CVE-2016-2381

CWE-20 — Improper Input Validation10 documents8 sources
Severity
7.5HIGH
EPSS
19.5%
top 4.61%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
10
Oracle Configuration ManagerOracle Timesten In-memory DatabasePerl Perl+7 more
Timeline
PublishedApr 8
Latest updateMay 13

Description

Perl might allow context-dependent attackers to bypass the taint protection mechanism in a child process via duplicate environment variables in envp.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages9 packages

▶NVDperl/perl< 5.23.9
▶Debianperl< 5.22.1-8+3
▶NVDoracle/configuration_manager< 12.1.2.0.4+1
▶NVDoracle/solaris11.3

Also affects: Debian Linux 7.0, 8.0, Ubuntu Linux 12.04, 14.04, 15.10

🔴Vulnerability Details

4
GHSA
GHSA-mmf9-wh8f-2qv3: Perl might allow context-dependent attackers to bypass the taint protection mechanism in a child process via duplicate environment variables in envp↗2022-05-13
▶
CVEList
CVE-2016-2381: Perl might allow context-dependent attackers to bypass the taint protection mechanism in a child process via duplicate environment variables in envp↗2016-04-08
▶
OSV
CVE-2016-2381: Perl might allow context-dependent attackers to bypass the taint protection mechanism in a child process via duplicate environment variables in envp↗2016-04-08
▶
OSV
perl vulnerabilities↗2016-03-02
▶

📋Vendor Advisories

3
Ubuntu
Perl vulnerabilities↗2016-03-02
▶
Red Hat
perl: ambiguous environment variables handling↗2016-03-01
▶
Debian
CVE-2016-2381: perl - Perl might allow context-dependent attackers to bypass the taint protection mech...↗2016
▶

💬Community

2
Bugzilla
CVE-2016-2381 perl: ambiguous environment variables handling [fedora-all]↗2016-03-02
▶
Bugzilla
CVE-2016-2381 perl: ambiguous environment variables handling↗2016-02-17
▶