SB2016072502 - Debian update for perl

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2016072502

SB2016072502 - Debian update for perl

Published: July 25, 2016

Security Bulletin ID SB2016072502
Severity
High
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Local access
Highest impact Code execution

Breakdown by Severity

High 50% Low 50%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 secuirty vulnerabilities.


1) Insecure search path in perl5-porters (CVE-ID: CVE-2016-1238)

The vulnerability allows a local user to potentially elevate privileges.

The vulnerability exists due to Perl 5 module loads modules from the includes directory array ("@INC") in which the last element is the current directory ("."). A local attacker can place specially crafted modules into world-writable directory and trick the victim to run arbitrary script from this directory.

Successful exploitation of this vulnerability may allow a local attacker to obtain elevated privileges on the system.


2) XSLoader relative path error in Perl (CVE-ID: CVE-2016-6185)

The vulnerability allows a local user to obtain elevated privileges on the target system.

The vulnerability exists due to an access control error in Perl. A local user can load arbitrary code from the current working directory by supplying specially crafted data to the XSLoader component.

Successful exploitation of this vulnerability may result in execution of arbitrary code.

Remediation

Install update from vendor's website.

References