NVD Vulnerability Detail

CVE-2016-1238

Summary	(1) cpan/Archive-Tar/bin/ptar, (2) cpan/Archive-Tar/bin/ptardiff, (3) cpan/Archive-Tar/bin/ptargrep, (4) cpan/CPAN/scripts/cpan, (5) cpan/Digest-SHA/shasum, (6) cpan/Encode/bin/enc2xs, (7) cpan/Encode/bin/encguess, (8) cpan/Encode/bin/piconv, (9) cpan/Encode/bin/ucmlint, (10) cpan/Encode/bin/unidump, (11) cpan/ExtUtils-MakeMaker/bin/instmodsh, (12) cpan/IO-Compress/bin/zipdetails, (13) cpan/JSON-PP/bin/json_pp, (14) cpan/Test-Harness/bin/prove, (15) dist/ExtUtils-ParseXS/lib/ExtUtils/xsubpp, (16) dist/Module-CoreList/corelist, (17) ext/Pod-Html/bin/pod2html, (18) utils/c2ph.PL, (19) utils/h2ph.PL, (20) utils/h2xs.PL, (21) utils/libnetcfg.PL, (22) utils/perlbug.PL, (23) utils/perldoc.PL, (24) utils/perlivp.PL, and (25) utils/splain.PL in Perl 5.x before 5.22.3-RC2 and 5.24 before 5.24.1-RC2 do not properly remove . (period) characters from the end of the includes directory array, which might allow local users to gain privileges via a Trojan horse module under the current working directory.
Publication Date	Aug. 2, 2016, 11:59 p.m.
Registration Date	Jan. 26, 2021, 2:06 p.m.
Last Update	Nov. 21, 2024, 11:46 a.m.

CVSS3.1 : HIGH
スコア	7.8
Vector	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
攻撃元区分(AV)	ローカル
攻撃条件の複雑さ(AC)	低
攻撃に必要な特権レベル(PR)	低
利用者の関与(UI)	不要
影響の想定範囲(S)	変更なし
機密性への影響(C)	高
完全性への影響(I)	高
可用性への影響(A)	高

CVSS2.0 : HIGH
Score	7.2
Vector	AV:L/AC:L/Au:N/C:C/I:C/A:C
攻撃元区分(AV)	ローカル
攻撃条件の複雑さ(AC)	低
攻撃前の認証要否(Au)	不要
機密性への影響(C)	高
完全性への影響(I)	高
可用性への影響(A)	高
Get all privileges.	いいえ
Get user privileges	いいえ
Get other privileges	いいえ
User operation required	いいえ

Affected software configurations

Configuration1	or higher	or less	more than	less than
cpe:2.3:o:debian:debian_linux:8.0:::::::*
cpe:2.3:o:fedoraproject:fedora:24:::::::*
cpe:2.3:o:fedoraproject:fedora:23:::::::*

Configuration2	or higher	or less	more than	less than
cpe:2.3:a:perl:perl:5.003_92:::::::*
cpe:2.3:a:perl:perl:5.21.1:::::::*
cpe:2.3:a:perl:perl:5.9.3:::::::*
cpe:2.3:a:perl:perl:5.14.1:::::::*
cpe:2.3:a:perl:perl:5.8.0:::::::*
cpe:2.3:a:perl:perl:5.003_97:::::::*
cpe:2.3:a:perl:perl:5.6.0:::::::*
cpe:2.3:a:perl:perl:5.17.11:::::::*
cpe:2.3:a:perl:perl:5.24.1:rc1::::::
cpe:2.3:a:perl:perl:5.16.0:rc2::::::
cpe:2.3:a:perl:perl:5.19.6:::::::*
cpe:2.3:a:perl:perl:5.22.3:rc1::::::
cpe:2.3:a:perl:perl:5.17.4:::::::*
cpe:2.3:a:perl:perl:5.003_03:::::::*
cpe:2.3:a:perl:perl:5.18.4:::::::*
cpe:2.3:a:perl:perl:5.18.2:rc3::::::
cpe:2.3:a:perl:perl:5.8.4:::::::*
cpe:2.3:a:perl:perl:5.15.6:::::::*
cpe:2.3:a:perl:perl:5.004_04:::::::*
cpe:2.3:a:perl:perl:5.12.0:rc1::::::
cpe:2.3:a:perl:perl:5.9.5:::::::*
cpe:2.3:a:perl:perl:5.004_02:::::::*
cpe:2.3:a:perl:perl:5.003_12:::::::*
cpe:2.3:a:perl:perl:5.18.3:rc2::::::
cpe:2.3:a:perl:perl:5.13.10:::::::*
cpe:2.3:a:perl:perl:5.003_24:::::::*
cpe:2.3:a:perl:perl:5.12.0:rc4::::::
cpe:2.3:a:perl:perl:5.17.1:::::::*
cpe:2.3:a:perl:perl:5.22.0:::::::*
cpe:2.3:a:perl:perl:5.8:::::::*
cpe:2.3:a:perl:perl:5.003_97e:::::::*
cpe:2.3:a:perl:perl:5.8.1:::::::*
cpe:2.3:a:perl:perl:5.21.7:::::::*
cpe:2.3:a:perl:perl:5.12.4:::::::*
cpe:2.3:a:perl:perl:5.15.2:::::::*
cpe:2.3:a:perl:perl:5.8.9:::::::*
cpe:2.3:a:perl:perl:5.20.2:rc1::::::
cpe:2.3:a:perl:perl:5.000:::::::*
cpe:2.3:a:perl:perl:5.18.0:rc2::::::
cpe:2.3:a:perl:perl:5.15.0:::::::*
cpe:2.3:a:perl:perl:5.12.1:rc0::::::
cpe:2.3:a:perl:perl:5.003_09:::::::*
cpe:2.3:a:perl:perl:5.18.3:rc1::::::
cpe:2.3:a:perl:perl:5.12.5:rc2::::::
cpe:2.3:a:perl:perl:5.005_04:::::::*
cpe:2.3:a:perl:perl:5.005_01:::::::*
cpe:2.3:a:perl:perl:1.0.16:::::::*
cpe:2.3:a:perl:perl:5.003_90:::::::*
cpe:2.3:a:perl:perl:5.12.4:rc1::::::
cpe:2.3:a:perl:perl:5.14.4:rc1::::::
cpe:2.3:a:perl:perl:5.21.4:::::::*
cpe:2.3:a:perl:perl:5.15.3:::::::*
cpe:2.3:a:perl:perl:5.24.0:rc2::::::
cpe:2.3:a:perl:perl:5.6:::::::*
cpe:2.3:a:perl:perl:5.17.9:::::::*
cpe:2.3:a:perl:perl:5.12.0:rc3::::::
cpe:2.3:a:perl:perl:5.21.9:::::::*
cpe:2.3:a:perl:perl:5.6.1:::::::*
cpe:2.3:a:perl:perl:5.12.1:rc1::::::
cpe:2.3:a:perl:perl:5.13.8:::::::*
cpe:2.3:a:perl:perl:5.003_21:::::::*
cpe:2.3:a:perl:perl:5.003_15:::::::*
cpe:2.3:a:perl:perl:5.003_26:::::::*
cpe:2.3:a:perl:perl:5.003_97f:::::::*
cpe:2.3:a:perl:perl:5.11.2:::::::*
cpe:2.3:a:perl:perl:5.13.0:::::::*
cpe:2.3:a:perl:perl:5.21.6:::::::*
cpe:2.3:a:perl:perl:5.19.10:::::::*
cpe:2.3:a:perl:perl:5.14.0:rc2::::::
cpe:2.3:a:perl:perl:5.22.1:rc4::::::
cpe:2.3:a:perl:perl:5.14.3:rc1::::::
cpe:2.3:a:perl:perl:5.12.3:rc3::::::
cpe:2.3:a:perl:perl:5.24.0:rc5::::::
cpe:2.3:a:perl:perl:5.13.5:::::::*
cpe:2.3:a:perl:perl:5.20.3:rc2::::::
cpe:2.3:a:perl:perl:5.13.3:::::::*
cpe:2.3:a:perl:perl:5.7.3:::::::*
cpe:2.3:a:perl:perl:5.003_94:::::::*
cpe:2.3:a:perl:perl:5.003_97j:::::::*
cpe:2.3:a:perl:perl:5.9.2:::::::*
cpe:2.3:a:perl:perl:5.13.6:::::::*
cpe:2.3:a:perl:perl:5.003_10:::::::*
cpe:2.3:a:perl:perl:5.14.3:::::::*
cpe:2.3:a:perl:perl:5.19.5:::::::*
cpe:2.3:a:perl:perl:5.9.0:::::::*
cpe:2.3:a:perl:perl:5.003_27:::::::*
cpe:2.3:a:perl:perl:5.003_19:::::::*
cpe:2.3:a:perl:perl:5.003_97g:::::::*
cpe:2.3:a:perl:perl:5.001:::::::*
cpe:2.3:a:perl:perl:5.19.3:::::::*
cpe:2.3:a:perl:perl:5.24.0:::::::*
cpe:2.3:a:perl:perl:5.13.11:::::::*
cpe:2.3:a:perl:perl:5.8.2:::::::*
cpe:2.3:a:perl:perl:5.17.10:::::::*
cpe:2.3:a:perl:perl:5.11.1:::::::*
cpe:2.3:a:perl:perl:5.8.5:::::::*
cpe:2.3:a:perl:perl:5.19.2:::::::*
cpe:2.3:a:perl:perl:5.13.7:::::::*
cpe:2.3:a:perl:perl:5.22.1:rc3::::::
cpe:2.3:a:perl:perl:5.19.11:::::::*
cpe:2.3:a:perl:perl:5.10:::::::*
cpe:2.3:a:perl:perl:5.13.1:::::::*
cpe:2.3:a:perl:perl:5.10.1:::::::*
cpe:2.3:a:perl:perl:5.17.8:::::::*
cpe:2.3:a:perl:perl:5.16.3:rc1::::::
cpe:2.3:a:perl:perl:5.12.3:::::::*
cpe:2.3:a:perl:perl:5.12.1:rc2::::::
cpe:2.3:a:perl:perl:5.14.4:::::::*
cpe:2.3:a:perl:perl:5.003_20:::::::*
cpe:2.3:a:perl:perl:5.22.2:rc1::::::
cpe:2.3:a:perl:perl:5.18.2:rc2::::::
cpe:2.3:a:perl:perl:5.003_97i:::::::*
cpe:2.3:a:perl:perl:5.12.0:rc2::::::
cpe:2.3:a:perl:perl:5.19.0:::::::*
cpe:2.3:a:perl:perl:5.003_14:::::::*
cpe:2.3:a:perl:perl:5.003_28:::::::*
cpe:2.3:a:perl:perl:5.14.0:::::::*
cpe:2.3:a:perl:perl:5.21.2:::::::*
cpe:2.3:a:perl:perl:5.18.3:::::::*
cpe:2.3:a:perl:perl:5.003_17:::::::*
cpe:2.3:a:perl:perl:5.22.0:rc1::::::
cpe:2.3:a:perl:perl:5.003:::::::*
cpe:2.3:a:perl:perl:5.16.0:::::::*
cpe:2.3:a:perl:perl:5.24.0:rc3::::::
cpe:2.3:a:perl:perl:5.12.0:::::::*
cpe:2.3:a:perl:perl:5.003_91:::::::*
cpe:2.3:a:perl:perl:5.18.0:rc3::::::
cpe:2.3:a:perl:perl:5.16.1:::::::*
cpe:2.3:a:perl:perl:5.003_04:::::::*
cpe:2.3:a:perl:perl:5.12.3:rc1::::::
cpe:2.3:a:perl:perl:5.11.5:::::::*
cpe:2.3:a:perl:perl:5.003_25:::::::*
cpe:2.3:a:perl:perl:5.22.2:::::::*
cpe:2.3:a:perl:perl:5.003_01:::::::*
cpe:2.3:a:perl:perl:5.17.5:::::::*
cpe:2.3:a:perl:perl:5.20.2:::::::*
cpe:2.3:a:perl:perl:5.21.3:::::::*
cpe:2.3:a:perl:perl:5.18.0:rc4::::::
cpe:2.3:a:perl:perl:5.18.2:::::::*
cpe:2.3:a:perl:perl:5.20.3:::::::*
cpe:2.3:a:perl:perl:5.12.5:rc1::::::
cpe:2.3:a:perl:perl:5.6.2:::::::*
cpe:2.3:a:perl:perl:5.11.0:::::::*
cpe:2.3:a:perl:perl:5.19.9:::::::*
cpe:2.3:a:perl:perl:5.004_05:::::::*
cpe:2.3:a:perl:perl:5.24.0:rc4::::::
cpe:2.3:a:perl:perl:5.17.2:::::::*
cpe:2.3:a:perl:perl:5.21.8:::::::*
cpe:2.3:a:perl:perl:5.003_13:::::::*
cpe:2.3:a:perl:perl:5.004_01:::::::*
cpe:2.3:a:perl:perl:5.15.9:::::::*
cpe:2.3:a:perl:perl:5.003_16:::::::*
cpe:2.3:a:perl:perl:5.19.8:::::::*
cpe:2.3:a:perl:perl:5.12.2:::::::*
cpe:2.3:a:perl:perl:5.003_97c:::::::*
cpe:2.3:a:perl:perl:5.22.1:rc2::::::
cpe:2.3:a:perl:perl:5.002_01:::::::*
cpe:2.3:a:perl:perl:5.12.4:rc2::::::
cpe:2.3:a:perl:perl:5.20.1:rc1::::::
cpe:2.3:a:perl:perl:5.21.10:::::::*
cpe:2.3:a:perl:perl:5.20.1:rc2::::::
cpe:2.3:a:perl:perl:5.003_07:::::::*
cpe:2.3:a:perl:perl:5.003_02:::::::*
cpe:2.3:a:perl:perl:5.001n:::::::*
cpe:2.3:a:perl:perl:5.8.7:::::::*
cpe:2.3:a:perl:perl:5.17.0:::::::*
cpe:2.3:a:perl:perl:5.003_95:::::::*
cpe:2.3:a:perl:perl:5.003_93:::::::*
cpe:2.3:a:perl:perl:5.24.0:rc1::::::
cpe:2.3:a:perl:perl:5.14.0:rc1::::::
cpe:2.3:a:perl:perl:5.11.3:::::::*
cpe:2.3:a:perl:perl:5.15.5:::::::*
cpe:2.3:a:perl:perl:5.13.4:::::::*
cpe:2.3:a:perl:perl:5.14.0:rc3::::::
cpe:2.3:a:perl:perl:5.17.7:::::::*
cpe:2.3:a:perl:perl:5.17.3:::::::*
cpe:2.3:a:perl:perl:5.15.8:::::::*
cpe:2.3:a:perl:perl:5.12.5:::::::*
cpe:2.3:a:perl:perl:1.0.15:::::::*
cpe:2.3:a:perl:perl:5.005:::::::*
cpe:2.3:a:perl:perl:5.22.1:::::::*
cpe:2.3:a:perl:perl:5.17.7.0:::::::*
cpe:2.3:a:perl:perl:5.18.2:rc1::::::
cpe:2.3:a:perl:perl:5.8.9:rc1::::::
cpe:2.3:a:perl:perl:5.004:::::::*
cpe:2.3:a:perl:perl:5.004_03:::::::*
cpe:2.3:a:perl:perl:5.16.0:rc1::::::
cpe:2.3:a:perl:perl:5.003_97h:::::::*
cpe:2.3:a:perl:perl:5.10.1:rc1::::::
cpe:2.3:a:perl:perl:5.21.11:::::::*
cpe:2.3:a:perl:perl:5.14.4:rc2::::::
cpe:2.3:a:perl:perl:5.15.4:::::::*
cpe:2.3:a:perl:perl:5.9.4:::::::*
cpe:2.3:a:perl:perl:5.17.6:::::::*
cpe:2.3:a:perl:perl:5.003_99a:::::::*
cpe:2.3:a:perl:perl:5.21.0:::::::*
cpe:2.3:a:perl:perl:5.005_03:::::::*
cpe:2.3:a:perl:perl:5.19.7:::::::*
cpe:2.3:a:perl:perl:5.14.3:rc2::::::
cpe:2.3:a:perl:perl:5.19.1:::::::*
cpe:2.3:a:perl:perl:5.11.4:::::::*
cpe:2.3:a:perl:perl:5.000o:::::::*
cpe:2.3:a:perl:perl:5.16.2:::::::*
cpe:2.3:a:perl:perl:5.20.0:::::::*
cpe:2.3:a:perl:perl:5.003_05:::::::*
cpe:2.3:a:perl:perl:5.22.1:rc1::::::
cpe:2.3:a:perl:perl:5.21.5:::::::*
cpe:2.3:a:perl:perl:5.14.2:::::::*
cpe:2.3:a:perl:perl:5.13.9:::::::*
cpe:2.3:a:perl:perl:5.18.0:rc1::::::
cpe:2.3:a:perl:perl:5.9.1:::::::*
cpe:2.3:a:perl:perl:5.12.3:rc2::::::
cpe:2.3:a:perl:perl:5.20.0:rc1::::::
cpe:2.3:a:perl:perl:5.003_97b:::::::*
cpe:2.3:a:perl:perl:5.14.1:rc1::::::
cpe:2.3:a:perl:perl:5.003_96:::::::*
cpe:2.3:a:perl:perl:5.12.2:rc1::::::
cpe:2.3:a:perl:perl:5.19.4:::::::*
cpe:2.3:a:perl:perl:5.12.0:rc0::::::
cpe:2.3:a:perl:perl:5.8.3:::::::*
cpe:2.3:a:perl:perl:5.12.0:rc5::::::
cpe:2.3:a:perl:perl:5.22.0:rc2::::::
cpe:2.3:a:perl:perl:5.8.6:::::::*
cpe:2.3:a:perl:perl:5.003_08:::::::*
cpe:2.3:a:perl:perl:5.003_18:::::::*
cpe:2.3:a:perl:perl:5.005_02:::::::*
cpe:2.3:a:perl:perl:5.18.0:::::::*
cpe:2.3:a:perl:perl:5.10.0:::::::*
cpe:2.3:a:perl:perl:5.16.3:::::::*
cpe:2.3:a:perl:perl:5.20.1:::::::*
cpe:2.3:a:perl:perl:5.14.2:rc1::::::
cpe:2.3:a:perl:perl:5.10.1:rc2::::::
cpe:2.3:a:perl:perl:5.20.3:rc1::::::
cpe:2.3:a:perl:perl:5.18.2:rc4::::::
cpe:2.3:a:perl:perl:5.18.1:::::::*
cpe:2.3:a:perl:perl:5.13.2:::::::*
cpe:2.3:a:perl:perl:5.003_97d:::::::*
cpe:2.3:a:perl:perl:5.002:::::::*
cpe:2.3:a:perl:perl:5.12.1:::::::*
cpe:2.3:a:perl:perl:5.003_99:::::::*
cpe:2.3:a:perl:perl:5.003_98:::::::*
cpe:2.3:a:perl:perl:5.003_23:::::::*
cpe:2.3:a:perl:perl:5.003_22:::::::*
cpe:2.3:a:perl:perl:5.003_97a:::::::*
cpe:2.3:a:perl:perl:5.003_11:::::::*
cpe:2.3:a:perl:perl:5.15.7:::::::*
cpe:2.3:a:perl:perl:5.15.1:::::::*
cpe:2.3:a:perl:perl:5.8.8:::::::*

Configuration3		or higher	or less	more than	less than
cpe:2.3:o:opensuse:leap:15.0:::::::*

Configuration4		or higher	or less	more than	less than
cpe:2.3:a:apache:spamassassin::::::::					3.4.2

Related information, measures and tools

No	URL	タグ
1	http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00002.html	Third Party Advisory
2	http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00002.html	Third Party Advisory
3	http://perl5.git.perl.org/perl.git/commit/cee96d52c39b1e7b36e1c62d38bcd8d86e9a41ab	Issue Tracking
4	http://perl5.git.perl.org/perl.git/commit/cee96d52c39b1e7b36e1c62d38bcd8d86e9a41ab	Issue Tracking
5	http://www.debian.org/security/2016/dsa-3628	Third Party Advisory
6	http://www.debian.org/security/2016/dsa-3628	Third Party Advisory
7	http://www.nntp.perl.org/group/perl.perl5.porters/2016/07/msg238271.html	Third Party Advisory
8	http://www.nntp.perl.org/group/perl.perl5.porters/2016/07/msg238271.html	Third Party Advisory
9	http://www.securityfocus.com/bid/92136	Third Party Advisory VDB Entry
10	http://www.securityfocus.com/bid/92136	Third Party Advisory VDB Entry
11	http://www.securitytracker.com/id/1036440	Third Party Advisory VDB Entry
12	http://www.securitytracker.com/id/1036440	Third Party Advisory VDB Entry
13	https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05240731	Third Party Advisory
14	https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05240731	Third Party Advisory
15	https://lists.apache.org/thread.html/7f6a16bc0fd0fd5e67c7fd95bd655069a2ac7d1f88e42d3c853e601c%40%3Cannounce.apache.org%3E
16	https://lists.apache.org/thread.html/7f6a16bc0fd0fd5e67c7fd95bd655069a2ac7d1f88e42d3c853e601c%40%3Cannounce.apache.org%3E
17	https://lists.debian.org/debian-lts-announce/2018/11/msg00016.html	Mailing List Third Party Advisory
18	https://lists.debian.org/debian-lts-announce/2018/11/msg00016.html	Mailing List Third Party Advisory
19	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2FBQOCV3GBAN2EYZUM3CFDJ4ECA3GZOK/
20	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2FBQOCV3GBAN2EYZUM3CFDJ4ECA3GZOK/
21	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DOFRQWJRP2NQJEYEWOMECVW3HAMD5SYN/
22	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DOFRQWJRP2NQJEYEWOMECVW3HAMD5SYN/
23	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TZBNQH3DMI7HDELJAZ4TFJJANHXOEDWH/
24	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TZBNQH3DMI7HDELJAZ4TFJJANHXOEDWH/
25	https://rt.perl.org/Public/Bug/Display.html?id=127834	Permissions Required
26	https://rt.perl.org/Public/Bug/Display.html?id=127834	Permissions Required
27	https://security.gentoo.org/glsa/201701-75	Third Party Advisory
28	https://security.gentoo.org/glsa/201701-75	Third Party Advisory
29	https://security.gentoo.org/glsa/201812-07	Third Party Advisory
30	https://security.gentoo.org/glsa/201812-07	Third Party Advisory

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-264	認可・権限・アクセス制御	https://cwe.mitre.org/data/definitions/264.html

JVN Vulnerability Information

Perl の複数のファイルにおける権限を取得される脆弱性

Title	Perl の複数のファイルにおける権限を取得される脆弱性
Summary	Perl の以下のファイルは、インクルードディレクトリの配列の末尾から . (ピリオド) 文字を適切に削除しないため、権限を取得される脆弱性が存在します。 (1) cpan/Archive-Tar/bin/ptar (2) cpan/Archive-Tar/bin/ptardiff (3) cpan/Archive-Tar/bin/ptargrep (4) cpan/CPAN/scripts/cpan (5) cpan/Digest-SHA/shasum (6) cpan/Encode/bin/enc2xs (7) cpan/Encode/bin/encguess (8) cpan/Encode/bin/piconv (9) cpan/Encode/bin/ucmlint (10) cpan/Encode/bin/unidump (11) cpan/ExtUtils-MakeMaker/bin/instmodsh (12) cpan/IO-Compress/bin/zipdetails (13) cpan/JSON-PP/bin/json_pp (14) cpan/Test-Harness/bin/prove (15) dist/ExtUtils-ParseXS/lib/ExtUtils/xsubpp (16) dist/Module-CoreList/corelist (17) ext/Pod-Html/bin/pod2html (18) utils/c2ph.PL (19) utils/h2ph.PL (20) utils/h2xs.PL (21) utils/libnetcfg.PL (22) utils/perlbug.PL (23) utils/perldoc.PL (24) utils/perlivp.PL (25) utils/splain.PL
Possible impacts	ローカルユーザにより、カレントワーキングディレクトリ配下にあるトロイの木馬のモジュールを介して、権限を取得される可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	July 25, 2016, midnight
Registration Date	Aug. 4, 2016, 4:50 p.m.
Last Update	Oct. 27, 2016, 3:18 p.m.

Affected System

The Perl Foundation

Perl 5.22.3-RC2 未満の 5.x

Perl 5.24.1-RC2 未満の 5.24

Debian

Debian GNU/Linux 8.0

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2016-1238	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1238
National Vulnerability Database (NVD)
2	CVE-2016-1238	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-1238
perl
3	CVE-2016-1238: Important unsafe module load path flaw	http://www.nntp.perl.org/group/perl.perl5.porters/2016/07/msg238271.html

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-264	https://jvndb.jvn.jp/ja/cwe/CWE-264.html

ベンダー情報

No	Name	URL
Debian Security Advisory
1	DSA-3628	https://www.debian.org/security/2016/dsa-3628
HPE Security Bulletin
2	HPSBNS03635	https://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c05240731
perl
3	(perl #127834) remove . from the end of @INC if complex modules are loaded	http://perl5.git.perl.org/perl.git/commit/cee96d52c39b1e7b36e1c62d38bcd8d86e9a41ab
4	Bug #127834	https://rt.perl.org/Public/Bug/Display.html?id=127834
Red Hat Bugzilla
5	Bug 1355695	https://bugzilla.redhat.com/show_bug.cgi?id=1355695

Change Log

No	Changed Details	Date of change
0	[2016年08月04日] 掲載 [2016年10月27日] ベンダ情報：ヒューレット・パッカード・エンタープライズ (HPSBNS03635) を追加	Feb. 17, 2018, 10:37 a.m.