Description
(1) cpan/Archive-Tar/bin/ptar, (2) cpan/Archive-Tar/bin/ptardiff, (3) cpan/Archive-Tar/bin/ptargrep, (4) cpan/CPAN/scripts/cpan, (5) cpan/Digest-SHA/shasum, (6) cpan/Encode/bin/enc2xs, (7) cpan/Encode/bin/encguess, (8) cpan/Encode/bin/piconv, (9) cpan/Encode/bin/ucmlint, (10) cpan/Encode/bin/unidump, (11) cpan/ExtUtils-MakeMaker/bin/instmodsh, (12) cpan/IO-Compress/bin/zipdetails, (13) cpan/JSON-PP/bin/json_pp, (14) cpan/Test-Harness/bin/prove, (15) dist/ExtUtils-ParseXS/lib/ExtUtils/xsubpp, (16) dist/Module-CoreList/corelist, (17) ext/Pod-Html/bin/pod2html, (18) utils/c2ph.PL, (19) utils/h2ph.PL, (20) utils/h2xs.PL, (21) utils/libnetcfg.PL, (22) utils/perlbug.PL, (23) utils/perldoc.PL, (24) utils/perlivp.PL, and (25) utils/splain.PL in Perl 5.x before 5.22.3-RC2 and 5.24 before 5.24.1-RC2 do not properly remove . (period) characters from the end of the includes directory array, which might allow local users to gain privileges via a Trojan horse module under the current working directory.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | perl | 5.22.2-3 | — |
| Debian 13 | perl | 5.22.2-3 | — |
| Debian 12 | perl | 5.22.2-3 | — |
| Debian 8 | perl | 5.20.2-3+deb8u6 | DSA-3628-1 |
| Debian 8 | spamassassin | 3.4.2-0+deb8u1 | DLA-1578-1 |
| Debian 7 | libsys-syslog-perl | 0.29-1+deb7u1 | DLA-584-1 |
| Debian 7 | perl | 5.14.2-21+deb7u4 | DLA-565-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 14.04 LTS | libsys-syslog-perl | 0.33-1+deb8u1build0.14.04.1 | — |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 16.04 LTS | perl | No fix yet | — |
| Ubuntu Pro 14.04 LTS | perl | No fix yet | — |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 | amavisd-new | 2.11.1-6.3.1 | SUSE-SU-2019:0505-1 |
| SLES 15 | spamassassin | 3.4.2-7.4.1 | SUSE-SU-2019:2011-1 |
| SLES 12 SP4 | spamassassin | 3.4.2-44.3.1 | SUSE-SU-2019:1961-1 |
| SLES 12 SP1 | perl | 5.18.2-11.1 | SUSE-SU-2016:2263-1 |
| SLES 11 SP4 | perl | 5.10.0-64.80.1 | SUSE-SU-2016:2246-1 |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 12 SP4 | spamassassin | 3.4.2-44.3.1 | SUSE-SU-2019:1961-1 |
| SLES for SAP 12 SP1 | perl | 5.18.2-11.1 | SUSE-SU-2016:2263-1 |
| SLES for SAP 11 SP4 | perl | 5.10.0-64.80.1 | SUSE-SU-2016:2246-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | ikiwiki | 3.20200202.3-2.7 | openSUSE-SU-2024:10860-1 |
| openSUSE Tumbleweed | perl-ExtUtils-MakeMaker | 7.64-1.1 | openSUSE-SU-2024:11706-1 |
| openSUSE Tumbleweed | perl-IO-Compress | 2.213.0-1.1 | openSUSE-SU-2025:14657-1 |
| openSUSE Tumbleweed | perl-MIME-Charset | 1.012.2-1.16 | openSUSE-SU-2024:11162-1 |
| openSUSE Tumbleweed | perl-Test-File | 1.448-1.5 | openSUSE-SU-2024:11163-1 |
| openSUSE Leap 15.0 | spamassassin | 3.4.2-lp150.6.3.1 | openSUSE-SU-2019:1831-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | spamassassin | 3.4.2-r0 | — |
| Alpine v3.23 | spamassassin | 3.4.2-r0 | — |
| Alpine v3.22 | spamassassin | 3.4.2-r0 | — |
| Alpine v3.21 | spamassassin | 3.4.2-r0 | — |
| Alpine v3.20 | spamassassin | 3.4.2-r0 | — |
Show 14 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | spamassassin | 3.4.2-r0 | — |
| Alpine v3.18 | spamassassin | 3.4.2-r0 | — |
| Alpine v3.17 | spamassassin | 3.4.2-r0 | — |
| Alpine v3.16 | spamassassin | 3.4.2-r0 | — |
| Alpine v3.15 | spamassassin | 3.4.2-r0 | — |
| Alpine v3.14 | spamassassin | 3.4.2-r0 | — |
| Alpine v3.13 | spamassassin | 3.4.2-r0 | — |
| Alpine v3.12 | spamassassin | 3.4.2-r0 | — |
| Alpine v3.11 | spamassassin | 3.4.2-r0 | — |
| Alpine v3.10 | spamassassin | 3.4.2-r0 | — |
| Alpine v3.9 | spamassassin | 3.4.2-r0 | — |
| Alpine v3.8 | spamassassin | 3.4.3-r0 | — |
| Alpine v3.4 | perl | 5.22.3-r0 | — |
| Alpine v3.3 | perl | 5.22.3-r0 | — |
Advisories 16
- DLA-584-1 libsys-syslog-perl - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-565-1 perl - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-3628-1 perl - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-1578-1 spamassassin - security update Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2025:14657-1 perl-IO-Compress-2.213.0-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2019:1831-1 Security update for spamassassin SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:11706-1 perl-ExtUtils-MakeMaker-7.64-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2016:2246-1 Security update for perl SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2019:2011-1 Security update for spamassassin SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2019:0505-1 Security update for amavisd-new SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2019:1961-1 Security update for spamassassin SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:11162-1 perl-MIME-Charset-1.012.2-1.16 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2016:2263-1 Security update for perl SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:11163-1 perl-Test-File-1.448-1.5 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10860-1 ikiwiki-3.20200202.3-2.7 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2025-0118 Perl: Schwachstelle ermöglicht Privilegieneskalation BSI CERT-Bund (WID) · Jan 19, 2025
References
- GLSA-201701-75 vendor-advisory
- GLSA-201812-07 vendor-advisory
- http://perl5.git.perl.org/perl.git/commit/cee96d52c39b1e7b36e1c62d38bcd8d86e9a41ab
- 1036440 vdb-entry
- DSA-3628 vendor-advisory
- [announce] 20180916 [SECURITY] Apache SpamAssassin 3.4.2 resolves CVE-2017-15705, CVE-2016-1238, CVE-2018-11780 & CVE-2018-11781 mailing-list
- FEDORA-2016-6ec2009080 vendor-advisory
- [perl.perl5.porters] 20160725 CVE-2016-1238: Important unsafe module load path flaw mailing-list
- FEDORA-2016-e9e5c081d4 vendor-advisory
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05240731
- FEDORA-2016-dd20a4631a vendor-advisory
- 92136 vdb-entry
- [debian-lts-announce] 20181113 [SECURITY] [DLA 1578-1] spamassassin security update mailing-list
- https://rt.perl.org/Public/Bug/Display.html?id=127834
- openSUSE-SU-2019:1831 vendor-advisory