CVE-2016-1238

2016-07-2500:00:00

ubuntu.com

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

7.2 High

CVSS2

Access Vector

LOCAL

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

0.0004 Low

EPSS

Percentile

14.3%

JSON

(1) cpan/Archive-Tar/bin/ptar, (2) cpan/Archive-Tar/bin/ptardiff, (3)
cpan/Archive-Tar/bin/ptargrep, (4) cpan/CPAN/scripts/cpan, (5)
cpan/Digest-SHA/shasum, (6) cpan/Encode/bin/enc2xs, (7)
cpan/Encode/bin/encguess, (8) cpan/Encode/bin/piconv, (9)
cpan/Encode/bin/ucmlint, (10) cpan/Encode/bin/unidump, (11)
cpan/ExtUtils-MakeMaker/bin/instmodsh, (12)
cpan/IO-Compress/bin/zipdetails, (13) cpan/JSON-PP/bin/json_pp, (14)
cpan/Test-Harness/bin/prove, (15)
dist/ExtUtils-ParseXS/lib/ExtUtils/xsubpp, (16)
dist/Module-CoreList/corelist, (17) ext/Pod-Html/bin/pod2html, (18)
utils/c2ph.PL, (19) utils/h2ph.PL, (20) utils/h2xs.PL, (21)
utils/libnetcfg.PL, (22) utils/perlbug.PL, (23) utils/perldoc.PL, (24)
utils/perlivp.PL, and (25) utils/splain.PL in Perl 5.x before 5.22.3-RC2
and 5.24 before 5.24.1-RC2 do not properly remove . (period) characters
from the end of the includes directory array, which might allow local users
to gain privileges via a Trojan horse module under the current working
directory.

Bugs

<https://bugs.launchpad.net/ubuntu/+source/perl/+bug/1705145>

Notes

Author	Note
mdeslaur	the fix for this issue changes default behaviour and will possibly break existing installations and scripts. Furthermore, other packages in the archive need to be changed to work with the new behaviour, see the Debian advisory for more info: https://www.debian.org/security/2016/dsa-3628 Due to the change in behaviour, we will not be fixing this issue in perl in Ubuntu 12.04 LTS, Ubuntu 14.04 LTS and Ubuntu 16.04 LTS.

Author

Note

mdeslaur

the fix for this issue changes default behaviour and will possibly break existing installations and scripts. Furthermore, other packages in the archive need to be changed to work with the new behaviour, see the Debian advisory for more info: https://www.debian.org/security/2016/dsa-3628 Due to the change in behaviour, we will not be fixing this issue in perl in Ubuntu 12.04 LTS, Ubuntu 14.04 LTS and Ubuntu 16.04 LTS.

OSVersionArchitecturePackageVersionFilename
ubuntu12.04noarchlibsys-syslog-perl< 0.29-1+deb7u1build0.12.04.1UNKNOWN
ubuntu14.04noarchlibsys-syslog-perl< 0.33-1+deb8u1build0.14.04.1UNKNOWN