Veracode Vulnerability DatabaseVERACODE:25368Arbitrary Code Execution
7.8 High
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
7.2 High
CVSS2
Access Vector
LOCAL
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:L/AC:L/Au:N/C:C/I:C/A:C
perl is vulnerable to arbitrary code execution. The vulnerability exists as it does not properly remove . (period) characters from the end of the includes directory array, which might allow local users to gain privileges via a Trojan horse module under the current working directory.
References
perl5.git.perl.org/perl.git/commit/cee96d52c39b1e7b36e1c62d38bcd8d86e9a41ab
www.debian.org/security/2016/dsa-3628
www.nntp.perl.org/group/perl.perl5.porters/2016/07/msg238271.html
www.securityfocus.com/bid/92136
www.securitytracker.com/id/1036440
h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05240731
lists.apache.org/thread.html/7f6a16bc0fd0fd5e67c7fd95bd655069a2ac7d1f88e42d3c853e601c@%3Cannounce.apache.org%3E
lists.debian.org/debian-lts-announce/2018/11/msg00016.html
lists.fedoraproject.org/archives/list/[email protected]/message/2FBQOCV3GBAN2EYZUM3CFDJ4ECA3GZOK/
lists.fedoraproject.org/archives/list/[email protected]/message/DOFRQWJRP2NQJEYEWOMECVW3HAMD5SYN/
lists.fedoraproject.org/archives/list/[email protected]/message/TZBNQH3DMI7HDELJAZ4TFJJANHXOEDWH/
rt.perl.org/Public/Bug/Display.html?id=127834
security.gentoo.org/glsa/201701-75
security.gentoo.org/glsa/201812-07
Related
7.8 High
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
7.2 High
CVSS2
Access Vector
LOCAL
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:L/AC:L/Au:N/C:C/I:C/A:C