CVE-2016-2381

Perl might allow context-dependent attackers to bypass the taint protection mechanism in a child...

7.5 HighFix available

Perl might allow context-dependent attackers to bypass the taint protection mechanism in a child process via duplicate environment variables in envp.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: High
Availability: None

Exploit likelihood

9.08%Up 6.4 points since Feb 4, 2022

What each source reports

NVD Score used 7.5

Perl might allow context-dependent attackers to bypass the taint protection mechanism in a child process via duplicate environment variables in envp.

Record: CVE-2016-2381
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS 2.0: 5.0 MediumAV:N/AC:L/Au:N/C:N/I:P/A:N
Weakness: CWE-20
Updated: 2026-11-02

CVE List No score

Perl might allow context-dependent attackers to bypass the taint protection mechanism in a child process via duplicate environment variables in envp.

Record: CVE-2016-2381
Updated: 2026-11-02

EUVDEUVD-2016-3465 No score

Perl might allow context-dependent attackers to bypass the taint protection mechanism in a child process via duplicate environment variables in envp.

Record: EUVD-2016-3465
Updated: 2026-11-03

GitHub AdvisoriesGHSA-mmf9-wh8f-2qv3 7.5

Perl might allow context-dependent attackers to bypass the taint protection mechanism in a child...

Perl might allow context-dependent attackers to bypass the taint protection mechanism in a child process via duplicate environment variables in envp.

Record: GHSA-mmf9-wh8f-2qv3
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weakness: CWE-20
Updated: 2026-11-02

OSV 7.5

Perl might allow context-dependent attackers to bypass the taint protection mechanism in a child process via duplicate environment variables in envp.

Record: CVE-2016-2381
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated: 2026-11-02

OSVDEBIAN-CVE-2016-2381 7.5

Perl might allow context-dependent attackers to bypass the taint protection mechanism in a child process via duplicate environment variables in envp.

Record: DEBIAN-CVE-2016-2381
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated: 2026-11-02

Show 8 moreShow less

OSVRHSA-2026:6206 8.2

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record: RHSA-2026:6206
CVSS 3.1: 8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2016-2381 7.5

Perl might allow context-dependent attackers to bypass the taint protection mechanism in a child process via duplicate environment variables in envp.

Record: UBUNTU-CVE-2016-2381
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS 3.0: 6.5 MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Updated: 2026-11-02

OSVMGASA-2016-0099 No score

Updated perl packages fix CVE-2016-2381

Updated perl packages fix security vulnerability:

Stephane Chazelas discovered a bug in the environment handling in Perl. Perl provides a Perl-space hash variable, %ENV, in which environment variables can be looked up. If a variable appears twice in envp, only the last value would appear in %ENV, but getenv would return the first. Perl's taint security mechanism would be applied to the value in %ENV, but not to the other rest of the environment. This could result in an ambiguous environment causing environment variables to be propagated to subprocesses, despite the protections supposedly offered by taint checking (CVE-2016-2381).

Record: MGASA-2016-0099
Updated: 2026-11-02

OSVSUSE-SU-2016:2246-1 No score

Security update for perl

This update for perl fixes the following issues:

CVE-2016-6185: xsloader looking at a '(eval)' directory [bsc#988311]
CVE-2016-1238: searching current directory for optional modules [bsc#987887]
CVE-2015-8853: regex engine hanging on bad utf8 [bnc976584]
CVE-2016-2381: environment dup handling bug [bsc#967082]
perl panic with utf8_mg_pos_cache_update [bsc#929027]

Record: SUSE-SU-2016:2246-1
Updated: 2026-11-02

OSVSUSE-SU-2016:2263-1 No score

Security update for perl

This update for Perl fixes the following issues:

CVE-2016-6185: Xsloader looking at a '(eval)' directory. (bsc#988311)
CVE-2016-1238: Searching current directory for optional modules. (bsc#987887)
CVE-2015-8853: Regular expression engine hanging on bad utf8. (bsc)
CVE-2016-2381: Environment dup handling bug. (bsc#967082)
'Insecure dependency in require' error in taint mode. (bsc#984906)
Memory leak in 'use utf8' handling. (bsc#928292)
Missing lock prototype to the debugger. (bsc#932894)

Record: SUSE-SU-2016:2263-1
Updated: 2026-11-02

OSVSUSE-SU-2017:2699-1 No score

Security update for SLES 12 Docker image

The SUSE Linux Enterprise Server 12 container image has been updated to include security and stability fixes.

The following issues related to building of the container images have been fixed:

Included krb5 package to avoid the inclusion of krb5-mini which gets selected as a dependency by the Build Service solver. (bsc#1056193)
Do not install recommended packages when building container images. (bsc#975726)

A number of security issues that have been already fixed by updates released for SUSE Linux Enterprise Server 12 are now included in the base image. A package/CVE cross-reference is available below.

pam:

CVE-2015-3238

libtasn1:

CVE-2015-3622
CVE-2016-4008

libidn:

CVE-2015-2059
CVE-2015-8948
CVE-2016-6261
CVE-2016-6262
CVE-2016-6263

zlib:

CVE-2016-9840
CVE-2016-9841
CVE-2016-9842
CVE-2016-9843

curl:

CVE-2016-5419
CVE-2016-5420
CVE-2016-5421
CVE-2016-7141
CVE-2016-7167
CVE-2016-8615
CVE-2016-8616
CVE-2016-8617
CVE-2016-8618
CVE-2016-8619
CVE-2016-8620
CVE-2016-8621
CVE-2016-8622
CVE-2016-8623
CVE-2016-8624
CVE-2016-9586
CVE-2017-1000100
CVE-2017-1000101
CVE-2017-7407

openssl:

CVE-2016-2105
CVE-2016-2106
CVE-2016-2107
CVE-2016-2108
CVE-2016-2109
CVE-2016-2177
CVE-2016-2178
CVE-2016-2179
CVE-2016-2180
CVE-2016-2181
CVE-2016-2182
CVE-2016-2183
CVE-2016-6302
CVE-2016-6303
CVE-2016-6304
CVE-2016-6306

libxml2:

CVE-2014-0191
CVE-2015-8806
CVE-2016-1762
CVE-2016-1833
CVE-2016-1834
CVE-2016-1835
CVE-2016-1837
CVE-2016-1838
CVE-2016-1839
CVE-2016-1840
CVE-2016-2073
CVE-2016-3627
CVE-2016-3705
CVE-2016-4447
CVE-2016-4448
CVE-2016-4449
CVE-2016-4483
CVE-2016-4658
CVE-2016-9318
CVE-2016-9597
CVE-2017-9047
CVE-2017-9048
CVE-2017-9049
CVE-2017-9050

util-linux:

CVE-2015-5218
CVE-2016-5011
CVE-2017-2616

cracklib:

CVE-2016-6318

systemd:

CVE-2014-9770
CVE-2015-8842
CVE-2016-7796

pcre:

CVE-2014-8964
CVE-2015-2325
CVE-2015-2327
CVE-2015-2328
CVE-2015-3210
CVE-2015-3217
CVE-2015-5073
CVE-2015-8380
CVE-2015-8381
CVE-2015-8382
CVE-2015-8383
CVE-2015-8384
CVE-2015-8385
CVE-2015-8386
CVE-2015-8387
CVE-2015-8388
CVE-2015-8389
CVE-2015-8390
CVE-2015-8391
CVE-2015-8392
CVE-2015-8393
CVE-2015-8394
CVE-2015-8395
CVE-2016-1283
CVE-2016-3191

appamor:

CVE-2017-6507

bash:

CVE-2014-6277
CVE-2014-6278
CVE-2016-0634
CVE-2016-7543

cpio:

CVE-2016-2037

glibc:

CVE-2016-1234
CVE-2016-3075
CVE-2016-3706
CVE-2016-4429
CVE-2017-1000366

perl:

CVE-2015-8853
CVE-2016-1238
CVE-2016-2381
CVE-2016-6185

libssh2_org:

CVE-2016-0787

expat:

CVE-2012-6702
CVE-2015-1283
CVE-2016-0718
CVE-2016-5300
CVE-2016-9063
CVE-2017-9233

ncurses:

CVE-2017-10684
CVE-2017-10685
CVE-2017-11112
CVE-2017-11113

libksba:

CVE-2016-4574
CVE-2016-4579

libgcrypt:

CVE-2015-7511
CVE-2016-6313
CVE-2017-7526

dbus-1:

CVE-2014-7824
CVE-2015-0245

Finally, the following packages received non-security fixes:

augeas
bzip2
ca-certificates-mozilla
coreutils
cryptsetup
cyrus-sasl
dirmngr
e2fsprogs
findutils
gpg2
insserv-compat
kmod
libcap
libsolv
libzypp
openldap2
p11-kit
permissions
procps
rpm
sed
shadow
zypper

Record: SUSE-SU-2017:2699-1
Updated: 2026-11-02

OSVSUSE-SU-2017:2700-1 No score

Security update for SLES 12-SP1 Docker image

The SUSE Linux Enterprise Server 12 SP1 container image has been updated to include security and stability fixes.

The following issues related to building of the container images have been fixed:

Included krb5 package to avoid the inclusion of krb5-mini which gets selected as a dependency by the Build Service solver. (bsc#1056193)
Do not install recommended packages when building container images. (bsc#975726)

A number of security issues that have been already fixed by updates released for SUSE Linux Enterprise Server 12 SP1 are now included in the base image. A package/CVE cross-reference is available below.

pam:

CVE-2015-3238

libtasn1:

CVE-2015-3622
CVE-2016-4008

expat:

CVE-2012-6702
CVE-2015-1283
CVE-2016-0718
CVE-2016-5300
CVE-2016-9063
CVE-2017-9233

libidn:

CVE-2015-2059
CVE-2015-8948
CVE-2016-6261
CVE-2016-6262
CVE-2016-6263

zlib:

CVE-2016-9840
CVE-2016-9841
CVE-2016-9842
CVE-2016-9843

curl:

CVE-2016-5419
CVE-2016-5420
CVE-2016-5421
CVE-2016-7141
CVE-2016-7167
CVE-2016-8615
CVE-2016-8616
CVE-2016-8617
CVE-2016-8618
CVE-2016-8619
CVE-2016-8620
CVE-2016-8621
CVE-2016-8622
CVE-2016-8623
CVE-2016-8624
CVE-2016-9586
CVE-2017-1000100
CVE-2017-1000101
CVE-2017-7407

openssl:

CVE-2016-2105
CVE-2016-2106
CVE-2016-2107
CVE-2016-2108
CVE-2016-2109
CVE-2016-2177
CVE-2016-2178
CVE-2016-2179
CVE-2016-2180
CVE-2016-2181
CVE-2016-2182
CVE-2016-2183
CVE-2016-6302
CVE-2016-6303
CVE-2016-6304
CVE-2016-6306
CVE-2016-7056
CVE-2016-8610
CVE-2017-3731

cracklib:

CVE-2016-6318

pcre:

CVE-2014-8964
CVE-2015-2325
CVE-2015-2327
CVE-2015-2328
CVE-2015-3210
CVE-2015-3217
CVE-2015-5073
CVE-2015-8380
CVE-2015-8381
CVE-2015-8382
CVE-2015-8383
CVE-2015-8384
CVE-2015-8385
CVE-2015-8386
CVE-2015-8387
CVE-2015-8388
CVE-2015-8389
CVE-2015-8390
CVE-2015-8391
CVE-2015-8392
CVE-2015-8393
CVE-2015-8394
CVE-2015-8395
CVE-2016-1283
CVE-2016-3191

appamor:

CVE-2017-6507

bash:

CVE-2014-6277
CVE-2014-6278
CVE-2016-0634
CVE-2016-7543

cpio:

CVE-2016-2037

glibc:

CVE-2016-1234
CVE-2016-3075
CVE-2016-3706
CVE-2016-4429
CVE-2017-1000366

perl:

CVE-2015-8853
CVE-2016-1238
CVE-2016-2381
CVE-2016-6185

libssh2_org:

CVE-2016-0787

util-linux:

CVE-2016-5011
CVE-2017-2616

ncurses:

CVE-2017-10684
CVE-2017-10685
CVE-2017-11112
CVE-2017-11113

libksba:

CVE-2016-4574
CVE-2016-4579

libxml2:

CVE-2014-0191
CVE-2015-8806
CVE-2016-1762
CVE-2016-1833
CVE-2016-1834
CVE-2016-1835
CVE-2016-1837
CVE-2016-1838
CVE-2016-1839
CVE-2016-1840
CVE-2016-2073
CVE-2016-3627
CVE-2016-3705
CVE-2016-4447
CVE-2016-4448
CVE-2016-4449
CVE-2016-4483
CVE-2016-4658
CVE-2016-9318
CVE-2016-9597
CVE-2017-9047
CVE-2017-9048
CVE-2017-9049
CVE-2017-9050

libgcrypt:

CVE-2015-7511
CVE-2016-6313
CVE-2017-7526

update-alternatives:

CVE-2015-0860

systemd:

CVE-2014-9770
CVE-2015-8842
CVE-2016-7796

dbus-1:

CVE-2014-7824
CVE-2015-0245

Finally, the following packages received non-security fixes:

augeas
bzip2
ca-certificates-mozilla
coreutils
cryptsetup
cyrus-sasl
dirmngr
e2fsprogs
findutils
gpg2
insserv-compat
kmod
libcap
libsolv
libzypp
lua51
lvm2
netcfg
p11-kit
permissions
procps
rpm
sed
sg3_utils
shadow
zypper

Record: SUSE-SU-2017:2700-1
Updated: 2026-11-02

OSVUSN-2916-1 No score

perl vulnerabilities

It was discovered that Perl incorrectly handled certain regular expressions with an invalid backreference. An attacker could use this issue to cause Perl to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2013-7422)

Markus Vervier discovered that Perl incorrectly handled nesting in the Data::Dumper module. An attacker could use this issue to cause Perl to consume memory and crash, resulting in a denial of service. (CVE-2014-4330)

Stephane Chazelas discovered that Perl incorrectly handled duplicate environment variables. An attacker could possibly use this issue to bypass the taint protection mechanism. (CVE-2016-2381)

Record: USN-2916-1
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`perl` Debian:12	before 5.22.1-8	5.22.1-8
`perl` Debian:13	before 5.22.1-8	5.22.1-8
`perl` Debian:14	before 5.22.1-8	5.22.1-8
`perl` Debian:7	before 5.14.2-21+deb7u3, plus listed versions 5.14.2-215.14.2-21+deb7u15.14.2-21+deb7u2	5.14.2-21+deb7u3
`perl` Debian:8	before 5.20.2-3+deb8u4, plus listed versions 5.20.2-35.20.2-3+deb8u15.20.2-3+deb8u25.20.2-3+deb8u35.20.2-3+deb8u3+kbsd1	5.20.2-3+deb8u4
`perl` Mageia:5	before 5.20.1-8.2.mga5	5.20.1-8.2.mga5
`perl` Red Hat:hummingbird:1	before 0:5.42.2-524.hum1	0:5.42.2-524.hum1
`perl-Attribute-Handlers` Red Hat:hummingbird:1	before 0:1.03-524.hum1	0:1.03-524.hum1
`perl-AutoLoader` Red Hat:hummingbird:1	before 0:5.74-524.hum1	0:5.74-524.hum1
`perl-AutoSplit` Red Hat:hummingbird:1	before 0:5.74-524.hum1	0:5.74-524.hum1

Show 104 moreShow less

Affected packages
Package	Affected	Fixed
`perl-B` Red Hat:hummingbird:1	before 0:1.89-524.hum1	0:1.89-524.hum1
`perl-Benchmark` Red Hat:hummingbird:1	before 0:1.27-524.hum1	0:1.27-524.hum1
`perl-Class-Struct` Red Hat:hummingbird:1	before 0:0.68-524.hum1	0:0.68-524.hum1
`perl-Config-Extensions` Red Hat:hummingbird:1	before 0:0.03-524.hum1	0:0.03-524.hum1
`perl-DBM_Filter` Red Hat:hummingbird:1	before 0:0.07-524.hum1	0:0.07-524.hum1
`perl-Devel-Peek` Red Hat:hummingbird:1	before 0:1.36-524.hum1	0:1.36-524.hum1
`perl-Devel-SelfStubber` Red Hat:hummingbird:1	before 0:1.06-524.hum1	0:1.06-524.hum1
`perl-DirHandle` Red Hat:hummingbird:1	before 0:1.05-524.hum1	0:1.05-524.hum1
`perl-Dumpvalue` Red Hat:hummingbird:1	before 0:2.27-524.hum1	0:2.27-524.hum1
`perl-DynaLoader` Red Hat:hummingbird:1	before 0:1.57-524.hum1	0:1.57-524.hum1
`perl-English` Red Hat:hummingbird:1	before 0:1.11-524.hum1	0:1.11-524.hum1
`perl-Errno` Red Hat:hummingbird:1	before 0:1.38-524.hum1	0:1.38-524.hum1
`perl-ExtUtils-Constant` Red Hat:hummingbird:1	before 0:0.25-524.hum1	0:0.25-524.hum1
`perl-ExtUtils-Embed` Red Hat:hummingbird:1	before 0:1.35-524.hum1	0:1.35-524.hum1
`perl-ExtUtils-Miniperl` Red Hat:hummingbird:1	before 0:1.14-524.hum1	0:1.14-524.hum1
`perl-Fcntl` Red Hat:hummingbird:1	before 0:1.20-524.hum1	0:1.20-524.hum1
`perl-File-Basename` Red Hat:hummingbird:1	before 0:2.86-524.hum1	0:2.86-524.hum1
`perl-File-Compare` Red Hat:hummingbird:1	before 0:1.100.800-524.hum1	0:1.100.800-524.hum1
`perl-File-Copy` Red Hat:hummingbird:1	before 0:2.41-524.hum1	0:2.41-524.hum1
`perl-File-DosGlob` Red Hat:hummingbird:1	before 0:1.12-524.hum1	0:1.12-524.hum1
`perl-File-Find` Red Hat:hummingbird:1	before 0:1.44-524.hum1	0:1.44-524.hum1
`perl-File-stat` Red Hat:hummingbird:1	before 0:1.14-524.hum1	0:1.14-524.hum1
`perl-FileCache` Red Hat:hummingbird:1	before 0:1.10-524.hum1	0:1.10-524.hum1
`perl-FileHandle` Red Hat:hummingbird:1	before 0:2.05-524.hum1	0:2.05-524.hum1
`perl-FindBin` Red Hat:hummingbird:1	before 0:1.54-524.hum1	0:1.54-524.hum1
`perl-GDBM_File` Red Hat:hummingbird:1	before 0:1.24-524.hum1	0:1.24-524.hum1
`perl-Getopt-Std` Red Hat:hummingbird:1	before 0:1.14-524.hum1	0:1.14-524.hum1
`perl-Hash-Util` Red Hat:hummingbird:1	before 0:0.32-524.hum1	0:0.32-524.hum1
`perl-Hash-Util-FieldHash` Red Hat:hummingbird:1	before 0:1.27-524.hum1	0:1.27-524.hum1
`perl-I18N-Collate` Red Hat:hummingbird:1	before 0:1.02-524.hum1	0:1.02-524.hum1
`perl-I18N-LangTags` Red Hat:hummingbird:1	before 0:0.45-524.hum1	0:0.45-524.hum1
`perl-I18N-Langinfo` Red Hat:hummingbird:1	before 0:0.24-524.hum1	0:0.24-524.hum1
`perl-IO` Red Hat:hummingbird:1	before 0:1.55-524.hum1	0:1.55-524.hum1
`perl-IPC-Open3` Red Hat:hummingbird:1	before 0:1.24-524.hum1	0:1.24-524.hum1
`perl-Locale-Maketext-Simple` Red Hat:hummingbird:1	before 0:0.21-524.hum1	0:0.21-524.hum1
`perl-Math-Complex` Red Hat:hummingbird:1	before 0:1.63-524.hum1	0:1.63-524.hum1
`perl-Memoize` Red Hat:hummingbird:1	before 0:1.17-524.hum1	0:1.17-524.hum1
`perl-Module-Loaded` Red Hat:hummingbird:1	before 0:0.08-524.hum1	0:0.08-524.hum1
`perl-NDBM_File` Red Hat:hummingbird:1	before 0:1.18-524.hum1	0:1.18-524.hum1
`perl-NEXT` Red Hat:hummingbird:1	before 0:0.69-524.hum1	0:0.69-524.hum1
`perl-Net` Red Hat:hummingbird:1	before 0:1.04-524.hum1	0:1.04-524.hum1
`perl-ODBM_File` Red Hat:hummingbird:1	before 0:1.20-524.hum1	0:1.20-524.hum1
`perl-Opcode` Red Hat:hummingbird:1	before 0:1.69-524.hum1	0:1.69-524.hum1
`perl-POSIX` Red Hat:hummingbird:1	before 0:2.23-524.hum1	0:2.23-524.hum1
`perl-Pod-Functions` Red Hat:hummingbird:1	before 0:1.14-524.hum1	0:1.14-524.hum1
`perl-Pod-Html` Red Hat:hummingbird:1	before 0:1.35-524.hum1	0:1.35-524.hum1
`perl-Safe` Red Hat:hummingbird:1	before 0:2.47-524.hum1	0:2.47-524.hum1
`perl-Search-Dict` Red Hat:hummingbird:1	before 0:1.08-524.hum1	0:1.08-524.hum1
`perl-SelectSaver` Red Hat:hummingbird:1	before 0:1.02-524.hum1	0:1.02-524.hum1
`perl-SelfLoader` Red Hat:hummingbird:1	before 0:1.28-524.hum1	0:1.28-524.hum1
`perl-Symbol` Red Hat:hummingbird:1	before 0:1.09-524.hum1	0:1.09-524.hum1
`perl-Sys-Hostname` Red Hat:hummingbird:1	before 0:1.25-524.hum1	0:1.25-524.hum1
`perl-Term-Complete` Red Hat:hummingbird:1	before 0:1.403-524.hum1	0:1.403-524.hum1
`perl-Term-ReadLine` Red Hat:hummingbird:1	before 0:1.17-524.hum1	0:1.17-524.hum1
`perl-Test` Red Hat:hummingbird:1	before 0:1.31-524.hum1	0:1.31-524.hum1
`perl-Text-Abbrev` Red Hat:hummingbird:1	before 0:1.02-524.hum1	0:1.02-524.hum1
`perl-Thread` Red Hat:hummingbird:1	before 0:3.06-524.hum1	0:3.06-524.hum1
`perl-Thread-Semaphore` Red Hat:hummingbird:1	before 0:2.13-524.hum1	0:2.13-524.hum1
`perl-Tie` Red Hat:hummingbird:1	before 0:4.6-524.hum1	0:4.6-524.hum1
`perl-Tie-File` Red Hat:hummingbird:1	before 0:1.10-524.hum1	0:1.10-524.hum1
`perl-Tie-Memoize` Red Hat:hummingbird:1	before 0:1.1-524.hum1	0:1.1-524.hum1
`perl-Time` Red Hat:hummingbird:1	before 0:1.04-524.hum1	0:1.04-524.hum1
`perl-Time-Piece` Red Hat:hummingbird:1	before 0:1.3600-524.hum1	0:1.3600-524.hum1
`perl-Unicode-UCD` Red Hat:hummingbird:1	before 0:0.81-524.hum1	0:0.81-524.hum1
`perl-User-pwent` Red Hat:hummingbird:1	before 0:1.05-524.hum1	0:1.05-524.hum1
`perl-autouse` Red Hat:hummingbird:1	before 0:1.11-524.hum1	0:1.11-524.hum1
`perl-base` Red Hat:hummingbird:1	before 0:2.27-524.hum1	0:2.27-524.hum1
`perl-blib` Red Hat:hummingbird:1	before 0:1.07-524.hum1	0:1.07-524.hum1
`perl-debugger` Red Hat:hummingbird:1	before 0:1.60-524.hum1	0:1.60-524.hum1
`perl-deprecate` Red Hat:hummingbird:1	before 0:0.04-524.hum1	0:0.04-524.hum1
`perl-devel` Red Hat:hummingbird:1	before 0:5.42.2-524.hum1	0:5.42.2-524.hum1
`perl-diagnostics` Red Hat:hummingbird:1	before 0:1.40-524.hum1	0:1.40-524.hum1
`perl-doc` Red Hat:hummingbird:1	before 0:5.42.2-524.hum1	0:5.42.2-524.hum1
`perl-encoding-warnings` Red Hat:hummingbird:1	before 0:0.14-524.hum1	0:0.14-524.hum1
`perl-fields` Red Hat:hummingbird:1	before 0:2.27-524.hum1	0:2.27-524.hum1
`perl-filetest` Red Hat:hummingbird:1	before 0:1.03-524.hum1	0:1.03-524.hum1
`perl-if` Red Hat:hummingbird:1	before 0:0.61.000-524.hum1	0:0.61.000-524.hum1
`perl-interpreter` Red Hat:hummingbird:1	before 0:5.42.2-524.hum1	0:5.42.2-524.hum1
`perl-less` Red Hat:hummingbird:1	before 0:0.03-524.hum1	0:0.03-524.hum1
`perl-lib` Red Hat:hummingbird:1	before 0:0.65-524.hum1	0:0.65-524.hum1
`perl-libnetcfg` Red Hat:hummingbird:1	before 0:5.42.2-524.hum1	0:5.42.2-524.hum1
`perl-libs` Red Hat:hummingbird:1	before 0:5.42.2-524.hum1	0:5.42.2-524.hum1
`perl-locale` Red Hat:hummingbird:1	before 0:1.13-524.hum1	0:1.13-524.hum1
`perl-macros` Red Hat:hummingbird:1	before 0:5.42.2-524.hum1	0:5.42.2-524.hum1
`perl-meta-notation` Red Hat:hummingbird:1	before 0:5.42.2-524.hum1	0:5.42.2-524.hum1
`perl-mro` Red Hat:hummingbird:1	before 0:1.29-524.hum1	0:1.29-524.hum1
`perl-open` Red Hat:hummingbird:1	before 0:1.13-524.hum1	0:1.13-524.hum1
`perl-overload` Red Hat:hummingbird:1	before 0:1.40-524.hum1	0:1.40-524.hum1
`perl-overloading` Red Hat:hummingbird:1	before 0:0.02-524.hum1	0:0.02-524.hum1
`perl-ph` Red Hat:hummingbird:1	before 0:5.42.2-524.hum1	0:5.42.2-524.hum1
`perl-sigtrap` Red Hat:hummingbird:1	before 0:1.10-524.hum1	0:1.10-524.hum1
`perl-sort` Red Hat:hummingbird:1	before 0:2.06-524.hum1	0:2.06-524.hum1
`perl-subs` Red Hat:hummingbird:1	before 0:1.04-524.hum1	0:1.04-524.hum1
`perl-tests` Red Hat:hummingbird:1	before 0:5.42.2-524.hum1	0:5.42.2-524.hum1
`perl-utils` Red Hat:hummingbird:1	before 0:5.42.2-524.hum1	0:5.42.2-524.hum1
`perl-vars` Red Hat:hummingbird:1	before 0:1.05-524.hum1	0:1.05-524.hum1
`perl-vmsish` Red Hat:hummingbird:1	before 0:1.04-524.hum1	0:1.04-524.hum1
`perl` SUSE:Linux Enterprise Software Development Kit 11 SP4	before 5.10.0-64.80.1	5.10.0-64.80.1
`perl` SUSE:Linux Enterprise Server 11 SP4	before 5.10.0-64.80.1	5.10.0-64.80.1
`perl` SUSE:Linux Enterprise Server for SAP Applications 11 SP4	before 5.10.0-64.80.1	5.10.0-64.80.1
`perl` SUSE:Linux Enterprise Desktop 12 SP1	before 5.18.2-11.1	5.18.2-11.1
`perl` SUSE:Linux Enterprise Server 12 SP1	before 5.18.2-11.1	5.18.2-11.1
`perl` SUSE:Linux Enterprise Server for SAP Applications 12 SP1	before 5.18.2-11.1	5.18.2-11.1
`perl` Ubuntu:14.04:LTS	before 5.18.2-2ubuntu1.1, plus listed versions 5.14.2-21build15.18.1-45.18.1-4build15.18.1-55.18.2-25.18.2-2ubuntu1	5.18.2-2ubuntu1.1

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2016-2381 is a high vulnerability (CVSS 7.5) in Perl, published March 1, 2016. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 9.08%, the 95th percentile. Fixed in perl 5.22.1-8.

References

Show 194 moreShow less

This page doesn't list everything

Left out here: 18 references. The JSON record has them.