CVE-2017-1238

The CVE-2017-1238 entry concerns IBM Rational Quality Manager (RQM) versions 5.0.x and 6.0 up to 6.0.5, where the Web UI is vulnerable to cross-site scripting. The flaw allows embedding arbitrary JavaScript in the Web UI, potentially altering functionality and exposing credentials within a truste...

Security Bulletin: IBM Flex System Manager (FSM) is affected by multiple perl vulnerabilities (CVE-2016-1238, CVE-2016-2381, CVE-2015-8853)

Summary Multiple vulnerabilities have been identified in perl that is embedded in the IBM FSM. This fix addresses these vulnerabilities. Vulnerability Details CVEID: CVE-2016-1238 DESCRIPTION: Perl could allow a local attacker to gain elevated privileges on the system, caused by an error when...

Dell EMC ScaleIO Buffer Overflow / Command Injection Vulnerability

Dell EMC ScaleIO customers are encouraged to update to ScaleIO version 2.5, which contains fixes for multiple security vulnerabilities in earlier ScaleIO software versions that could potentially be exploited by malicious users to compromise the affected system. Dell EMC Identifier: DSA-2018-058 C...

CVE-2018-1238

Dell EMC ScaleIO prior to version 2.5 is affected by CVE-2018-1238 due to a command-injection flaw in the Light Installation Agent (LIA), which handles deployment management and uses shell commands. A remote attacker with network access to LIA and knowledge of the LIA administrative password coul...

Debian: Security Advisory (DLA-1238-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Updated perl packages fix security vulnerability

John Lightsey and Todd Rinaldo reported that the opportunistic loading of optional modules can make many programs unintentionally load code from the current working directory which might be changed to another directory without the user realising and potentially leading to privilege escalation...

Perl Privilege Escalation Vulnerability - Windows

Perl is prone to a privilege escalation vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:perl:perl"; ifdescription...

openSUSE Security Update : perl (openSUSE-2016-1086)

This update for Perl fixes the following issues : - CVE-2016-6185: Xsloader looking at a 'eval' directory. bsc988311 - CVE-2016-1238: Searching current directory for optional modules. bsc987887 - CVE-2015-8853: Regular expression engine hanging on bad utf8. bsc - CVE-2016-2381: Environment dup...

SUSE SLED12 / SLES12 Security Update : perl (SUSE-SU-2016:2263-1)

This update for Perl fixes the following issues : - CVE-2016-6185: Xsloader looking at a 'eval' directory. bsc988311 - CVE-2016-1238: Searching current directory for optional modules. bsc987887 - CVE-2015-8853: Regular expression engine hanging on bad utf8. bsc - CVE-2016-2381: Environment dup...

SUSE SLES11 Security Update : perl (SUSE-SU-2016:2246-1)

This update for perl fixes the following issues : - CVE-2016-6185: xsloader looking at a 'eval' directory bsc988311 - CVE-2016-1238: searching current directory for optional modules bsc987887 - CVE-2015-8853: regex engine hanging on bad utf8 bnc976584 - CVE-2016-2381: environment dup handling bug...

Fedora 23 : 4:perl (2016-6ec2009080)

Security fix for CVE-2016-1238 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEVEL 70300...

Fedora 23 : perl-Module-Load-Conditional (2016-0aa251bc9b)

This update adds an option 'FORCESAFEINC', which, if set it isn't by default, removes the current directory from the module load path so as to avoid loading code from a potentially unsafe place CVE-2016-1238. Note that Tenable Network Security has extracted the preceding description block directl...

Fedora Update for perl-Module-Load-Conditional FEDORA-2016-0aa251bc9b

The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora 24 : perl-Module-Load-Conditional (2016-dd20a4631a)

This update adds an option 'FORCESAFEINC', which, if set it isn't by default, removes the current directory from the module load path so as to avoid loading code from a potentially unsafe place CVE-2016-1238. Note that Tenable Network Security has extracted the preceding description block directl...

FreeBSD : perl -- local arbitrary code execution (72bfbb09-5a6a-11e6-a6c3-14dae9d210b8)

Sawyer X reports : Perl 5.x before 5.22.3-RC2 and 5.24 before 5.24.1-RC2 do not properly remove . period characters from the end of the includes directory array, which might allow local users to gain privileges via a Trojan horse module under the current working directory. %NASLMINLEVEL 70300 C...

[SECURITY] [DLA 584-1] libsys-syslog-perl security update

Package : libsys-syslog-perl Version : 0.29-1+deb7u1 CVE ID : CVE-2016-1238 John Lightsey and Todd Rinaldo reported that the opportunistic loading of optional modules can make many programs unintentionally load code from the current working directory which might be changed to another directory...

CVE-2016-1238

1 cpan/Archive-Tar/bin/ptar, 2 cpan/Archive-Tar/bin/ptardiff, 3 cpan/Archive-Tar/bin/ptargrep, 4 cpan/CPAN/scripts/cpan, 5 cpan/Digest-SHA/shasum, 6 cpan/Encode/bin/enc2xs, 7 cpan/Encode/bin/encguess, 8 cpan/Encode/bin/piconv, 9 cpan/Encode/bin/ucmlint, 10 cpan/Encode/bin/unidump, 11...

CVE-2016-1238

1 cpan/Archive-Tar/bin/ptar, 2 cpan/Archive-Tar/bin/ptardiff, 3 cpan/Archive-Tar/bin/ptargrep, 4 cpan/CPAN/scripts/cpan, 5 cpan/Digest-SHA/shasum, 6 cpan/Encode/bin/enc2xs, 7 cpan/Encode/bin/encguess, 8 cpan/Encode/bin/piconv, 9 cpan/Encode/bin/ucmlint, 10 cpan/Encode/bin/unidump, 11...

CVE-2016-1238

1 cpan/Archive-Tar/bin/ptar, 2 cpan/Archive-Tar/bin/ptardiff, 3 cpan/Archive-Tar/bin/ptargrep, 4 cpan/CPAN/scripts/cpan, 5 cpan/Digest-SHA/shasum, 6 cpan/Encode/bin/enc2xs, 7 cpan/Encode/bin/encguess, 8 cpan/Encode/bin/piconv, 9 cpan/Encode/bin/ucmlint, 10 cpan/Encode/bin/unidump, 11...

CVE-2016-1238

CVE-2016-1238 affects SpamAssassin (Debian advisory DLA-1578-1). The issue arises when Perl programs do not properly remove trailing periods from the includes directory array, which can allow a local attacker to load a Trojan horse module from the current working directory and gain privileges. De...