CVE-2016-1238 (1) cpan/Archive-Tar/bin/ptar, (2) cpan/Archive-Tar/bin/ptardiff, (3) cpan/Archive-Tar/bin/ptargrep, (4) cpan/CPAN/scripts/cpan, (5) cpan/Digest-SHA/shasum, (6) cpan/Encode/bin/enc2xs, (7) cpan/Encode...
HighCVSS 7.8
EPSS 0.78%
- Published
- Updated
- Exploit status
- No public exploit known
Description
(1) cpan/Archive-Tar/bin/ptar, (2) cpan/Archive-Tar/bin/ptardiff, (3) cpan/Archive-Tar/bin/ptargrep, (4) cpan/CPAN/scripts/cpan, (5) cpan/Digest-SHA/shasum, (6) cpan/Encode/bin/enc2xs, (7) cpan/Encode/bin/encguess, (8) cpan/Encode/bin/piconv, (9) cpan/Encode/bin/ucmlint, (10) cpan/Encode/bin/unidump, (11) cpan/ExtUtils-MakeMaker/bin/instmodsh, (12) cpan/IO-Compress/bin/zipdetails, (13) cpan/JSON-PP/bin/json_pp, (14) cpan/Test-Harness/bin/prove, (15) dist/ExtUtils-ParseXS/lib/ExtUtils/xsubpp, (16) dist/Module-CoreList/corelist, (17) ext/Pod-Html/bin/pod2html, (18) utils/c2ph.PL, (19) utils/h2ph.PL, (20) utils/h2xs.PL, (21) utils/libnetcfg.PL, (22) utils/perlbug.PL, (23) utils/perldoc.PL, (24) utils/perlivp.PL, and (25) utils/splain.PL in Perl 5.x before 5.22.3-RC2 and 5.24 before 5.24.1-RC2 do not properly remove . (period) characters from the end of the includes directory array, which might allow local users to gain privileges via a Trojan horse module under the current working directory.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/perl(Debian:12) | < 5.22.2-3 | 5.22.2-3 |
| debian/perl(Debian:13) | < 5.22.2-3 | 5.22.2-3 |
| debian/perl(Debian:14) | < 5.22.2-3 | 5.22.2-3 |
| debian linux | = 8.0 | No fix listed |
| fedoraproject fedora | = 23 | No fix listed |
| fedoraproject fedora | = 24 | No fix listed |
| perl | = 1.0.15 | No fix listed |
| perl | = 1.0.16 | No fix listed |
| perl | = 5.000 | No fix listed |
| perl | = 5.000o | No fix listed |
| perl | = 5.001 | No fix listed |
| perl | = 5.001n | No fix listed |
| perl | = 5.002 | No fix listed |
| perl | = 5.002_01 | No fix listed |
| perl | = 5.003 | No fix listed |
| perl | = 5.003_01 | No fix listed |
| perl | = 5.003_02 | No fix listed |
| perl | = 5.003_03 | No fix listed |
| perl | = 5.003_04 | No fix listed |
| perl | = 5.003_05 | No fix listed |
| perl | = 5.003_07 | No fix listed |
| perl | = 5.003_08 | No fix listed |
| perl | = 5.003_09 | No fix listed |
| perl | = 5.003_10 | No fix listed |
| perl | = 5.003_11 | No fix listed |
Show 175 more
| Product | Affected versions | Fixed in |
|---|---|---|
| perl | = 5.003_12 | No fix listed |
| perl | = 5.003_13 | No fix listed |
| perl | = 5.003_14 | No fix listed |
| perl | = 5.003_15 | No fix listed |
| perl | = 5.003_16 | No fix listed |
| perl | = 5.003_17 | No fix listed |
| perl | = 5.003_18 | No fix listed |
| perl | = 5.003_19 | No fix listed |
| perl | = 5.003_20 | No fix listed |
| perl | = 5.003_21 | No fix listed |
| perl | = 5.003_22 | No fix listed |
| perl | = 5.003_23 | No fix listed |
| perl | = 5.003_24 | No fix listed |
| perl | = 5.003_25 | No fix listed |
| perl | = 5.003_26 | No fix listed |
| perl | = 5.003_27 | No fix listed |
| perl | = 5.003_28 | No fix listed |
| perl | = 5.003_90 | No fix listed |
| perl | = 5.003_91 | No fix listed |
| perl | = 5.003_92 | No fix listed |
| perl | = 5.003_93 | No fix listed |
| perl | = 5.003_94 | No fix listed |
| perl | = 5.003_95 | No fix listed |
| perl | = 5.003_96 | No fix listed |
| perl | = 5.003_97 | No fix listed |
| perl | = 5.003_97a | No fix listed |
| perl | = 5.003_97b | No fix listed |
| perl | = 5.003_97c | No fix listed |
| perl | = 5.003_97d | No fix listed |
| perl | = 5.003_97e | No fix listed |
| perl | = 5.003_97f | No fix listed |
| perl | = 5.003_97g | No fix listed |
| perl | = 5.003_97h | No fix listed |
| perl | = 5.003_97i | No fix listed |
| perl | = 5.003_97j | No fix listed |
| perl | = 5.003_98 | No fix listed |
| perl | = 5.003_99 | No fix listed |
| perl | = 5.003_99a | No fix listed |
| perl | = 5.004 | No fix listed |
| perl | = 5.004_01 | No fix listed |
| perl | = 5.004_02 | No fix listed |
| perl | = 5.004_03 | No fix listed |
| perl | = 5.004_04 | No fix listed |
| perl | = 5.004_05 | No fix listed |
| perl | = 5.005 | No fix listed |
| perl | = 5.005_01 | No fix listed |
| perl | = 5.005_02 | No fix listed |
| perl | = 5.005_03 | No fix listed |
| perl | = 5.005_04 | No fix listed |
| perl | = 5.6 | No fix listed |
| perl | = 5.6.0 | No fix listed |
| perl | = 5.6.1 | No fix listed |
| perl | = 5.6.2 | No fix listed |
| perl | = 5.7.3 | No fix listed |
| perl | = 5.8 | No fix listed |
| perl | = 5.8.0 | No fix listed |
| perl | = 5.8.1 | No fix listed |
| perl | = 5.8.2 | No fix listed |
| perl | = 5.8.3 | No fix listed |
| perl | = 5.8.4 | No fix listed |
| perl | = 5.8.5 | No fix listed |
| perl | = 5.8.6 | No fix listed |
| perl | = 5.8.7 | No fix listed |
| perl | = 5.8.8 | No fix listed |
| perl | = 5.8.9 | No fix listed |
| perl | = 5.8.9-rc1 | No fix listed |
| perl | = 5.9.0 | No fix listed |
| perl | = 5.9.1 | No fix listed |
| perl | = 5.9.2 | No fix listed |
| perl | = 5.9.3 | No fix listed |
| perl | = 5.9.4 | No fix listed |
| perl | = 5.9.5 | No fix listed |
| perl | = 5.10 | No fix listed |
| perl | = 5.10.0 | No fix listed |
| perl | = 5.10.1 | No fix listed |
| perl | = 5.10.1-rc1 | No fix listed |
| perl | = 5.10.1-rc2 | No fix listed |
| perl | = 5.11.0 | No fix listed |
| perl | = 5.11.1 | No fix listed |
| perl | = 5.11.2 | No fix listed |
| perl | = 5.11.3 | No fix listed |
| perl | = 5.11.4 | No fix listed |
| perl | = 5.11.5 | No fix listed |
| perl | = 5.12.0 | No fix listed |
| perl | = 5.12.0-rc0 | No fix listed |
| perl | = 5.12.0-rc1 | No fix listed |
| perl | = 5.12.0-rc2 | No fix listed |
| perl | = 5.12.0-rc3 | No fix listed |
| perl | = 5.12.0-rc4 | No fix listed |
| perl | = 5.12.0-rc5 | No fix listed |
| perl | = 5.12.1 | No fix listed |
| perl | = 5.12.1-rc0 | No fix listed |
| perl | = 5.12.1-rc1 | No fix listed |
| perl | = 5.12.1-rc2 | No fix listed |
| perl | = 5.12.2 | No fix listed |
| perl | = 5.12.2-rc1 | No fix listed |
| perl | = 5.12.3 | No fix listed |
| perl | = 5.12.3-rc1 | No fix listed |
| perl | = 5.12.3-rc2 | No fix listed |
| perl | = 5.12.3-rc3 | No fix listed |
| perl | = 5.12.4 | No fix listed |
| perl | = 5.12.4-rc1 | No fix listed |
| perl | = 5.12.4-rc2 | No fix listed |
| perl | = 5.12.5 | No fix listed |
| perl | = 5.12.5-rc1 | No fix listed |
| perl | = 5.12.5-rc2 | No fix listed |
| perl | = 5.13.0 | No fix listed |
| perl | = 5.13.1 | No fix listed |
| perl | = 5.13.2 | No fix listed |
| perl | = 5.13.3 | No fix listed |
| perl | = 5.13.4 | No fix listed |
| perl | = 5.13.5 | No fix listed |
| perl | = 5.13.6 | No fix listed |
| perl | = 5.13.7 | No fix listed |
| perl | = 5.13.8 | No fix listed |
| perl | = 5.13.9 | No fix listed |
| perl | = 5.13.10 | No fix listed |
| perl | = 5.13.11 | No fix listed |
| perl | = 5.14.0 | No fix listed |
| perl | = 5.14.0-rc1 | No fix listed |
| perl | = 5.14.0-rc2 | No fix listed |
| perl | = 5.14.0-rc3 | No fix listed |
| perl | = 5.14.1 | No fix listed |
| perl | = 5.14.1-rc1 | No fix listed |
| perl | = 5.14.2 | No fix listed |
| perl | = 5.14.2-rc1 | No fix listed |
| perl | = 5.14.3 | No fix listed |
| perl | = 5.14.3-rc1 | No fix listed |
| perl | = 5.14.3-rc2 | No fix listed |
| perl | = 5.14.4 | No fix listed |
| perl | = 5.14.4-rc1 | No fix listed |
| perl | = 5.14.4-rc2 | No fix listed |
| perl | = 5.15.0 | No fix listed |
| perl | = 5.15.1 | No fix listed |
| perl | = 5.15.2 | No fix listed |
| perl | = 5.15.3 | No fix listed |
| perl | = 5.15.4 | No fix listed |
| perl | = 5.15.5 | No fix listed |
| perl | = 5.15.6 | No fix listed |
| perl | = 5.15.7 | No fix listed |
| perl | = 5.15.8 | No fix listed |
| perl | = 5.15.9 | No fix listed |
| perl | = 5.16.0 | No fix listed |
| perl | = 5.16.0-rc1 | No fix listed |
| perl | = 5.16.0-rc2 | No fix listed |
| perl | = 5.16.1 | No fix listed |
| perl | = 5.16.2 | No fix listed |
| perl | = 5.16.3 | No fix listed |
| perl | = 5.16.3-rc1 | No fix listed |
| perl | = 5.17.0 | No fix listed |
| perl | = 5.17.1 | No fix listed |
| perl | = 5.17.2 | No fix listed |
| perl | = 5.17.3 | No fix listed |
| perl | = 5.17.4 | No fix listed |
| perl | = 5.17.5 | No fix listed |
| perl | = 5.17.6 | No fix listed |
| perl | = 5.17.7 | No fix listed |
| perl | = 5.17.7.0 | No fix listed |
| perl | = 5.17.8 | No fix listed |
| perl | = 5.17.9 | No fix listed |
| perl | = 5.17.10 | No fix listed |
| perl | = 5.17.11 | No fix listed |
| perl | = 5.18.0 | No fix listed |
| perl | = 5.18.0-rc1 | No fix listed |
| perl | = 5.18.0-rc2 | No fix listed |
| perl | = 5.18.0-rc3 | No fix listed |
| perl | = 5.18.0-rc4 | No fix listed |
| perl | = 5.18.1 | No fix listed |
| perl | = 5.18.2 | No fix listed |
| perl | = 5.18.2-rc1 | No fix listed |
| perl | = 5.18.2-rc2 | No fix listed |
| perl | = 5.18.2-rc3 | No fix listed |
| perl | = 5.18.2-rc4 | No fix listed |
| perl | = 5.18.3 | No fix listed |
| perl | = 5.18.3-rc1 | No fix listed |
References
- Debian Security Tracker CVE-2016-1238 vendor-advisory
- openSUSE-SU-2019:1831 third-party-advisory vendor-advisory
- perl5.git.perl.org issue-tracking
- DSA-3628 third-party-advisory vendor-advisory
- [perl.perl5.porters] 20160725 CVE-2016-1238: Important unsafe module load path flaw mailing-list third-party-advisory
- 92136 third-party-advisory vdb-entry
- 1036440 third-party-advisory vdb-entry
- h20566.www2.hpe.com third-party-advisory
- [announce] 20180916 [SECURITY] Apache SpamAssassin 3.4.2 resolves CVE-2017-15705, CVE-2016-1238, CVE-2018-11780 & CVE-2018-11781 mailing-list
- [debian-lts-announce] 20181113 [SECURITY] [DLA 1578-1] spamassassin security update mailing-list third-party-advisory
- FEDORA-2016-e9e5c081d4 vendor-advisory
- FEDORA-2016-dd20a4631a vendor-advisory
- FEDORA-2016-6ec2009080 vendor-advisory
- rt.perl.org permissions-required
- GLSA-201701-75 third-party-advisory vendor-advisory
- GLSA-201812-07 third-party-advisory vendor-advisory
- security.alpinelinux.org vendor-advisory