CVE-2016-1238
Summary
| CVE | CVE-2016-1238 |
|---|---|
| State | PUBLISHED |
| Assigner | debian |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2016-08-02 14:59:00 UTC |
| Updated | 2026-05-06 22:30:45 UTC |
| Description | (1) cpan/Archive-Tar/bin/ptar, (2) cpan/Archive-Tar/bin/ptardiff, (3) cpan/Archive-Tar/bin/ptargrep, (4) cpan/CPAN/scripts/cpan, (5) cpan/Digest-SHA/shasum, (6) cpan/Encode/bin/enc2xs, (7) cpan/Encode/bin/encguess, (8) cpan/Encode/bin/piconv, (9) cpan/Encode/bin/ucmlint, (10) cpan/Encode/bin/unidump, (11) cpan/ExtUtils-MakeMaker/bin/instmodsh, (12) cpan/IO-Compress/bin/zipdetails, (13) cpan/JSON-PP/bin/json_pp, (14) cpan/Test-Harness/bin/prove, (15) dist/ExtUtils-ParseXS/lib/ExtUtils/xsubpp, (16) dist/Module-CoreList/corelist, (17) ext/Pod-Html/bin/pod2html, (18) utils/c2ph.PL, (19) utils/h2ph.PL, (20) utils/h2xs.PL, (21) utils/libnetcfg.PL, (22) utils/perlbug.PL, (23) utils/perldoc.PL, (24) utils/perlivp.PL, and (25) utils/splain.PL in Perl 5.x before 5.22.3-RC2 and 5.24 before 5.24.1-RC2 do not properly remove . (period) characters from the end of the includes directory array, which might allow local users to gain privileges via a Trojan horse module under the current working directory. |
Risk And Classification
Primary CVSS: v3.1 7.8 HIGH from [email protected]
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Problem Types: CWE-264 | n/a
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | [email protected] | Primary | 7.8 | HIGH | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| 2.0 | [email protected] | Primary | 7.2 | AV:L/AC:L/Au:N/C:C/I:C/A:C |
CVSS v3.1 Breakdown
Attack Vector
LocalAttack Complexity
LowPrivileges Required
LowUser Interaction
NoneScope
UnchangedConfidentiality
HighIntegrity
HighAvailability
HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v2.0 Breakdown
Access Vector
LocalAccess Complexity
LowAuthentication
NoneConfidentiality
CompleteIntegrity
CompleteAvailability
CompleteAV:L/AC:L/Au:N/C:C/I:C/A:C
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Apache | Spamassassin | All | All | All | All |
| Operating System | Debian | Debian Linux | 8.0 | All | All | All |
| Operating System | Fedoraproject | Fedora | 23 | All | All | All |
| Operating System | Fedoraproject | Fedora | 24 | All | All | All |
| Operating System | Opensuse | Leap | 15.0 | All | All | All |
| Application | Perl | Perl | 1.0.15 | All | All | All |
| Application | Perl | Perl | 1.0.16 | All | All | All |
| Application | Perl | Perl | 5.000 | All | All | All |
| Application | Perl | Perl | 5.000o | All | All | All |
| Application | Perl | Perl | 5.001 | All | All | All |
| Application | Perl | Perl | 5.001n | All | All | All |
| Application | Perl | Perl | 5.002 | All | All | All |
| Application | Perl | Perl | 5.002_01 | All | All | All |
| Application | Perl | Perl | 5.003 | All | All | All |
| Application | Perl | Perl | 5.003_01 | All | All | All |
| Application | Perl | Perl | 5.003_02 | All | All | All |
| Application | Perl | Perl | 5.003_03 | All | All | All |
| Application | Perl | Perl | 5.003_04 | All | All | All |
| Application | Perl | Perl | 5.003_05 | All | All | All |
| Application | Perl | Perl | 5.003_07 | All | All | All |
| Application | Perl | Perl | 5.003_08 | All | All | All |
| Application | Perl | Perl | 5.003_09 | All | All | All |
| Application | Perl | Perl | 5.003_10 | All | All | All |
| Application | Perl | Perl | 5.003_11 | All | All | All |
| Application | Perl | Perl | 5.003_12 | All | All | All |
| Application | Perl | Perl | 5.003_13 | All | All | All |
| Application | Perl | Perl | 5.003_14 | All | All | All |
| Application | Perl | Perl | 5.003_15 | All | All | All |
| Application | Perl | Perl | 5.003_16 | All | All | All |
| Application | Perl | Perl | 5.003_17 | All | All | All |
| Application | Perl | Perl | 5.003_18 | All | All | All |
| Application | Perl | Perl | 5.003_19 | All | All | All |
| Application | Perl | Perl | 5.003_20 | All | All | All |
| Application | Perl | Perl | 5.003_21 | All | All | All |
| Application | Perl | Perl | 5.003_22 | All | All | All |
| Application | Perl | Perl | 5.003_23 | All | All | All |
| Application | Perl | Perl | 5.003_24 | All | All | All |
| Application | Perl | Perl | 5.003_25 | All | All | All |
| Application | Perl | Perl | 5.003_26 | All | All | All |
| Application | Perl | Perl | 5.003_27 | All | All | All |
| Application | Perl | Perl | 5.003_28 | All | All | All |
| Application | Perl | Perl | 5.003_90 | All | All | All |
| Application | Perl | Perl | 5.003_91 | All | All | All |
| Application | Perl | Perl | 5.003_92 | All | All | All |
| Application | Perl | Perl | 5.003_93 | All | All | All |
| Application | Perl | Perl | 5.003_94 | All | All | All |
| Application | Perl | Perl | 5.003_95 | All | All | All |
| Application | Perl | Perl | 5.003_96 | All | All | All |
| Application | Perl | Perl | 5.003_97 | All | All | All |
| Application | Perl | Perl | 5.003_97a | All | All | All |
| Application | Perl | Perl | 5.003_97b | All | All | All |
| Application | Perl | Perl | 5.003_97c | All | All | All |
| Application | Perl | Perl | 5.003_97d | All | All | All |
| Application | Perl | Perl | 5.003_97e | All | All | All |
| Application | Perl | Perl | 5.003_97f | All | All | All |
| Application | Perl | Perl | 5.003_97g | All | All | All |
| Application | Perl | Perl | 5.003_97h | All | All | All |
| Application | Perl | Perl | 5.003_97i | All | All | All |
| Application | Perl | Perl | 5.003_97j | All | All | All |
| Application | Perl | Perl | 5.003_98 | All | All | All |
| Application | Perl | Perl | 5.003_99 | All | All | All |
| Application | Perl | Perl | 5.003_99a | All | All | All |
| Application | Perl | Perl | 5.004 | All | All | All |
| Application | Perl | Perl | 5.004_01 | All | All | All |
| Application | Perl | Perl | 5.004_02 | All | All | All |
| Application | Perl | Perl | 5.004_03 | All | All | All |
| Application | Perl | Perl | 5.004_04 | All | All | All |
| Application | Perl | Perl | 5.004_05 | All | All | All |
| Application | Perl | Perl | 5.005 | All | All | All |
| Application | Perl | Perl | 5.005_01 | All | All | All |
| Application | Perl | Perl | 5.005_02 | All | All | All |
| Application | Perl | Perl | 5.005_03 | All | All | All |
| Application | Perl | Perl | 5.005_04 | All | All | All |
| Application | Perl | Perl | 5.10 | All | All | All |
| Application | Perl | Perl | 5.10.0 | All | All | All |
| Application | Perl | Perl | 5.10.1 | All | All | All |
| Application | Perl | Perl | 5.10.1 | rc1 | All | All |
| Application | Perl | Perl | 5.10.1 | rc2 | All | All |
| Application | Perl | Perl | 5.11.0 | All | All | All |
| Application | Perl | Perl | 5.11.1 | All | All | All |
| Application | Perl | Perl | 5.11.2 | All | All | All |
| Application | Perl | Perl | 5.11.3 | All | All | All |
| Application | Perl | Perl | 5.11.4 | All | All | All |
| Application | Perl | Perl | 5.11.5 | All | All | All |
| Application | Perl | Perl | 5.12.0 | All | All | All |
| Application | Perl | Perl | 5.12.0 | rc0 | All | All |
| Application | Perl | Perl | 5.12.0 | rc1 | All | All |
| Application | Perl | Perl | 5.12.0 | rc2 | All | All |
| Application | Perl | Perl | 5.12.0 | rc3 | All | All |
| Application | Perl | Perl | 5.12.0 | rc4 | All | All |
| Application | Perl | Perl | 5.12.0 | rc5 | All | All |
| Application | Perl | Perl | 5.12.1 | All | All | All |
| Application | Perl | Perl | 5.12.1 | rc0 | All | All |
| Application | Perl | Perl | 5.12.1 | rc1 | All | All |
| Application | Perl | Perl | 5.12.1 | rc2 | All | All |
| Application | Perl | Perl | 5.12.2 | All | All | All |
| Application | Perl | Perl | 5.12.2 | rc1 | All | All |
| Application | Perl | Perl | 5.12.3 | All | All | All |
| Application | Perl | Perl | 5.12.3 | rc1 | All | All |
| Application | Perl | Perl | 5.12.3 | rc2 | All | All |
| Application | Perl | Perl | 5.12.3 | rc3 | All | All |
| Application | Perl | Perl | 5.12.4 | All | All | All |
| Application | Perl | Perl | 5.12.4 | rc1 | All | All |
| Application | Perl | Perl | 5.12.4 | rc2 | All | All |
| Application | Perl | Perl | 5.12.5 | All | All | All |
| Application | Perl | Perl | 5.12.5 | rc1 | All | All |
| Application | Perl | Perl | 5.12.5 | rc2 | All | All |
| Application | Perl | Perl | 5.13.0 | All | All | All |
| Application | Perl | Perl | 5.13.1 | All | All | All |
| Application | Perl | Perl | 5.13.10 | All | All | All |
| Application | Perl | Perl | 5.13.11 | All | All | All |
| Application | Perl | Perl | 5.13.2 | All | All | All |
| Application | Perl | Perl | 5.13.3 | All | All | All |
| Application | Perl | Perl | 5.13.4 | All | All | All |
| Application | Perl | Perl | 5.13.5 | All | All | All |
| Application | Perl | Perl | 5.13.6 | All | All | All |
| Application | Perl | Perl | 5.13.7 | All | All | All |
| Application | Perl | Perl | 5.13.8 | All | All | All |
| Application | Perl | Perl | 5.13.9 | All | All | All |
| Application | Perl | Perl | 5.14.0 | All | All | All |
| Application | Perl | Perl | 5.14.0 | rc1 | All | All |
| Application | Perl | Perl | 5.14.0 | rc2 | All | All |
| Application | Perl | Perl | 5.14.0 | rc3 | All | All |
| Application | Perl | Perl | 5.14.1 | All | All | All |
| Application | Perl | Perl | 5.14.1 | rc1 | All | All |
| Application | Perl | Perl | 5.14.2 | All | All | All |
| Application | Perl | Perl | 5.14.2 | rc1 | All | All |
| Application | Perl | Perl | 5.14.3 | All | All | All |
| Application | Perl | Perl | 5.14.3 | rc1 | All | All |
| Application | Perl | Perl | 5.14.3 | rc2 | All | All |
| Application | Perl | Perl | 5.14.4 | All | All | All |
| Application | Perl | Perl | 5.14.4 | rc1 | All | All |
| Application | Perl | Perl | 5.14.4 | rc2 | All | All |
| Application | Perl | Perl | 5.15.0 | All | All | All |
| Application | Perl | Perl | 5.15.1 | All | All | All |
| Application | Perl | Perl | 5.15.2 | All | All | All |
| Application | Perl | Perl | 5.15.3 | All | All | All |
| Application | Perl | Perl | 5.15.4 | All | All | All |
| Application | Perl | Perl | 5.15.5 | All | All | All |
| Application | Perl | Perl | 5.15.6 | All | All | All |
| Application | Perl | Perl | 5.15.7 | All | All | All |
| Application | Perl | Perl | 5.15.8 | All | All | All |
| Application | Perl | Perl | 5.15.9 | All | All | All |
| Application | Perl | Perl | 5.16.0 | All | All | All |
| Application | Perl | Perl | 5.16.0 | rc1 | All | All |
| Application | Perl | Perl | 5.16.0 | rc2 | All | All |
| Application | Perl | Perl | 5.16.1 | All | All | All |
| Application | Perl | Perl | 5.16.2 | All | All | All |
| Application | Perl | Perl | 5.16.3 | All | All | All |
| Application | Perl | Perl | 5.16.3 | rc1 | All | All |
| Application | Perl | Perl | 5.17.0 | All | All | All |
| Application | Perl | Perl | 5.17.1 | All | All | All |
| Application | Perl | Perl | 5.17.10 | All | All | All |
| Application | Perl | Perl | 5.17.11 | All | All | All |
| Application | Perl | Perl | 5.17.2 | All | All | All |
| Application | Perl | Perl | 5.17.3 | All | All | All |
| Application | Perl | Perl | 5.17.4 | All | All | All |
| Application | Perl | Perl | 5.17.5 | All | All | All |
| Application | Perl | Perl | 5.17.6 | All | All | All |
| Application | Perl | Perl | 5.17.7 | All | All | All |
| Application | Perl | Perl | 5.17.7.0 | All | All | All |
| Application | Perl | Perl | 5.17.8 | All | All | All |
| Application | Perl | Perl | 5.17.9 | All | All | All |
| Application | Perl | Perl | 5.18.0 | All | All | All |
| Application | Perl | Perl | 5.18.0 | rc1 | All | All |
| Application | Perl | Perl | 5.18.0 | rc2 | All | All |
| Application | Perl | Perl | 5.18.0 | rc3 | All | All |
| Application | Perl | Perl | 5.18.0 | rc4 | All | All |
| Application | Perl | Perl | 5.18.1 | All | All | All |
| Application | Perl | Perl | 5.18.2 | All | All | All |
| Application | Perl | Perl | 5.18.2 | rc1 | All | All |
| Application | Perl | Perl | 5.18.2 | rc2 | All | All |
| Application | Perl | Perl | 5.18.2 | rc3 | All | All |
| Application | Perl | Perl | 5.18.2 | rc4 | All | All |
| Application | Perl | Perl | 5.18.3 | All | All | All |
| Application | Perl | Perl | 5.18.3 | rc1 | All | All |
| Application | Perl | Perl | 5.18.3 | rc2 | All | All |
| Application | Perl | Perl | 5.18.4 | All | All | All |
| Application | Perl | Perl | 5.19.0 | All | All | All |
| Application | Perl | Perl | 5.19.1 | All | All | All |
| Application | Perl | Perl | 5.19.10 | All | All | All |
| Application | Perl | Perl | 5.19.11 | All | All | All |
| Application | Perl | Perl | 5.19.2 | All | All | All |
| Application | Perl | Perl | 5.19.3 | All | All | All |
| Application | Perl | Perl | 5.19.4 | All | All | All |
| Application | Perl | Perl | 5.19.5 | All | All | All |
| Application | Perl | Perl | 5.19.6 | All | All | All |
| Application | Perl | Perl | 5.19.7 | All | All | All |
| Application | Perl | Perl | 5.19.8 | All | All | All |
| Application | Perl | Perl | 5.19.9 | All | All | All |
| Application | Perl | Perl | 5.20.0 | All | All | All |
| Application | Perl | Perl | 5.20.0 | rc1 | All | All |
| Application | Perl | Perl | 5.20.1 | All | All | All |
| Application | Perl | Perl | 5.20.1 | rc1 | All | All |
| Application | Perl | Perl | 5.20.1 | rc2 | All | All |
| Application | Perl | Perl | 5.20.2 | All | All | All |
| Application | Perl | Perl | 5.20.2 | rc1 | All | All |
| Application | Perl | Perl | 5.20.3 | All | All | All |
| Application | Perl | Perl | 5.20.3 | rc1 | All | All |
| Application | Perl | Perl | 5.20.3 | rc2 | All | All |
| Application | Perl | Perl | 5.21.0 | All | All | All |
| Application | Perl | Perl | 5.21.1 | All | All | All |
| Application | Perl | Perl | 5.21.10 | All | All | All |
| Application | Perl | Perl | 5.21.11 | All | All | All |
| Application | Perl | Perl | 5.21.2 | All | All | All |
| Application | Perl | Perl | 5.21.3 | All | All | All |
| Application | Perl | Perl | 5.21.4 | All | All | All |
| Application | Perl | Perl | 5.21.5 | All | All | All |
| Application | Perl | Perl | 5.21.6 | All | All | All |
| Application | Perl | Perl | 5.21.7 | All | All | All |
| Application | Perl | Perl | 5.21.8 | All | All | All |
| Application | Perl | Perl | 5.21.9 | All | All | All |
| Application | Perl | Perl | 5.22.0 | All | All | All |
| Application | Perl | Perl | 5.22.0 | rc1 | All | All |
| Application | Perl | Perl | 5.22.0 | rc2 | All | All |
| Application | Perl | Perl | 5.22.1 | All | All | All |
| Application | Perl | Perl | 5.22.1 | rc1 | All | All |
| Application | Perl | Perl | 5.22.1 | rc2 | All | All |
| Application | Perl | Perl | 5.22.1 | rc3 | All | All |
| Application | Perl | Perl | 5.22.1 | rc4 | All | All |
| Application | Perl | Perl | 5.22.2 | All | All | All |
| Application | Perl | Perl | 5.22.2 | rc1 | All | All |
| Application | Perl | Perl | 5.22.3 | rc1 | All | All |
| Application | Perl | Perl | 5.24.0 | All | All | All |
| Application | Perl | Perl | 5.24.0 | rc1 | All | All |
| Application | Perl | Perl | 5.24.0 | rc2 | All | All |
| Application | Perl | Perl | 5.24.0 | rc3 | All | All |
| Application | Perl | Perl | 5.24.0 | rc4 | All | All |
| Application | Perl | Perl | 5.24.0 | rc5 | All | All |
| Application | Perl | Perl | 5.24.1 | rc1 | All | All |
| Application | Perl | Perl | 5.6 | All | All | All |
| Application | Perl | Perl | 5.6.0 | All | All | All |
| Application | Perl | Perl | 5.6.1 | All | All | All |
| Application | Perl | Perl | 5.6.2 | All | All | All |
| Application | Perl | Perl | 5.7.3 | All | All | All |
| Application | Perl | Perl | 5.8 | All | All | All |
| Application | Perl | Perl | 5.8.0 | All | All | All |
| Application | Perl | Perl | 5.8.1 | All | All | All |
| Application | Perl | Perl | 5.8.2 | All | All | All |
| Application | Perl | Perl | 5.8.3 | All | All | All |
| Application | Perl | Perl | 5.8.4 | All | All | All |
| Application | Perl | Perl | 5.8.5 | All | All | All |
| Application | Perl | Perl | 5.8.6 | All | All | All |
| Application | Perl | Perl | 5.8.7 | All | All | All |
| Application | Perl | Perl | 5.8.8 | All | All | All |
| Application | Perl | Perl | 5.8.9 | All | All | All |
| Application | Perl | Perl | 5.8.9 | rc1 | All | All |
| Application | Perl | Perl | 5.9.0 | All | All | All |
| Application | Perl | Perl | 5.9.1 | All | All | All |
| Application | Perl | Perl | 5.9.2 | All | All | All |
| Application | Perl | Perl | 5.9.3 | All | All | All |
| Application | Perl | Perl | 5.9.4 | All | All | All |
| Application | Perl | Perl | 5.9.5 | All | All | All |
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| [security-announce] openSUSE-SU-2019:1831-1: moderate: Security update f | af854a3a-2127-422b-91ae-364da2661108 | lists.opensuse.org | Third Party Advisory |
| Document Display | HPE Support Center | af854a3a-2127-422b-91ae-364da2661108 | h20566.www2.hpe.com | Third Party Advisory |
| Perl Includes Directory Bug Lets Local Users Gain Elevated Privileges - SecurityTracker | af854a3a-2127-422b-91ae-364da2661108 | www.securitytracker.com | Third Party Advisory, VDB Entry |
| Apache Mail Archives | af854a3a-2127-422b-91ae-364da2661108 | lists.apache.org | |
| SpamAssassin: Multiple vulnerabilities (GLSA 201812-07) — Gentoo security | af854a3a-2127-422b-91ae-364da2661108 | security.gentoo.org | Third Party Advisory |
| [SECURITY] Fedora 24 Update: perl-5.22.2-362.fc24 - package-announce - Fedora Mailing-Lists | af854a3a-2127-422b-91ae-364da2661108 | lists.fedoraproject.org | |
| Perl: Multiple vulnerabilities (GLSA 201701-75) — Gentoo security | af854a3a-2127-422b-91ae-364da2661108 | security.gentoo.org | Third Party Advisory |
| CVE-2016-1238: Important unsafe module load path flaw - nntp.perl.org | af854a3a-2127-422b-91ae-364da2661108 | www.nntp.perl.org | Third Party Advisory |
| [SECURITY] Fedora 24 Update: perl-Module-Load-Conditional-0.68-1.fc24 - package-announce - Fedora Mailing-Lists | af854a3a-2127-422b-91ae-364da2661108 | lists.fedoraproject.org | |
| Debian -- Security Information -- DSA-3628-1 perl | af854a3a-2127-422b-91ae-364da2661108 | www.debian.org | Third Party Advisory |
| Perl CVE-2016-1238 Local Privilege Escalation Vulnerability | af854a3a-2127-422b-91ae-364da2661108 | www.securityfocus.com | Third Party Advisory, VDB Entry |
| perl5.git.perl.org Git - perl.git/commit | af854a3a-2127-422b-91ae-364da2661108 | perl5.git.perl.org | Issue Tracking |
| [SECURITY] Fedora 23 Update: perl-5.22.2-354.fc23 - package-announce - Fedora Mailing-Lists | af854a3a-2127-422b-91ae-364da2661108 | lists.fedoraproject.org | |
| RT Error | af854a3a-2127-422b-91ae-364da2661108 | rt.perl.org | Permissions Required |
| [SECURITY] [DLA 1578-1] spamassassin security update | af854a3a-2127-422b-91ae-364da2661108 | lists.debian.org | Mailing List, Third Party Advisory |
| [SECURITY] Fedora 23 Update: perl-5.22.2-354.fc23 - package-announce - Fedora Mailing-Lists | MITRE | lists.fedoraproject.org | |
| [SECURITY] Fedora 24 Update: perl-Module-Load-Conditional-0.68-1.fc24 - package-announce - Fedora Mailing-Lists | MITRE | lists.fedoraproject.org | |
| [SECURITY] Fedora 24 Update: perl-5.22.2-362.fc24 - package-announce - Fedora Mailing-Lists | MITRE | lists.fedoraproject.org | |
| Apache Mail Archives | MITRE | lists.apache.org | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.