(1) cpan/Archive-Tar/bin/ptar, (2) cpan/Archive-Tar/bin/ptardiff, (3) cpan/Archive-Tar/bin/ptargrep, (4) cpan/CPAN/scripts/cpan, (5) cpan/Digest-SHA/shasum, (6) cpan/Encode/bin/enc2xs, (7) cpan/Encode/bin/encguess, (8) cpan/Encode/bin/piconv, (9) cpan/Encode/bin/ucmlint, (10) cpan/Encode/bin/unidump, (11) cpan/ExtUtils-MakeMaker/bin/instmodsh, (12) cpan/IO-Compress/bin/zipdetails, (13) cpan/JSON-PP/bin/json_pp, (14) cpan/Test-Harness/bin/prove, (15) dist/ExtUtils-ParseXS/lib/ExtUtils/xsubpp, (16) dist/Module-CoreList/corelist, (17) ext/Pod-Html/bin/pod2html, (18) utils/c2ph.PL, (19) utils/h2ph.PL, (20) utils/h2xs.PL, (21) utils/libnetcfg.PL, (22) utils/perlbug.PL, (23) utils/perldoc.PL, (24) utils/perlivp.PL, and (25) utils/splain.PL in Perl 5.x before 5.22.3-RC2 and 5.24 before 5.24.1-RC2 do not properly remove . (period) characters from the end of the includes directory array, which might allow local users to gain privileges via a Trojan horse module under the current working directory.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade spamassassinUpgrade perl | Oct 25, 2017 | Aug 2, 2016 |
| Debian | — | Upgrade libsys-syslog-perlUpgrade perl | Jul 26, 2016 | Jul 25, 2016 |
| Freebsd | — | Upgrade perl5.20Upgrade perlUpgrade perl5.22Upgrade perl5.24Upgrade perl5-develUpgrade perl5Upgrade spamassassinUpgrade perl5.18 | Nov 14, 2016 | Aug 4, 2016 |
| Gentoo Linux | — | Upgrade mail-filter/spamassassin.Upgrade dev-lang/perl. | Oct 30, 2017 | Aug 2, 2016 |
| Huawei Euleros 2_0_sp2 | — | Upgrade perl-libsUpgrade perl-develUpgrade perlUpgrade perl-macrosUpgrade perl-core | Dec 4, 2019 | Aug 2, 2016 |
| Huawei Euleros 2_0_sp3 | — | Upgrade perl-develUpgrade perl-libsUpgrade perl-macrosUpgrade perlUpgrade perl-core | Dec 18, 2019 | Aug 2, 2016 |
| Huawei Euleros 2_0_sp5 | — | Upgrade perl-libsUpgrade perlUpgrade perl-develUpgrade perl-coreUpgrade perl-macros | Nov 19, 2019 | Aug 2, 2016 |
| Oracle Solaris | — | Upgrade runtime/perl-threaded-512 to version 5.12.5-0.175.3.21.0.5.0 on Solaris 11.3Upgrade runtime/perl-584/extra to version 5.8.4-0.175.3.24.0.2.0 on Solaris 11.3Upgrade runtime/perl-common to version 1-0.175.3.21.0.5.0 on Solaris 11.3Upgrade runtime/perl-512 to version 5.12.5-0.175.3.21.0.5.0 on Solaris 11.3Upgrade runtime/perl-522 to version 5.22.1-0.175.3.21.0.5.0 on Solaris 11.3Upgrade runtime/perl-584 to version 5.8.4-0.175.3.24.0.3.0 on Solaris 11.3 | Jun 20, 2017 | Aug 2, 2016 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Jul 25, 2016 |
| Suse | — | Upgrade perl-MIME-CharsetUpgrade perl-Archive-ExtractUpgrade amavisd-newUpgrade perl-base-32bitUpgrade perl-baseUpgrade perl-ExtUtils-MakeMakerUpgrade perlUpgrade perl-Module-BuildUpgrade perl-Test-SimpleUpgrade amavisd-new-docsUpgrade perl-x86Upgrade perl-mail-spamassassin-plugin-ixhash2Upgrade sles12sp1-docker-imageUpgrade sles12-docker-imageUpgrade perl-mail-spamassassinUpgrade spamassassinUpgrade perl-32bitUpgrade perl-Module-Load-ConditionalUpgrade perl-doc | Sep 6, 2016 | Aug 2, 2016 |
| Ubuntu | — | Upgrade libsys-syslog-perl | Nov 19, 2024 | Aug 2, 2016 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Aug 2, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub