CPANSA-Encode-2016-01: Encode vulnerability
| Publisher | giterlizzi | Document category | csaf_security_advisory |
|---|---|---|---|
| Initial release date | 2016-07-27T00:00:00 | Engine | CSAF Perl Toolkit 0.25 |
| Current release date | 2016-07-27T00:00:00 | Build Date | |
| Current version | 1 | Status | final |
| CVSS v3.1 Base Score | 7.8 | Severity | High |
| Original language | Language | en | |
| Also referred to | |||
Vulnerability Description
Loading optional modules from . (current directory).
Vulnerabilities
CVE-2016-1238
Vulnerability Description(1) cpan/Archive-Tar/bin/ptar, (2) cpan/Archive-Tar/bin/ptardiff, (3) cpan/Archive-Tar/bin/ptargrep, (4) cpan/CPAN/scripts/cpan, (5) cpan/Digest-SHA/shasum, (6) cpan/Encode/bin/enc2xs, (7) cpan/Encode/bin/encguess, (8) cpan/Encode/bin/piconv, (9) cpan/Encode/bin/ucmlint, (10) cpan/Encode/bin/unidump, (11) cpan/ExtUtils-MakeMaker/bin/instmodsh, (12) cpan/IO-Compress/bin/zipdetails, (13) cpan/JSON-PP/bin/json_pp, (14) cpan/Test-Harness/bin/prove, (15) dist/ExtUtils-ParseXS/lib/ExtUtils/xsubpp, (16) dist/Module-CoreList/corelist, (17) ext/Pod-Html/bin/pod2html, (18) utils/c2ph.PL, (19) utils/h2ph.PL, (20) utils/h2xs.PL, (21) utils/libnetcfg.PL, (22) utils/perlbug.PL, (23) utils/perldoc.PL, (24) utils/perlivp.PL, and (25) utils/splain.PL in Perl 5.x before 5.22.3-RC2 and 5.24 before 5.24.1-RC2 do not properly remove . (period) characters from the end of the includes directory array, which might allow local users to gain privileges via a Trojan horse module under the current working directory.
| Weakness | CWE-264 : Permissions, Privileges, and Access Controls |
|---|
Product status
Known affected
| Product | Score | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Encode less than 2.85 |
|
Fixed
- Encode greater than or equal 2.85
giterlizzi
Namespace: https://github.com/giterlizzi/
gdt@cpan.org
References
- CPANSA-Encode-2016-01 JSON self
https://raw.githubusercontent.com/giterlizzi/perl-CPANSA-CSAF/develop/csaf/white/2016/cpansa-encode-2016-01.json - https://metacpan.org/changes/distribution/Encode external
https://metacpan.org/changes/distribution/Encode - https://github.com/dankogai/p5-encode/pull/58/commits/12be15d64ce089154c4367dc1842cd0dc0993ec6 external
https://github.com/dankogai/p5-encode/pull/58/commits/12be15d64ce089154c4367dc1842cd0dc0993ec6 - CVE-2016-1238 (NVD) external
https://nvd.nist.gov/vuln/detail/CVE-2016-1238
Revision history
| Version | Date of the revision | Summary of the revision |
|---|---|---|
| 1 | Wed Jul 27 00:00:00 2016 | First release |
Sharing rules
TLP:WHITE
For the TLP version see: https://www.first.org/tlp/