(1) cpan/Archive-Tar/bin/ptar, (2) cpan/Archive-Tar/bin/ptardiff, (3) cpan/Archive-Tar/bin/ptargrep, (4) cpan/CPAN/scripts/cpan, (5) cpan/Digest-SHA/shasum, (6) cpan/Encode/bin/enc2xs, (7) cpan/Encode/bin/encguess, (8) cpan/Encode/bin/piconv, (9) cpan/Encode/bin/ucmlint, (10) cpan/Encode/bin/unidump, (11) cpan/ExtUtils-MakeMaker/bin/instmodsh, (12) cpan/IO-Compress/bin/zipdetails, (13) cpan/JSON-PP/bin/json_pp, (14) cpan/Test-Harness/bin/prove, (15) dist/ExtUtils-ParseXS/lib/ExtUtils/xsubpp, (16) dist/Module-CoreList/corelist, (17) ext/Pod-Html/bin/pod2html, (18) utils/c2ph.PL, (19) utils/h2ph.PL, (20) utils/h2xs.PL, (21) utils/libnetcfg.PL, (22) utils/perlbug.PL, (23) utils/perldoc.PL, (24) utils/perlivp.PL, and (25) utils/splain.PL in Perl 5.x before 5.22.3-RC2 and 5.24 before 5.24.1-RC2 do not properly remove . (period) characters from the end of the includes directory array, which might allow local users to gain privileges via a Trojan horse module under the current working directory.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade spamassassinUpgrade perl | Oct 25, 2017 | Aug 2, 2016 |
| Debian | — | Upgrade perlUpgrade libsys-syslog-perl | Jul 26, 2016 | Jul 25, 2016 |
| Freebsd | — | Upgrade perlUpgrade perl5.20Upgrade perl5.18Upgrade spamassassinUpgrade perl5Upgrade perl5-develUpgrade perl5.22Upgrade perl5.24 | Nov 14, 2016 | Aug 4, 2016 |
| Gentoo Linux | — | Upgrade dev-lang/perl.Upgrade mail-filter/spamassassin. | Oct 30, 2017 | Aug 2, 2016 |
| Huawei Euleros 2_0_sp2 | — | Upgrade perlUpgrade perl-develUpgrade perl-libsUpgrade perl-macrosUpgrade perl-core | Dec 4, 2019 | Aug 2, 2016 |
| Huawei Euleros 2_0_sp3 | — | Upgrade perlUpgrade perl-coreUpgrade perl-macrosUpgrade perl-develUpgrade perl-libs | Dec 18, 2019 | Aug 2, 2016 |
| Huawei Euleros 2_0_sp5 | — | Upgrade perl-develUpgrade perl-macrosUpgrade perl-coreUpgrade perl-libsUpgrade perl | Nov 19, 2019 | Aug 2, 2016 |
| Oracle Solaris | — | Upgrade runtime/perl-common to version 1-0.175.3.21.0.5.0 on Solaris 11.3Upgrade runtime/perl-threaded-512 to version 5.12.5-0.175.3.21.0.5.0 on Solaris 11.3Upgrade runtime/perl-584/extra to version 5.8.4-0.175.3.24.0.2.0 on Solaris 11.3Upgrade runtime/perl-522 to version 5.22.1-0.175.3.21.0.5.0 on Solaris 11.3Upgrade runtime/perl-512 to version 5.12.5-0.175.3.21.0.5.0 on Solaris 11.3Upgrade runtime/perl-584 to version 5.8.4-0.175.3.24.0.3.0 on Solaris 11.3 | Jun 20, 2017 | Aug 2, 2016 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Jul 25, 2016 |
| Suse | — | Upgrade sles12sp1-docker-imageUpgrade perl-mail-spamassassin-plugin-ixhash2Upgrade sles12-docker-imageUpgrade amavisd-new-docsUpgrade perl-x86Upgrade perl-32bitUpgrade perl-Test-SimpleUpgrade perl-docUpgrade perl-Module-Load-ConditionalUpgrade spamassassinUpgrade perl-Module-BuildUpgrade perl-mail-spamassassinUpgrade perl-ExtUtils-MakeMakerUpgrade perl-Archive-ExtractUpgrade perl-base-32bitUpgrade perlUpgrade amavisd-newUpgrade perl-baseUpgrade perl-MIME-Charset | Sep 6, 2016 | Aug 2, 2016 |
| Ubuntu | — | Upgrade libsys-syslog-perl | Nov 19, 2024 | Aug 2, 2016 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Aug 2, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub