CVE-2016-6185
HIGH 7.8EPSS 0.8%
The XSLoader::load method in XSLoader in Perl does not properly locate .so files when called in a string eval, which might allow local users to execute arbitrary code via a Trojan horse library under the current working directory.
- CVSS v3.1 NVD
- 7.8 HIGH
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - CVSS v2.0 NVD
- 4.6 MEDIUM
AV:L/AC:L/Au:N/C:P/I:P/A:P - EPSS
- 0.79% chance of exploitation in the next 30 days, 55th percentile
- Published
- 2016-08-02
- Updated
- 2024-08-06
Proof-of-concept exploits (1)
Security advisories
- http://perl5.git.perl.org/perl.git/commitdiff/08e3451d7
- http://www.debian.org/security/2016/dsa-3628
- http://www.openwall.com/lists/oss-security/2016/07/07/1
- http://www.openwall.com/lists/oss-security/2016/07/08/5
- http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html
- http://www.securityfocus.com/bid/91685
- http://www.securitytracker.com/id/1036260
- https://security.gentoo.org/glsa/201701-75
- https://usn.ubuntu.com/3625-1
- https://usn.ubuntu.com/3625-2