Published: 02/08/2016 Updated: 07/11/2023

CVSS v2 Base Score: 4.6 | Impact Score: 6.4 | Exploitability Score: 3.9

CVSS v3 Base Score: 7.8 | Impact Score: 5.9 | Exploitability Score: 1.8

VMScore: 409

Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P

The XSLoader::load method in XSLoader in Perl does not properly locate .so files when called in a string eval, which might allow local users to execute arbitrary code via a Trojan horse library under the current working directory.

Vulnerable Product	Search on Vulmon	Subscribe to Product
perl perl
fedoraproject fedora 22
fedoraproject fedora 24
fedoraproject fedora 23
debian debian linux 8.0
oracle solaris 11.3
oracle solaris 10
canonical ubuntu linux 16.04
canonical ubuntu linux 12.04
canonical ubuntu linux 17.10
canonical ubuntu linux 14.04

Debian Bug report logs - #829578 perl: CVE-2016-6185: XSLoader tries to load code from '(eval 1)/' when called inside a string eval Package: perl; Maintainer for perl is Niko Tyni <ntyni@debianorg>; Source for perl is src:perl (PTS, buildd, popcon) Affects: check-all-the-things Reported by: Jakub Wilk <jwilk@debianorg&gt ...

Several security issues were fixed in Perl ...

Multiple vulnerabilities were discovered in the implementation of the Perl programming language The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2016-1238 John Lightsey and Todd Rinaldo reported that the opportunistic loading of optional modules can make many programs unintentionally load code fr ...

The XSLoader::load method in XSLoader in Perl does not properly locate so files when called in a string eval, which might allow local users to execute arbitrary code via a Trojan horse library under the current working directory ...

NVD-CWE-noinfo http://perl5.git.perl.org/perl.git/commitdiff/08e3451d7 http://www.openwall.com/lists/oss-security/2016/07/07/1 http://www.openwall.com/lists/oss-security/2016/07/08/5 https://rt.cpan.org/Public/Bug/Display.html?id=115808 http://www.debian.org/security/2016/dsa-3628 http://www.securitytracker.com/id/1036260 http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html http://www.securityfocus.com/bid/91685 https://security.gentoo.org/glsa/201701-75 https://usn.ubuntu.com/3625-2/https://usn.ubuntu.com/3625-1/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PRIPTDA6XINBVEJXI2NGLKVEINBREHTN/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ITYZJXQH24X2F2LAOQEQAC5KXLYJTJ76/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5RFDMASVZLFZYBB2GNTZXU6I76E4NA4V/https://nvd.nist.gov https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=829578 https://usn.ubuntu.com/3625-2/

CVE-2016-6185

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect