CVE-2016-1238
Description
(1) cpan/Archive-Tar/bin/ptar, (2) cpan/Archive-Tar/bin/ptardiff, (3) cpan/Archive-Tar/bin/ptargrep, (4) cpan/CPAN/scripts/cpan, (5) cpan/Digest-SHA/shasum, (6) cpan/Encode/bin/enc2xs, (7) cpan/Encode/bin/encguess, (8) cpan/Encode/bin/piconv, (9) cpan/Encode/bin/ucmlint, (10) cpan/Encode/bin/unidump, (11) cpan/ExtUtils-MakeMaker/bin/instmodsh, (12) cpan/IO-Compress/bin/zipdetails, (13) cpan/JSON-PP/bin/json_pp, (14) cpan/Test-Harness/bin/prove, (15) dist/ExtUtils-ParseXS/lib/ExtUtils/xsubpp, (16) dist/Module-CoreList/corelist, (17) ext/Pod-Html/bin/pod2html, (18) utils/c2ph.PL, (19) utils/h2ph.PL, (20) utils/h2xs.PL, (21) utils/libnetcfg.PL, (22) utils/perlbug.PL, (23) utils/perldoc.PL, (24) utils/perlivp.PL, and (25) utils/splain.PL in Perl 5.x before 5.22.3-RC2 and 5.24 before 5.24.1-RC2 do not properly remove . (period) characters from the end of the includes directory array, which might allow local users to gain privileges via a Trojan horse module under the current working directory.
How to fix
- security.gentoo.org/glsa/201701-75
- security.gentoo.org/glsa/201812-07
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TZBNQH3DMI7HDELJAZ4TFJJANHXOEDWH/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2FBQOCV3GBAN2EYZUM3CFDJ4ECA3GZOK/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DOFRQWJRP2NQJEYEWOMECVW3HAMD5SYN/
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| perl perl | 1.0.15, 1.0.16, 5.000, 5.000o, 5.001, 5.001n, 5.002, 5.002_01, 5.003, 5.003_01, 5.003_02, 5.003_03, 5.003_04, 5.003_05, 5.003_07, 5.003_08, 5.003_09, 5.003_10, 5.003_11, 5.003_12, 5.003_13, 5.003_14, 5.003_15, 5.003_16, 5.003_17, 5.003_18, 5.003_19, 5.003_20, 5.003_21, 5.003_22, 5.003_23, 5.003_24, 5.003_25, 5.003_26, 5.003_27, 5.003_28, 5.003_90, 5.003_91, 5.003_92, 5.003_93, 5.003_94, 5.003_95, 5.003_96, 5.003_97, 5.003_97a, 5.003_97b, 5.003_97c, 5.003_97d, 5.003_97e, 5.003_97f, 5.003_97g, 5.003_97h, 5.003_97i, 5.003_97j, 5.003_98, 5.003_99, 5.003_99a, 5.004, 5.004_01, 5.004_02, 5.004_03, 5.004_04, 5.004_05, 5.005, 5.005_01, 5.005_02, 5.005_03, 5.005_04, 5.6, 5.6.0, 5.6.1, 5.6.2, 5.7.3, 5.8, 5.8.0, 5.8.1, 5.8.2, 5.8.3, 5.8.4, 5.8.5, 5.8.6, 5.8.7, 5.8.8, 5.8.9, 5.9.0, 5.9.1, 5.9.2, 5.9.3, 5.9.4, 5.9.5, 5.10, 5.10.0, 5.10.1, 5.11.0, 5.11.1, 5.11.2, 5.11.3, 5.11.4, 5.11.5, 5.12.0, 5.12.1, 5.12.2, 5.12.3, 5.12.4, 5.12.5, 5.13.0, 5.13.1, 5.13.2, 5.13.3, 5.13.4, 5.13.5, 5.13.6, 5.13.7, 5.13.8, 5.13.9, 5.13.10, 5.13.11, 5.14.0, 5.14.1, 5.14.2, 5.14.3, 5.14.4, 5.15.0, 5.15.1, 5.15.2, 5.15.3, 5.15.4, 5.15.5, 5.15.6, 5.15.7, 5.15.8, 5.15.9, 5.16.0, 5.16.1, 5.16.2, 5.16.3, 5.17.0, 5.17.1, 5.17.2, 5.17.3, 5.17.4, 5.17.5, 5.17.6, 5.17.7, 5.17.7.0, 5.17.8, 5.17.9, 5.17.10, 5.17.11, 5.18.0, 5.18.1, 5.18.2, 5.18.3, 5.18.4, 5.19.0 | — |
| debian debian_linux | 8.0 | — |
| fedoraproject fedora | 23, 24 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.