(1) cpan/Archive-Tar/bin/ptar, (2) cpan/Archive-Tar/bin/ptardiff, (3) cpan/Archive-Tar/bin/ptargrep, (4) cpan/CPAN/scripts/cpan, (5) cpan/Digest-SHA/shasum, (6) cpan/Encode/bin/enc2xs, (7) cpan/Encode/bin/encguess, (8) cpan/Encode/bin/piconv, (9) cpan/Encode/bin/ucmlint, (10) cpan/Encode/bin/unidump, (11) cpan/ExtUtils-MakeMaker/bin/instmodsh, (12) cpan/IO-Compress/bin/zipdetails, (13) cpan/JSON-PP/bin/json_pp, (14) cpan/Test-Harness/bin/prove, (15) dist/ExtUtils-ParseXS/lib/ExtUtils/xsubpp, (16) dist/Module-CoreList/corelist, (17) ext/Pod-Html/bin/pod2html, (18) utils/c2ph.PL, (19) utils/h2ph.PL, (20) utils/h2xs.PL, (21) utils/libnetcfg.PL, (22) utils/perlbug.PL, (23) utils/perldoc.PL, (24) utils/perlivp.PL, and (25) utils/splain.PL in Perl 5.x before 5.22.3-RC2 and 5.24 before 5.24.1-RC2 do not properly remove . (period) characters from the end of the includes directory array, which might allow local users to gain privileges via a Trojan horse module under the current working directory.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade perlUpgrade spamassassin | Oct 25, 2017 | Aug 2, 2016 |
| Debian | — | Upgrade perlUpgrade libsys-syslog-perl | Jul 26, 2016 | Jul 25, 2016 |
| Freebsd | — | Upgrade perlUpgrade perl5.20Upgrade perl5.18Upgrade perl5.24Upgrade perl5-develUpgrade spamassassinUpgrade perl5.22Upgrade perl5 | Nov 14, 2016 | Aug 4, 2016 |
| Gentoo Linux | — | Upgrade mail-filter/spamassassin.Upgrade dev-lang/perl. | Oct 30, 2017 | Aug 2, 2016 |
| Huawei Euleros 2_0_sp2 | — | Upgrade perl-coreUpgrade perl-macrosUpgrade perl-develUpgrade perlUpgrade perl-libs | Dec 4, 2019 | Aug 2, 2016 |
| Huawei Euleros 2_0_sp3 | — | Upgrade perl-coreUpgrade perlUpgrade perl-macrosUpgrade perl-develUpgrade perl-libs | Dec 18, 2019 | Aug 2, 2016 |
| Huawei Euleros 2_0_sp5 | — | Upgrade perl-develUpgrade perl-macrosUpgrade perlUpgrade perl-coreUpgrade perl-libs | Nov 19, 2019 | Aug 2, 2016 |
| Oracle Solaris | — | Upgrade runtime/perl-584 to version 5.8.4-0.175.3.24.0.3.0 on Solaris 11.3Upgrade runtime/perl-522 to version 5.22.1-0.175.3.21.0.5.0 on Solaris 11.3Upgrade runtime/perl-512 to version 5.12.5-0.175.3.21.0.5.0 on Solaris 11.3Upgrade runtime/perl-threaded-512 to version 5.12.5-0.175.3.21.0.5.0 on Solaris 11.3Upgrade runtime/perl-584/extra to version 5.8.4-0.175.3.24.0.2.0 on Solaris 11.3Upgrade runtime/perl-common to version 1-0.175.3.21.0.5.0 on Solaris 11.3 | Jun 20, 2017 | Aug 2, 2016 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Jul 25, 2016 |
| Suse | — | Upgrade perl-MIME-CharsetUpgrade amavisd-newUpgrade perl-base-32bitUpgrade perl-baseUpgrade perlUpgrade perl-Archive-ExtractUpgrade perl-ExtUtils-MakeMakerUpgrade perl-mail-spamassassin-plugin-ixhash2Upgrade perl-32bitUpgrade spamassassinUpgrade amavisd-new-docsUpgrade sles12sp1-docker-imageUpgrade perl-mail-spamassassinUpgrade perl-Module-BuildUpgrade perl-x86Upgrade perl-Test-SimpleUpgrade perl-Module-Load-ConditionalUpgrade perl-docUpgrade sles12-docker-image | Sep 6, 2016 | Aug 2, 2016 |
| Ubuntu | — | Upgrade libsys-syslog-perl | Nov 19, 2024 | Aug 2, 2016 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Aug 2, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub