(1) cpan/Archive-Tar/bin/ptar, (2) cpan/Archive-Tar/bin/ptardiff, (3) cpan/Archive-Tar/bin/ptargrep, (4) cpan/CPAN/scripts/cpan, (5) cpan/Digest-SHA/shasum, (6) cpan/Encode/bin/enc2xs, (7) cpan/Encode/bin/encguess, (8) cpan/Encode/bin/piconv, (9) cpan/Encode/bin/ucmlint, (10) cpan/Encode/bin/unidump, (11) cpan/ExtUtils-MakeMaker/bin/instmodsh, (12) cpan/IO-Compress/bin/zipdetails, (13) cpan/JSON-PP/bin/json_pp, (14) cpan/Test-Harness/bin/prove, (15) dist/ExtUtils-ParseXS/lib/ExtUtils/xsubpp, (16) dist/Module-CoreList/corelist, (17) ext/Pod-Html/bin/pod2html, (18) utils/c2ph.PL, (19) utils/h2ph.PL, (20) utils/h2xs.PL, (21) utils/libnetcfg.PL, (22) utils/perlbug.PL, (23) utils/perldoc.PL, (24) utils/perlivp.PL, and (25) utils/splain.PL in Perl 5.x before 5.22.3-RC2 and 5.24 before 5.24.1-RC2 do not properly remove . (period) characters from the end of the includes directory array, which might allow local users to gain privileges via a Trojan horse module under the current working directory.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade perlUpgrade spamassassin | Oct 25, 2017 | Aug 2, 2016 |
| Debian | — | Upgrade libsys-syslog-perlUpgrade perl | Jul 26, 2016 | Jul 25, 2016 |
| Freebsd | — | Upgrade perl5.20Upgrade perlUpgrade spamassassinUpgrade perl5-develUpgrade perl5.22Upgrade perl5.24Upgrade perl5.18Upgrade perl5 | Nov 14, 2016 | Aug 4, 2016 |
| Gentoo Linux | — | Upgrade mail-filter/spamassassin.Upgrade dev-lang/perl. | Oct 30, 2017 | Aug 2, 2016 |
| Huawei Euleros 2_0_sp2 | — | Upgrade perl-macrosUpgrade perl-coreUpgrade perl-develUpgrade perl-libsUpgrade perl | Dec 4, 2019 | Aug 2, 2016 |
| Huawei Euleros 2_0_sp3 | — | Upgrade perl-develUpgrade perl-libsUpgrade perl-coreUpgrade perlUpgrade perl-macros | Dec 18, 2019 | Aug 2, 2016 |
| Huawei Euleros 2_0_sp5 | — | Upgrade perl-macrosUpgrade perl-coreUpgrade perl-develUpgrade perlUpgrade perl-libs | Nov 19, 2019 | Aug 2, 2016 |
| Oracle Solaris | — | Upgrade runtime/perl-522 to version 5.22.1-0.175.3.21.0.5.0 on Solaris 11.3Upgrade runtime/perl-512 to version 5.12.5-0.175.3.21.0.5.0 on Solaris 11.3Upgrade runtime/perl-584 to version 5.8.4-0.175.3.24.0.3.0 on Solaris 11.3Upgrade runtime/perl-common to version 1-0.175.3.21.0.5.0 on Solaris 11.3Upgrade runtime/perl-584/extra to version 5.8.4-0.175.3.24.0.2.0 on Solaris 11.3Upgrade runtime/perl-threaded-512 to version 5.12.5-0.175.3.21.0.5.0 on Solaris 11.3 | Jun 20, 2017 | Aug 2, 2016 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Jul 25, 2016 |
| Suse | — | Upgrade perl-baseUpgrade perl-Archive-ExtractUpgrade perlUpgrade perl-ExtUtils-MakeMakerUpgrade perl-MIME-CharsetUpgrade perl-base-32bitUpgrade amavisd-newUpgrade perl-Test-SimpleUpgrade perl-Module-Load-ConditionalUpgrade perl-mail-spamassassin-plugin-ixhash2Upgrade perl-docUpgrade perl-32bitUpgrade perl-x86Upgrade sles12-docker-imageUpgrade perl-Module-BuildUpgrade amavisd-new-docsUpgrade sles12sp1-docker-imageUpgrade perl-mail-spamassassinUpgrade spamassassin | Sep 6, 2016 | Aug 2, 2016 |
| Ubuntu | — | Upgrade libsys-syslog-perl | Nov 19, 2024 | Aug 2, 2016 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Aug 2, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub