | Upgrade perl5.24Upgrade perl5.22Upgrade perl5.18Upgrade spamassassinUpgrade perl5-develUpgrade perl5Upgrade perl5.20Upgrade perl | Nov 14, 2016 | Aug 4, 2016 |
| Gentoo Linux | — | Upgrade dev-lang/perl.Upgrade mail-filter/spamassassin. | Oct 30, 2017 | Aug 2, 2016 |
| Huawei Euleros 2_0_sp2 | — | Upgrade perlUpgrade perl-libsUpgrade perl-develUpgrade perl-macrosUpgrade perl-core | Dec 4, 2019 | Aug 2, 2016 |
| Huawei Euleros 2_0_sp3 | — | Upgrade perlUpgrade perl-macrosUpgrade perl-coreUpgrade perl-develUpgrade perl-libs | Dec 18, 2019 | Aug 2, 2016 |
| Huawei Euleros 2_0_sp5 | — | Upgrade perl-libsUpgrade perl-coreUpgrade perl-macrosUpgrade perlUpgrade perl-devel | Nov 19, 2019 | Aug 2, 2016 |
| Oracle Solaris | — | Upgrade runtime/perl-common to version 1-0.175.3.21.0.5.0 on Solaris 11.3Upgrade runtime/perl-584/extra to version 5.8.4-0.175.3.24.0.2.0 on Solaris 11.3Upgrade runtime/perl-threaded-512 to version 5.12.5-0.175.3.21.0.5.0 on Solaris 11.3Upgrade runtime/perl-522 to version 5.22.1-0.175.3.21.0.5.0 on Solaris 11.3Upgrade runtime/perl-584 to version 5.8.4-0.175.3.24.0.3.0 on Solaris 11.3Upgrade runtime/perl-512 to version 5.12.5-0.175.3.21.0.5.0 on Solaris 11.3 | Jun 20, 2017 | Aug 2, 2016 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Jul 25, 2016 |
| Suse | — | Upgrade perl-docUpgrade sles12sp1-docker-imageUpgrade perl-mail-spamassassinUpgrade spamassassinUpgrade perl-Module-Load-ConditionalUpgrade perl-mail-spamassassin-plugin-ixhash2Upgrade sles12-docker-imageUpgrade amavisd-new-docsUpgrade perl-32bitUpgrade perl-Module-BuildUpgrade perl-Test-SimpleUpgrade perl-x86Upgrade perl-MIME-CharsetUpgrade amavisd-newUpgrade perl-ExtUtils-MakeMakerUpgrade perl-Archive-ExtractUpgrade perl-baseUpgrade perl-base-32bitUpgrade perl | Sep 6, 2016 | Aug 2, 2016 |
| Ubuntu | — | Upgrade libsys-syslog-perl | Nov 19, 2024 | Aug 2, 2016 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Aug 2, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub