Published: 08/04/2016 Updated: 10/09/2020

CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10

CVSS v3 Base Score: 7.5 | Impact Score: 3.6 | Exploitability Score: 3.9

VMScore: 445

Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N

Perl might allow context-dependent malicious users to bypass the taint protection mechanism in a child process via duplicate environment variables in envp.

Vulnerable Product	Search on Vulmon	Subscribe to Product
perl perl
debian debian linux 7.0
debian debian linux 8.0
oracle communications billing and revenue management 7.5
oracle configuration manager
oracle configuration manager 12.1.2.0.6
oracle database server 11.2.0.4
oracle database server 12.1.0.2
oracle database server 12.2.0.1
oracle database server 18c
oracle database server 19c
oracle enterprise manager base platform 13.2.0.0.0
oracle enterprise manager base platform 13.3.0.0.0
oracle timesten in-memory database
oracle solaris 11.3
opensuse opensuse 13.2
canonical ubuntu linux 12.04
canonical ubuntu linux 14.04
canonical ubuntu linux 15.10

Several security issues were fixed in Perl ...

Stephane Chazelas discovered a bug in the environment handling in Perl Perl provides a Perl-space hash variable, %ENV, in which environment variables can be looked up If a variable appears twice in envp, only the last value would appear in %ENV, but getenv would return the first Perl's taint security mechanism would be applied to the value in %E ...

CWE-20 http://www.gossamer-threads.com/lists/perl/porters/326387 http://www.debian.org/security/2016/dsa-3501 http://perl5.git.perl.org/perl.git/commitdiff/ae37b791a73a9e78dedb89fb2429d2628cf58076 https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05240731 http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html http://www.securityfocus.com/bid/83802 http://www.ubuntu.com/usn/USN-2916-1 http://lists.opensuse.org/opensuse-updates/2016-03/msg00112.html https://security.gentoo.org/glsa/201701-75 http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html https://www.oracle.com/security-alerts/cpuapr2020.html https://www.oracle.com/security-alerts/cpujul2020.html https://usn.ubuntu.com/2916-1/https://nvd.nist.gov

CVE-2016-2381

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect