Local Code Execution Risk in Perl's XSLoader for Users
CVE-2016-6185

7.8HIGH

Key Information:

Vendor

Perl

Status
Perl
Vendor
CVE Published:
2 August 2016

What is CVE-2016-6185?

The XSLoader module in Perl contains a vulnerability that improperly resolves shared object file paths during the execution of string evals. This flaw could be exploited by local users through maliciously crafted libraries positioned in the current working directory, leading to the potential execution of arbitrary code. Adequate precautions should be taken to secure the environment against misuse of this functionality.

References

https://lists.fedoraproject.org/archives/list/package-ann...
vendor-advisoryx_refsource_FEDORA
https://security.gentoo.org/glsa/201701-75
vendor-advisoryx_refsource_GENTOO
https://usn.ubuntu.com/3625-2/
vendor-advisoryx_refsource_UBUNTU

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.