ISOMAN

CVE

CVE-2016-6185

The XSLoader::load method in XSLoader in Perl does not properly locate .so files when called in a string eval, which might allow local users to execute arbitrary code via a Trojan horse library under the current working directory.

Severity
HIGH
CVSS
7.8
Published
Modified
NVD detailAll CVEs

Linked Releases

DistributionReleaseStatusEvidence
Ubuntu16.04.7 amd64 desktopunknownsource
Ubuntu16.04.6 i386 desktopunknownsource
Ubuntu16.04.7 amd64 serverunknownsource
Ubuntu16.04.6 i386 serverunknownsource

References

  1. http://perl5.git.perl.org/perl.git/commitdiff/08e3451d7
  2. http://www.debian.org/security/2016/dsa-3628
  3. http://www.openwall.com/lists/oss-security/2016/07/07/1
  4. http://www.openwall.com/lists/oss-security/2016/07/08/5
  5. http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html
  6. http://www.securityfocus.com/bid/91685
  7. http://www.securitytracker.com/id/1036260
  8. https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5RFDMASVZLFZYBB2GNTZXU6I76E4NA4V/
  9. https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ITYZJXQH24X2F2LAOQEQAC5KXLYJTJ76/
  10. https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PRIPTDA6XINBVEJXI2NGLKVEINBREHTN/
  11. https://rt.cpan.org/Public/Bug/Display.html?id=115808
  12. https://security.gentoo.org/glsa/201701-75
  13. https://usn.ubuntu.com/3625-1/
  14. https://usn.ubuntu.com/3625-2/
  15. http://perl5.git.perl.org/perl.git/commitdiff/08e3451d7
  16. http://www.debian.org/security/2016/dsa-3628
  17. http://www.openwall.com/lists/oss-security/2016/07/07/1
  18. http://www.openwall.com/lists/oss-security/2016/07/08/5
  19. http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html
  20. http://www.securityfocus.com/bid/91685