CVE-2016-2381 Perl might allow context-dependent attackers to bypass the taint protection mechanism in a child process via duplicate environment variables in envp.
HighCVSS 7.5
EPSS 9.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Perl might allow context-dependent attackers to bypass the taint protection mechanism in a child process via duplicate environment variables in envp.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/perl(Debian:12) | < 5.22.1-8 | 5.22.1-8 |
| debian/perl(Debian:13) | < 5.22.1-8 | 5.22.1-8 |
| debian/perl(Debian:14) | < 5.22.1-8 | 5.22.1-8 |
| perl | < 5.23.9 | 5.23.9 |
| debian linux | = 7.0 | No fix listed |
| debian linux | = 8.0 | No fix listed |
| oracle communications billing and revenue management | = 7.5 | No fix listed |
| oracle configuration manager | < 12.1.2.0.4 | 12.1.2.0.4 |
| oracle configuration manager | = 12.1.2.0.6 | No fix listed |
| oracle database server | = 11.2.0.4 | No fix listed |
| oracle database server | = 12.1.0.2 | No fix listed |
| oracle database server | = 12.2.0.1 | No fix listed |
| oracle database server | = 18c | No fix listed |
| oracle database server | = 19c | No fix listed |
| oracle enterprise manager base platform | = 13.2.0.0.0 | No fix listed |
| oracle enterprise manager base platform | = 13.3.0.0.0 | No fix listed |
| oracle timesten in-memory database | < 18.1.2.1.0 | 18.1.2.1.0 |
| oracle solaris | = 11.3 | No fix listed |
| opensuse | = 13.2 | No fix listed |
| Canonical Ubuntu Linux | = 12.04 | No fix listed |
| Canonical Ubuntu Linux | = 14.04 | No fix listed |
| Canonical Ubuntu Linux | = 15.10 | No fix listed |
References
- Debian Security Tracker CVE-2016-2381 vendor-advisory
- openSUSE-SU-2016:0881 mailing-list third-party-advisory vendor-advisory
- perl5.git.perl.org vendor-advisory
- DSA-3501 third-party-advisory vendor-advisory
- [porters] 20160301 CVE-2016-2381: duplicate environment variables mailing-list third-party-advisory
- www.oracle.com third-party-advisory
- www.oracle.com third-party-advisory
- www.oracle.com third-party-advisory
- 83802 third-party-advisory vdb-entry
- USN-2916-1 third-party-advisory vendor-advisory
- h20566.www2.hpe.com third-party-advisory
- GLSA-201701-75 third-party-advisory vendor-advisory
- www.oracle.com third-party-advisory
- www.oracle.com third-party-advisory