Vulnerability Description
The XSLoader::load method in XSLoader in Perl does not properly locate .so files when called in a string eval, which might allow local users to execute arbitrary code via a Trojan horse library under the current working directory.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Perl | Perl | >= 5.23.0, < 5.24.1 |
| Fedoraproject | Fedora | 22 |
| Debian | Debian Linux | 8.0 |
| Oracle | Solaris | 10 |
| Canonical | Ubuntu Linux | 12.04 |
References
- http://perl5.git.perl.org/perl.git/commitdiff/08e3451d7Issue TrackingVendor Advisory
- http://www.debian.org/security/2016/dsa-3628Third Party Advisory
- http://www.openwall.com/lists/oss-security/2016/07/07/1Mailing ListThird Party Advisory
- http://www.openwall.com/lists/oss-security/2016/07/08/5Mailing ListThird Party Advisory
- http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.htmlThird Party Advisory
- http://www.securityfocus.com/bid/91685Third Party AdvisoryVDB Entry
- http://www.securitytracker.com/id/1036260Third Party AdvisoryVDB Entry
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://rt.cpan.org/Public/Bug/Display.html?id=115808ExploitIssue TrackingPatch
- https://security.gentoo.org/glsa/201701-75Third Party Advisory
- https://usn.ubuntu.com/3625-1/Third Party Advisory
- https://usn.ubuntu.com/3625-2/Third Party Advisory
- http://perl5.git.perl.org/perl.git/commitdiff/08e3451d7Issue TrackingVendor Advisory
FAQ
What is CVE-2016-6185?
CVE-2016-6185 is a vulnerability with a CVSS score of 7.8 (HIGH). The XSLoader::load method in XSLoader in Perl does not properly locate .so files when called in a string eval, which might allow local users to execute arbitrary code via a Trojan horse library under ...
How severe is CVE-2016-6185?
CVE-2016-6185 has been rated HIGH with a CVSS base score of 7.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2016-6185?
Check the references section above for vendor advisories and patch information. Affected products include: Perl Perl, Fedoraproject Fedora, Debian Debian Linux, Oracle Solaris, Canonical Ubuntu Linux.