CVE-2016-1238
At a glance
- Source
- NVD
- EPSS
- EPSS 0.78 % · percentile 56 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- debian
- NVD status
- Modified
Description
(1) cpan/Archive-Tar/bin/ptar, (2) cpan/Archive-Tar/bin/ptardiff, (3) cpan/Archive-Tar/bin/ptargrep, (4) cpan/CPAN/scripts/cpan, (5) cpan/Digest-SHA/shasum, (6) cpan/Encode/bin/enc2xs, (7) cpan/Encode/bin/encguess, (8) cpan/Encode/bin/piconv, (9) cpan/Encode/bin/ucmlint, (10) cpan/Encode/bin/unidump, (11) cpan/ExtUtils-MakeMaker/bin/instmodsh, (12) cpan/IO-Compress/bin/zipdetails, (13) cpan/JSON-PP/bin/json_pp, (14) cpan/Test-Harness/bin/prove, (15) dist/ExtUtils-ParseXS/lib/ExtUtils/xsubpp, (16) dist/Module-CoreList/corelist, (17) ext/Pod-Html/bin/pod2html, (18) utils/c2ph.PL, (19) utils/h2ph.PL, (20) utils/h2xs.PL, (21) utils/libnetcfg.PL, (22) utils/perlbug.PL, (23) utils/perldoc.PL, (24) utils/perlivp.PL, and (25) utils/splain.PL in Perl 5.x before 5.22.3-RC2 and 5.24 before 5.24.1-RC2 do not properly remove . (period) characters from the end of the includes directory array, which might allow local users to gain privileges via a Trojan horse module under the current working directory.
Weaknesses (CWE)
References
- https://security.gentoo.org/glsa/201701-75
- https://security.gentoo.org/glsa/201812-07
- http://perl5.git.perl.org/perl.git/commit/cee96d52c39b1e7b36e1c62d38bcd8d86e9a41ab
- http://www.securitytracker.com/id/1036440
- http://www.debian.org/security/2016/dsa-3628
- https://lists.apache.org/thread.html/7f6a16bc0fd0fd5e67c7fd95bd655069a2ac7d1f88e42d3c853e601c%40%3Cannounce.apache.org%3E
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TZBNQH3DMI7HDELJAZ4TFJJANHXOEDWH/
- http://www.nntp.perl.org/group/perl.perl5.porters/2016/07/msg238271.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2FBQOCV3GBAN2EYZUM3CFDJ4ECA3GZOK/
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05240731
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DOFRQWJRP2NQJEYEWOMECVW3HAMD5SYN/
- http://www.securityfocus.com/bid/92136
- https://lists.debian.org/debian-lts-announce/2018/11/msg00016.html
- https://rt.perl.org/Public/Bug/Display.html?id=127834
- http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00002.html
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | HIGH 7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | HIGH 7.2 | AV:L/AC:L/Au:N/C:C/I:C/A:C | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2016-2339
- GCVE · GCVE-0-2016-1238
CERT-FR advisories
- CERTFR-2022-AVI-650 — Multiples vulnérabilités dans les produits Juniper · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*cpe:2.3:o:fedoraproject:fedora:23:*:*:*:*:*:*:*cpe:2.3:o:fedoraproject:fedora:24:*:*:*:*:*:*:*cpe:2.3:a:perl:perl:1.0.15:*:*:*:*:*:*:*cpe:2.3:a:perl:perl:1.0.16:*:*:*:*:*:*:*cpe:2.3:a:perl:perl:5.000:*:*:*:*:*:*:*cpe:2.3:a:perl:perl:5.000o:*:*:*:*:*:*:*cpe:2.3:a:perl:perl:5.001:*:*:*:*:*:*:*cpe:2.3:a:perl:perl:5.001n:*:*:*:*:*:*:*cpe:2.3:a:perl:perl:5.002:*:*:*:*:*:*:*cpe:2.3:a:perl:perl:5.002_01:*:*:*:*:*:*:*cpe:2.3:a:perl:perl:5.003:*:*:*:*:*:*:*cpe:2.3:a:perl:perl:5.003_01:*:*:*:*:*:*:*cpe:2.3:a:perl:perl:5.003_02:*:*:*:*:*:*:*cpe:2.3:a:perl:perl:5.003_03:*:*:*:*:*:*:*cpe:2.3:a:perl:perl:5.003_04:*:*:*:*:*:*:*cpe:2.3:a:perl:perl:5.003_05:*:*:*:*:*:*:*cpe:2.3:a:perl:perl:5.003_07:*:*:*:*:*:*:*cpe:2.3:a:perl:perl:5.003_08:*:*:*:*:*:*:*cpe:2.3:a:perl:perl:5.003_09:*:*:*:*:*:*:*cpe:2.3:a:perl:perl:5.003_10:*:*:*:*:*:*:*cpe:2.3:a:perl:perl:5.003_11:*:*:*:*:*:*:*cpe:2.3:a:perl:perl:5.003_12:*:*:*:*:*:*:*cpe:2.3:a:perl:perl:5.003_13:*:*:*:*:*:*:*cpe:2.3:a:perl:perl:5.003_14:*:*:*:*:*:*:*cpe:2.3:a:perl:perl:5.003_15:*:*:*:*:*:*:*cpe:2.3:a:perl:perl:5.003_16:*:*:*:*:*:*:*cpe:2.3:a:perl:perl:5.003_17:*:*:*:*:*:*:*cpe:2.3:a:perl:perl:5.003_18:*:*:*:*:*:*:*cpe:2.3:a:perl:perl:5.003_19:*:*:*:*:*:*:*cpe:2.3:a:perl:perl:5.003_20:*:*:*:*:*:*:*cpe:2.3:a:perl:perl:5.003_21:*:*:*:*:*:*:*cpe:2.3:a:perl:perl:5.003_22:*:*:*:*:*:*:*cpe:2.3:a:perl:perl:5.003_23:*:*:*:*:*:*:*cpe:2.3:a:perl:perl:5.003_24:*:*:*:*:*:*:*cpe:2.3:a:perl:perl:5.003_25:*:*:*:*:*:*:*cpe:2.3:a:perl:perl:5.003_26:*:*:*:*:*:*:*cpe:2.3:a:perl:perl:5.003_27:*:*:*:*:*:*:*cpe:2.3:a:perl:perl:5.003_28:*:*:*:*:*:*:*cpe:2.3:a:perl:perl:5.003_90:*:*:*:*:*:*:*- +213 more
Affected products
| Product | Versions |
|---|---|
| affected n/a |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |