CVE-2017-6512

CVE-2017-6512 affects the Perl File-Path module prior to 2.13. A race condition in the rmtree and remove_tree functions can let an attacker loosen directory permissions to set the mode on arbitrary files. Impact is limited to permission changes on targeted files; no direct data-exfiltration vecto...

CVE-2017-6512

Race condition in the rmtree and removetree functions in the File-Path module before 2.13 for Perl allows attackers to set the mode on arbitrary files via vectors involving directory-permission loosening logic...

CVE-2017-6512

Race condition in the rmtree and removetree functions in the File-Path module before 2.13 for Perl allows attackers to set the mode on arbitrary files via vectors involving directory-permission loosening logic...

UBUNTU-CVE-2017-6512

Race condition in the rmtree and removetree functions in the File-Path module before 2.13 for Perl allows attackers to set the mode on arbitrary files via vectors involving directory-permission loosening logic...

suidperl Privilege Escalation (PROCSUID)

The suidperl application is installed on the remote host. It is, therefore, affected by a privilege escalation vulnerability that allows a local attacker to gain root privileges. PROCSUID is one of multiple Equation Group vulnerabilities and exploits disclosed on 2017/04/08 by a group known as th...

Internet Bug Bounty: heap-buffer-overflow (READ of size 61) in Perl_re_intuit_start()

Reported to the Perl security mailing list on 25 August 2016. ==17057==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60800000b978 at pc 0x0000004a9201 bp 0x7ffe97551890 sp 0x7ffe97551048 READ of size 61 at 0x60800000b978 thread T0 0 0x4a9200 in interceptormemcmp...

Updated perl-Image-Info packages fix security vulnerability

A crafted SVG file could have caused information disclosure or denial of service by using external entitity expansion XXE. This is a potentially incompatible change; however usually SVG files do not rely on XXE CVE-2016-9181...

Updated perl-CGI-Emulate-PSGI packages fix security vulnerability

This update removes the setting of the HTTPPROXY environment value. This works around the httproxy vulnerability aka CVE-2016-5387...

MGASA-2017-0146 Updated perl-CGI-Emulate-PSGI packages fix security vulnerability

This update removes the setting of the HTTPPROXY environment value. This works around the httproxy vulnerability aka CVE-2016-5387...

Internet Bug Bounty: heap-buffer-overflow (READ of size 11) in Perl 5.25.x

This issue was first reported to the Perl security mailing list on 19 August 2016. It was inadvertently made public in another bug report on 23 August 2016. It was finally marked fixed around 23 January 2017. Original bug report: perl -e 'v300&O|0' triggers a heap-buffer-overflow in Perlmyatof2...

Config-Model Local Elevation of Privilege Vulnerability

Config-Model aka libconfig-model-perl is an open source tool for validating, migrating or editing configuration files, which can support a variety of user interfaces such as graphical and interactive commands. A security vulnerability exists in the lib/Config/Model.pm file in versions of...

DEBIAN-CVE-2017-0373

The genclasspod implementation in lib/Config/Model/Utils/GenClassPod.pm in Config-Model aka libconfig-model-perl before 2.102 has a dangerous "use lib" line, which allows remote attackers to have an unspecified impact via a crafted Debian package file...

CVE-2017-0374

lib/Config/Model.pm in Config-Model aka libconfig-model-perl before 2.102 allows local users to gain privileges via a crafted model in the current working directory, related to use of . with the INC array...

CVE-2017-0373

The genclasspod implementation in lib/Config/Model/Utils/GenClassPod.pm in Config-Model aka libconfig-model-perl before 2.102 has a dangerous "use lib" line, which allows remote attackers to have an unspecified impact via a crafted Debian package file...

CVE-2017-0373

The genclasspod implementation in lib/Config/Model/Utils/GenClassPod.pm in Config-Model aka libconfig-model-perl before 2.102 has a dangerous "use lib" line, which allows remote attackers to have an unspecified impact via a crafted Debian package file...

UBUNTU-CVE-2017-0373

The genclasspod implementation in lib/Config/Model/Utils/GenClassPod.pm in Config-Model aka libconfig-model-perl before 2.102 has a dangerous "use lib" line, which allows remote attackers to have an unspecified impact via a crafted Debian package file...

DEBIAN-CVE-2017-0374

lib/Config/Model.pm in Config-Model aka libconfig-model-perl before 2.102 allows local users to gain privileges via a crafted model in the current working directory, related to use of . with the INC array...

CVE-2017-0373

Config-Model (libconfig-model-perl) before 2.102 contains a dangerous "use lib" line in GenClassPod.pm that could let remote attackers influence the system via a crafted Debian package. This CVE-2017-0373 detail is consistently described across multiple feeds (NVD, CNVD, OSV, Ubuntu, Debian OSV, ...

CVE-2017-0374

Affected software/component: libconfig-model-perl (Config-Model) – the file lib/Config/Model.pm. Vulnerability: in versions before 2.102, a crafted model in the current working directory can cause local privilege elevation via the INC path mechanism (use of “.” with INC). Impact: local users can ...

CVE-2017-0373

The genclasspod implementation in lib/Config/Model/Utils/GenClassPod.pm in Config-Model aka libconfig-model-perl before 2.102 has a dangerous "use lib" line, which allows remote attackers to have an unspecified impact via a crafted Debian package file...