{"id":"CVE-2016-1238","aliases":["ALPINE-CVE-2016-1238","BELL-CVE-2016-1238","DEBIAN-CVE-2016-1238","DLA-1578-1","DLA-565-1","DLA-584-1","DSA-3628-1","EUVD-2016-2339","GHSA-hm5v-6984-hfqp","MGASA-2018-0047","MGASA-2018-0425","SUSE-SU-2016:2246-1","SUSE-SU-2016:2263-1","SUSE-SU-2017:2699-1","SUSE-SU-2017:2700-1","SUSE-SU-2019:0505-1","SUSE-SU-2019:1961-1","SUSE-SU-2019:2011-1","UBUNTU-CVE-2016-1238","openSUSE-SU-2019:0297-1","openSUSE-SU-2019:1831-1","openSUSE-SU-2024:10523-1","openSUSE-SU-2024:10614-1","openSUSE-SU-2024:10860-1","openSUSE-SU-2024:11162-1","openSUSE-SU-2024:11163-1","openSUSE-SU-2024:11706-1","openSUSE-SU-2025:14657-1"],"status":"published","title":"(1) cpan/Archive-Tar/bin/ptar, (2) cpan/Archive-Tar/bin/ptardiff, (3) cpan/Archive-Tar/bin...","description":"(1) cpan/Archive-Tar/bin/ptar, (2) cpan/Archive-Tar/bin/ptardiff, (3) cpan/Archive-Tar/bin/ptargrep, (4) cpan/CPAN/scripts/cpan, (5) cpan/Digest-SHA/shasum, (6) cpan/Encode/bin/enc2xs, (7) cpan/Encode/bin/encguess, (8) cpan/Encode/bin/piconv, (9) cpan/Encode/bin/ucmlint, (10) cpan/Encode/bin/unidump, (11) cpan/ExtUtils-MakeMaker/bin/instmodsh, (12) cpan/IO-Compress/bin/zipdetails, (13) cpan/JSON-PP/bin/json_pp, (14) cpan/Test-Harness/bin/prove, (15) dist/ExtUtils-ParseXS/lib/ExtUtils/xsubpp, (16) dist/Module-CoreList/corelist, (17) ext/Pod-Html/bin/pod2html, (18) utils/c2ph.PL, (19) utils/h2ph.PL, (20) utils/h2xs.PL, (21) utils/libnetcfg.PL, (22) utils/perlbug.PL, (23) utils/perldoc.PL, (24) utils/perlivp.PL, and (25) utils/splain.PL in Perl 5.x before 5.22.3-RC2 and 5.24 before 5.24.1-RC2 do not properly remove . (period) characters from the end of the includes directory array, which might allow local users to gain privileges via a Trojan horse module under the current working directory.","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00779,"percentile":0.56175,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-264"],"published":"2016-07-25T00:00:00Z","modified":"2026-10-24T10:30:30Z","fixes":[{"ecosystem":"Alpine:v3.3","package":"perl","fixed_in":["5.22.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.4","package":"perl","fixed_in":["5.22.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.10","package":"spamassassin","fixed_in":["3.4.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.11","package":"spamassassin","fixed_in":["3.4.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"spamassassin","fixed_in":["3.4.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"spamassassin","fixed_in":["3.4.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"spamassassin","fixed_in":["3.4.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"spamassassin","fixed_in":["3.4.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"spamassassin","fixed_in":["3.4.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"spamassassin","fixed_in":["3.4.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"spamassassin","fixed_in":["3.4.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"spamassassin","fixed_in":["3.4.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"spamassassin","fixed_in":["3.4.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"spamassassin","fixed_in":["3.4.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"spamassassin","fixed_in":["3.4.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"spamassassin","fixed_in":["3.4.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"spamassassin","fixed_in":["3.4.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.8","package":"spamassassin","fixed_in":["3.4.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.9","package":"spamassassin","fixed_in":["3.4.2-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"perl","fixed_in":["5.22.2-3"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"perl","fixed_in":["5.22.2-3"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"perl","fixed_in":["5.22.2-3"],"sources":["osv"]},{"ecosystem":"Debian:7","package":"libsys-syslog-perl","fixed_in":["0.29-1+deb7u1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15","package":"amavisd-new","fixed_in":["2.11.1-6.3.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"libsys-syslog-perl","fixed_in":["0.33-1+deb8u1build0.14.04.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"perl-MIME-Charset","fixed_in":["1.012.2-1.16"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"perl-Test-File","fixed_in":["1.448-1.5"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"perl-ExtUtils-MakeMaker","fixed_in":["7.64-1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"perl-IO-Compress","fixed_in":["2.213.0-1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.3","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.22.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.4","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.22.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.10","package":"spamassassin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"spamassassin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"spamassassin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"spamassassin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"spamassassin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"spamassassin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"spamassassin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"spamassassin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"spamassassin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"spamassassin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"spamassassin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"spamassassin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"spamassassin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"spamassassin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"spamassassin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.8","package":"spamassassin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.9","package":"spamassassin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.22.2-3"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.22.2-3"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.22.2-3"}]}]},{"source":"osv","ecosystem":"Debian:8","package":"spamassassin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-0+deb8u1"}]}],"versions":["3.4.0-6","3.4.1-1","3.4.1-2","3.4.1-3","3.4.1-3~bpo8+1","3.4.1-4","3.4.1-5","3.4.1-5.1","3.4.1-6","3.4.1-6~bpo8+1","3.4.1-7","3.4.1-8"],"bundled":4},{"source":"osv","ecosystem":"Debian:7","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.2-21+deb7u4"}]}],"versions":["5.14.2-21","5.14.2-21+deb7u1","5.14.2-21+deb7u2","5.14.2-21+deb7u3"],"bundled":2},{"source":"osv","ecosystem":"Debian:7","package":"libsys-syslog-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.29-1+deb7u1"}]}],"versions":["0.29-1"]},{"source":"osv","ecosystem":"Debian:8","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.20.2-3+deb8u6"}]}],"versions":["5.20.2-3","5.20.2-3+deb8u1","5.20.2-3+deb8u2","5.20.2-3+deb8u3","5.20.2-3+deb8u3+kbsd1","5.20.2-3+deb8u4","5.20.2-3+deb8u5"],"bundled":2},{"source":"osv","ecosystem":"Mageia:5","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.20.1-8.7.mga5"}]}],"bundled":4},{"source":"osv","ecosystem":"Mageia:5","package":"perl-libintl-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.230.0-6.1.mga5"}]}],"bundled":4},{"source":"osv","ecosystem":"Mageia:5","package":"perl-MIME-Charset","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.1-4.1.mga5"}]}],"bundled":4},{"source":"osv","ecosystem":"Mageia:5","package":"perl-MIME-EncWords","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.2-4.1.mga5"}]}],"bundled":4},{"source":"osv","ecosystem":"Mageia:5","package":"perl-Module-Build","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.421.0-5.1.mga5"}]}],"bundled":4},{"source":"osv","ecosystem":"Mageia:5","package":"perl-Module-Load-Conditional","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.680.0-1.mga5"}]}],"bundled":4},{"source":"osv","ecosystem":"Mageia:5","package":"perl-Net-DNS","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.90.0-0.mga5"}]}],"bundled":4},{"source":"osv","ecosystem":"Mageia:5","package":"perl-Sys-Syslog","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.330.0-7.1.mga5"}]}],"bundled":4},{"source":"osv","ecosystem":"Mageia:5","package":"perl-Unicode-LineBreak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2014.60.0-5.1.mga5"}]}],"bundled":4},{"source":"osv","ecosystem":"Mageia:5","package":"perl-File-Path","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.90.0-4.1.mga5"}]}],"bundled":4},{"source":"osv","ecosystem":"Mageia:6","package":"spamassassin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-1.5.mga6"}]}],"bundled":4},{"source":"osv","ecosystem":"Mageia:6","package":"spamassassin-rules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-1.1.mga6"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP4","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.10.0-64.80.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.10.0-64.80.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.10.0-64.80.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP1","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.18.2-11.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.18.2-11.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.18.2-11.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15","package":"amavisd-new","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.1-6.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP4","package":"spamassassin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-44.3.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4","package":"spamassassin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-44.3.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"spamassassin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-44.3.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15","package":"spamassassin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-7.4.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15","package":"spamassassin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-7.4.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"libsys-syslog-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.33-1+deb8u1build0.14.04.1"}]}],"versions":["0.29-1build2","0.33-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.14.2-21build1","5.18.1-4","5.18.1-4build1","5.18.1-5","5.18.2-2","5.18.2-2ubuntu1","5.18.2-2ubuntu1.1","5.18.2-2ubuntu1.3","5.18.2-2ubuntu1.4","5.18.2-2ubuntu1.6","5.18.2-2ubuntu1.7","5.18.2-2ubuntu1.7+esm3","5.18.2-2ubuntu1.7+esm4","5.18.2-2ubuntu1.7+esm5","5.18.2-2ubuntu1.7+esm7","5.18.2-2ubuntu1.7+esm8","5.18.2-2ubuntu1.7+esm9"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.20.2-6","5.22.1-3","5.22.1-4","5.22.1-5","5.22.1-7","5.22.1-8","5.22.1-9","5.22.1-9ubuntu0.2","5.22.1-9ubuntu0.3","5.22.1-9ubuntu0.5","5.22.1-9ubuntu0.6","5.22.1-9ubuntu0.9","5.22.1-9ubuntu0.9+esm1","5.22.1-9ubuntu0.9+esm2","5.22.1-9ubuntu0.9+esm3","5.22.1-9ubuntu0.9+esm4"]},{"source":"osv","ecosystem":"openSUSE:Leap 15.0","package":"spamassassin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-lp150.6.3.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"ikiwiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.20200202.3-2.7"}]}],"bundled":14},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"perl-MIME-Charset","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.012.2-1.16"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"perl-Test-File","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.448-1.5"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"perl-ExtUtils-MakeMaker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.64-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"perl-IO-Compress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.213.0-1.1"}]}]}],"products":[{"vendor":"apache","product":"spamassassin"},{"vendor":"debian","product":"debian_linux"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"opensuse","product":"leap"},{"vendor":"perl","product":"perl"}],"references":[{"url":"https://security.gentoo.org/glsa/201701-75","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory"]},{"url":"https://security.gentoo.org/glsa/201812-07","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory"]},{"url":"http://perl5.git.perl.org/perl.git/commit/cee96d52c39b1e7b36e1c62d38bcd8d86e9a41ab","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","report"]},{"url":"http://www.securitytracker.com/id/1036440","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"http://www.debian.org/security/2016/dsa-3628","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.apache.org/thread.html/7f6a16bc0fd0fd5e67c7fd95bd655069a2ac7d1f88e42d3c853e601c%40%3Cannounce.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TZBNQH3DMI7HDELJAZ4TFJJANHXOEDWH/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"http://www.nntp.perl.org/group/perl.perl5.porters/2016/07/msg238271.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2FBQOCV3GBAN2EYZUM3CFDJ4ECA3GZOK/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05240731","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DOFRQWJRP2NQJEYEWOMECVW3HAMD5SYN/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"http://www.securityfocus.com/bid/92136","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2018/11/msg00016.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://rt.perl.org/Public/Bug/Display.html?id=127834","tags":["x_refsource_CONFIRM","x_transferred","Permissions Required","report"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00002.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-1238"},{"url":"https://lists.apache.org/thread.html/7f6a16bc0fd0fd5e67c7fd95bd655069a2ac7d1f88e42d3c853e601c@%3Cannounce.apache.org%3E"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2FBQOCV3GBAN2EYZUM3CFDJ4ECA3GZOK"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DOFRQWJRP2NQJEYEWOMECVW3HAMD5SYN"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TZBNQH3DMI7HDELJAZ4TFJJANHXOEDWH"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2FBQOCV3GBAN2EYZUM3CFDJ4ECA3GZOK"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DOFRQWJRP2NQJEYEWOMECVW3HAMD5SYN"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TZBNQH3DMI7HDELJAZ4TFJJANHXOEDWH"},{"url":"https://github.com/advisories/GHSA-hm5v-6984-hfqp"},{"url":"https://security.alpinelinux.org/vuln/CVE-2016-1238","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2016-1238","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2016-1238","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2018-0047.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=19051","tags":["report"]},{"url":"https://www.debian.org/security/2016/dsa-3628","tags":["web"]},{"url":"https://www.debian.org/security/2017/dsa-3873","tags":["web"]},{"url":"https://www.debian.org/security/2017/dsa-3982","tags":["web"]},{"url":"https://advisories.mageia.org/MGASA-2018-0425.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=23590","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2018/09/16/1","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20162246-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/929027","tags":["report"]},{"url":"https://bugzilla.suse.com/967082","tags":["report"]},{"url":"https://bugzilla.suse.com/987887","tags":["report"]},{"url":"https://bugzilla.suse.com/988311","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8853","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1238","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2381","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6185","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20162263-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/928292","tags":["report"]},{"url":"https://bugzilla.suse.com/932894","tags":["report"]},{"url":"https://bugzilla.suse.com/984906","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20172699-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1056193","tags":["report"]},{"url":"https://bugzilla.suse.com/975726","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2012-6702","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0191","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-6271","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-6277","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-6278","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-7169","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-7187","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-7824","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-8964","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9770","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-0245","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-1283","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-2059","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-2325","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-2327","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-2328","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3210","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3217","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3238","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3622","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5073","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5218","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5276","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7511","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8380","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8381","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8382","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8383","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8384","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8385","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8386","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8387","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8388","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8389","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8390","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8391","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8392","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8393","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8394","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8395","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8806","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8842","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8948","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-0634","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-0718","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-0787","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1234","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1283","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1762","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1833","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1834","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1835","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1837","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1838","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1839","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1840","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2037","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2073","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2105","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2106","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2107","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2108","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2109","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2177","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2178","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2179","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2180","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2181","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2182","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2183","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-3075","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-3191","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-3627","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-3705","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-3706","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4008","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4429","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4447","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4448","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4449","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4483","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4574","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4579","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4658","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5011","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5300","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5419","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5420","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5421","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6261","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6262","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6263","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6302","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6303","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6304","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6306","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6313","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6318","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7141","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7167","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7543","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7796","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8615","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8616","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8617","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8618","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8619","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8620","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8621","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8622","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8623","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8624","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9063","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9318","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9586","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9597","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9840","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9841","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9842","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9843","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-1000100","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-1000101","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-1000366","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-10684","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-10685","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-11112","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-11113","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-2616","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-6507","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7407","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7526","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-9047","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-9048","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-9049","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-9050","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-9233","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20172700-1/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2015-0860","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7056","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8610","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-3731","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20190505-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1123389","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20191961-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1108745","tags":["report"]},{"url":"https://bugzilla.suse.com/1108748","tags":["report"]},{"url":"https://bugzilla.suse.com/1108750","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2017-15705","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-11780","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-11781","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20192011-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1069831","tags":["report"]},{"url":"https://bugzilla.suse.com/1107765","tags":["report"]},{"url":"https://bugzilla.suse.com/1108749","tags":["report"]},{"url":"https://bugzilla.suse.com/1115411","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-1238","tags":["report"]},{"url":"http://ledgersmbdev.blogspot.ca/2016/07/notes-on-security-separation-of.html","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-1238","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/T5ANAUXCDCGLYH4N2EPY5MA7CJJND4MP/#T5ANAUXCDCGLYH4N2EPY5MA7CJJND4MP","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/XWM23J3YFXDJ4Y2P4EH532AXFSDKVM3Q/#XWM23J3YFXDJ4Y2P4EH532AXFSDKVM3Q","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2005-1349","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2008-0169","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2009-2944","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-0428","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-1401","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-0220","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-1572","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10026","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-3714","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4561","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9645","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9646","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-0356","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9187","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/M45NUZAE5T2PPU2VV4DPBYV25BXNEI4O/","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2016-1238","description":"(1) cpan/Archive-Tar/bin/ptar, (2) cpan/Archive-Tar/bin/ptardiff, (3) cpan/Archive-Tar/bin/ptargrep, (4) cpan/CPAN/scripts/cpan, (5) cpan/Digest-SHA/shasum, (6) cpan/Encode/bin/enc2xs, (7) cpan/Encode/bin/encguess, (8) cpan/Encode/bin/piconv, (9) cpan/Encode/bin/ucmlint, (10) cpan/Encode/bin/unidump, (11) cpan/ExtUtils-MakeMaker/bin/instmodsh, (12) cpan/IO-Compress/bin/zipdetails, (13) cpan/JSON-PP/bin/json_pp, (14) cpan/Test-Harness/bin/prove, (15) dist/ExtUtils-ParseXS/lib/ExtUtils/xsubpp, (16) dist/Module-CoreList/corelist, (17) ext/Pod-Html/bin/pod2html, (18) utils/c2ph.PL, (19) utils/h2ph.PL, (20) utils/h2xs.PL, (21) utils/libnetcfg.PL, (22) utils/perlbug.PL, (23) utils/perldoc.PL, (24) utils/perlivp.PL, and (25) utils/splain.PL in Perl 5.x before 5.22.3-RC2 and 5.24 before 5.24.1-RC2 do not properly remove . (period) characters from the end of the includes directory array, which might allow local users to gain privileges via a Trojan horse module under the current working directory.","status":"published","published":"2016-08-02T14:00:00Z","modified":"2024-08-05T22:48:13.656Z","updated_at":"2026-11-02T14:33:35.841056Z"}],"euvd":[{"id":"EUVD-2016-2339","description":"(1) cpan/Archive-Tar/bin/ptar, (2) cpan/Archive-Tar/bin/ptardiff, (3) cpan/Archive-Tar/bin/ptargrep, (4) cpan/CPAN/scripts/cpan, (5) cpan/Digest-SHA/shasum, (6) cpan/Encode/bin/enc2xs, (7) cpan/Encode/bin/encguess, (8) cpan/Encode/bin/piconv, (9) cpan/Encode/bin/ucmlint, (10) cpan/Encode/bin/unidump, (11) cpan/ExtUtils-MakeMaker/bin/instmodsh, (12) cpan/IO-Compress/bin/zipdetails, (13) cpan/JSON-PP/bin/json_pp, (14) cpan/Test-Harness/bin/prove, (15) dist/ExtUtils-ParseXS/lib/ExtUtils/xsubpp, (16) dist/Module-CoreList/corelist, (17) ext/Pod-Html/bin/pod2html, (18) utils/c2ph.PL, (19) utils/h2ph.PL, (20) utils/h2xs.PL, (21) utils/libnetcfg.PL, (22) utils/perlbug.PL, (23) utils/perldoc.PL, (24) utils/perlivp.PL, and (25) utils/splain.PL in Perl 5.x before 5.22.3-RC2 and 5.24 before 5.24.1-RC2 do not properly remove . (period) characters from the end of the includes directory array, which might allow local users to gain privileges via a Trojan horse module under the current working directory.","status":"published","published":"2016-08-02T14:00:00Z","modified":"2024-08-05T22:48:13Z","updated_at":"2026-11-03T02:22:57.974183Z"}],"ghsa":[{"id":"GHSA-hm5v-6984-hfqp","title":"(1) cpan/Archive-Tar/bin/ptar, (2) cpan/Archive-Tar/bin/ptardiff, (3) cpan/Archive-Tar/bin...","description":"(1) cpan/Archive-Tar/bin/ptar, (2) cpan/Archive-Tar/bin/ptardiff, (3) cpan/Archive-Tar/bin/ptargrep, (4) cpan/CPAN/scripts/cpan, (5) cpan/Digest-SHA/shasum, (6) cpan/Encode/bin/enc2xs, (7) cpan/Encode/bin/encguess, (8) cpan/Encode/bin/piconv, (9) cpan/Encode/bin/ucmlint, (10) cpan/Encode/bin/unidump, (11) cpan/ExtUtils-MakeMaker/bin/instmodsh, (12) cpan/IO-Compress/bin/zipdetails, (13) cpan/JSON-PP/bin/json_pp, (14) cpan/Test-Harness/bin/prove, (15) dist/ExtUtils-ParseXS/lib/ExtUtils/xsubpp, (16) dist/Module-CoreList/corelist, (17) ext/Pod-Html/bin/pod2html, (18) utils/c2ph.PL, (19) utils/h2ph.PL, (20) utils/h2xs.PL, (21) utils/libnetcfg.PL, (22) utils/perlbug.PL, (23) utils/perldoc.PL, (24) utils/perlivp.PL, and (25) utils/splain.PL in Perl 5.x before 5.22.3-RC2 and 5.24 before 5.24.1-RC2 do not properly remove . (period) characters from the end of the includes directory array, which might allow local users to gain privileges via a Trojan horse module under the current working directory.","status":"published","published":"2022-05-14T01:48:31Z","modified":"2025-04-12T13:04:02Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:01:29.190007Z"}],"nvd":[{"id":"CVE-2016-1238","description":"(1) cpan/Archive-Tar/bin/ptar, (2) cpan/Archive-Tar/bin/ptardiff, (3) cpan/Archive-Tar/bin/ptargrep, (4) cpan/CPAN/scripts/cpan, (5) cpan/Digest-SHA/shasum, (6) cpan/Encode/bin/enc2xs, (7) cpan/Encode/bin/encguess, (8) cpan/Encode/bin/piconv, (9) cpan/Encode/bin/ucmlint, (10) cpan/Encode/bin/unidump, (11) cpan/ExtUtils-MakeMaker/bin/instmodsh, (12) cpan/IO-Compress/bin/zipdetails, (13) cpan/JSON-PP/bin/json_pp, (14) cpan/Test-Harness/bin/prove, (15) dist/ExtUtils-ParseXS/lib/ExtUtils/xsubpp, (16) dist/Module-CoreList/corelist, (17) ext/Pod-Html/bin/pod2html, (18) utils/c2ph.PL, (19) utils/h2ph.PL, (20) utils/h2xs.PL, (21) utils/libnetcfg.PL, (22) utils/perlbug.PL, (23) utils/perldoc.PL, (24) utils/perlivp.PL, and (25) utils/splain.PL in Perl 5.x before 5.22.3-RC2 and 5.24 before 5.24.1-RC2 do not properly remove . (period) characters from the end of the includes directory array, which might allow local users to gain privileges via a Trojan horse module under the current working directory.","status":"published","published":"2016-08-02T14:59:00.13Z","modified":"2026-06-17T00:41:31.833Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":7.2,"vector":"AV:L/AC:L/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-264"],"updated_at":"2026-11-02T14:03:28.854267Z"}],"osv":[{"id":"ALPINE-CVE-2016-1238","description":"(1) cpan/Archive-Tar/bin/ptar, (2) cpan/Archive-Tar/bin/ptardiff, (3) cpan/Archive-Tar/bin/ptargrep, (4) cpan/CPAN/scripts/cpan, (5) cpan/Digest-SHA/shasum, (6) cpan/Encode/bin/enc2xs, (7) cpan/Encode/bin/encguess, (8) cpan/Encode/bin/piconv, (9) cpan/Encode/bin/ucmlint, (10) cpan/Encode/bin/unidump, (11) cpan/ExtUtils-MakeMaker/bin/instmodsh, (12) cpan/IO-Compress/bin/zipdetails, (13) cpan/JSON-PP/bin/json_pp, (14) cpan/Test-Harness/bin/prove, (15) dist/ExtUtils-ParseXS/lib/ExtUtils/xsubpp, (16) dist/Module-CoreList/corelist, (17) ext/Pod-Html/bin/pod2html, (18) utils/c2ph.PL, (19) utils/h2ph.PL, (20) utils/h2xs.PL, (21) utils/libnetcfg.PL, (22) utils/perlbug.PL, (23) utils/perldoc.PL, (24) utils/perlivp.PL, and (25) utils/splain.PL in Perl 5.x before 5.22.3-RC2 and 5.24 before 5.24.1-RC2 do not properly remove . (period) characters from the end of the includes directory array, which might allow local users to gain privileges via a Trojan horse module under the current working directory.","status":"published","published":"2016-08-02T14:59:00.13Z","modified":"2026-09-22T06:17:50.31478057Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:27:46.318571Z"},{"id":"BELL-CVE-2016-1238","title":"CVE-2016-1238 does not affect BellSoft software","status":"withdrawn","published":"2016-08-02T14:59:00Z","modified":"2026-01-26T09:47:05.714509Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:13.47097Z"},{"id":"CVE-2016-1238","description":"(1) cpan/Archive-Tar/bin/ptar, (2) cpan/Archive-Tar/bin/ptardiff, (3) cpan/Archive-Tar/bin/ptargrep, (4) cpan/CPAN/scripts/cpan, (5) cpan/Digest-SHA/shasum, (6) cpan/Encode/bin/enc2xs, (7) cpan/Encode/bin/encguess, (8) cpan/Encode/bin/piconv, (9) cpan/Encode/bin/ucmlint, (10) cpan/Encode/bin/unidump, (11) cpan/ExtUtils-MakeMaker/bin/instmodsh, (12) cpan/IO-Compress/bin/zipdetails, (13) cpan/JSON-PP/bin/json_pp, (14) cpan/Test-Harness/bin/prove, (15) dist/ExtUtils-ParseXS/lib/ExtUtils/xsubpp, (16) dist/Module-CoreList/corelist, (17) ext/Pod-Html/bin/pod2html, (18) utils/c2ph.PL, (19) utils/h2ph.PL, (20) utils/h2xs.PL, (21) utils/libnetcfg.PL, (22) utils/perlbug.PL, (23) utils/perldoc.PL, (24) utils/perlivp.PL, and (25) utils/splain.PL in Perl 5.x before 5.22.3-RC2 and 5.24 before 5.24.1-RC2 do not properly remove . (period) characters from the end of the includes directory array, which might allow local users to gain privileges via a Trojan horse module under the current working directory.","status":"published","published":"2016-08-02T14:59:00.13Z","modified":"2026-10-24T10:30:30.052789216Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:02.114472Z"},{"id":"DEBIAN-CVE-2016-1238","description":"(1) cpan/Archive-Tar/bin/ptar, (2) cpan/Archive-Tar/bin/ptardiff, (3) cpan/Archive-Tar/bin/ptargrep, (4) cpan/CPAN/scripts/cpan, (5) cpan/Digest-SHA/shasum, (6) cpan/Encode/bin/enc2xs, (7) cpan/Encode/bin/encguess, (8) cpan/Encode/bin/piconv, (9) cpan/Encode/bin/ucmlint, (10) cpan/Encode/bin/unidump, (11) cpan/ExtUtils-MakeMaker/bin/instmodsh, (12) cpan/IO-Compress/bin/zipdetails, (13) cpan/JSON-PP/bin/json_pp, (14) cpan/Test-Harness/bin/prove, (15) dist/ExtUtils-ParseXS/lib/ExtUtils/xsubpp, (16) dist/Module-CoreList/corelist, (17) ext/Pod-Html/bin/pod2html, (18) utils/c2ph.PL, (19) utils/h2ph.PL, (20) utils/h2xs.PL, (21) utils/libnetcfg.PL, (22) utils/perlbug.PL, (23) utils/perldoc.PL, (24) utils/perlivp.PL, and (25) utils/splain.PL in Perl 5.x before 5.22.3-RC2 and 5.24 before 5.24.1-RC2 do not properly remove . (period) characters from the end of the includes directory array, which might allow local users to gain privileges via a Trojan horse module under the current working directory.","status":"published","published":"2016-08-02T14:59:00.13Z","modified":"2026-09-22T07:00:37.695221021Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:27.323751Z"},{"id":"UBUNTU-CVE-2016-1238","description":"(1) cpan/Archive-Tar/bin/ptar, (2) cpan/Archive-Tar/bin/ptardiff, (3) cpan/Archive-Tar/bin/ptargrep, (4) cpan/CPAN/scripts/cpan, (5) cpan/Digest-SHA/shasum, (6) cpan/Encode/bin/enc2xs, (7) cpan/Encode/bin/encguess, (8) cpan/Encode/bin/piconv, (9) cpan/Encode/bin/ucmlint, (10) cpan/Encode/bin/unidump, (11) cpan/ExtUtils-MakeMaker/bin/instmodsh, (12) cpan/IO-Compress/bin/zipdetails, (13) cpan/JSON-PP/bin/json_pp, (14) cpan/Test-Harness/bin/prove, (15) dist/ExtUtils-ParseXS/lib/ExtUtils/xsubpp, (16) dist/Module-CoreList/corelist, (17) ext/Pod-Html/bin/pod2html, (18) utils/c2ph.PL, (19) utils/h2ph.PL, (20) utils/h2xs.PL, (21) utils/libnetcfg.PL, (22) utils/perlbug.PL, (23) utils/perldoc.PL, (24) utils/perlivp.PL, and (25) utils/splain.PL in Perl 5.x before 5.22.3-RC2 and 5.24 before 5.24.1-RC2 do not properly remove . (period) characters from the end of the includes directory array, which might allow local users to gain privileges via a Trojan horse module under the current working directory.","status":"published","published":"2016-07-25T00:00:00Z","modified":"2026-09-08T19:45:05.91112939Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"},{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:11.492576Z"},{"id":"DLA-1578-1","title":"spamassassin - security update","status":"published","published":"2018-11-13T00:00:00Z","modified":"2026-03-09T01:21:50.343955Z","updated_at":"2026-11-02T15:46:09.777694Z"},{"id":"DLA-565-1","title":"perl - security update","status":"published","published":"2016-07-28T00:00:00Z","modified":"2026-03-09T02:10:21.46182Z","updated_at":"2026-11-02T15:46:13.207219Z"},{"id":"DLA-584-1","title":"libsys-syslog-perl - security update","status":"published","published":"2016-08-04T00:00:00Z","modified":"2026-03-09T02:11:00.251458Z","updated_at":"2026-11-02T15:46:13.207219Z"},{"id":"DSA-3628-1","title":"perl - security update","status":"published","published":"2016-07-25T00:00:00Z","modified":"2026-03-09T01:23:17.227199Z","updated_at":"2026-11-02T15:46:16.199525Z"},{"id":"MGASA-2018-0047","title":"Updated perl packages fix security vulnerability","description":"John Lightsey and Todd Rinaldo reported that the opportunistic loading of\noptional modules can make many programs unintentionally load code from the\ncurrent working directory (which might be changed to another directory\nwithout the user realising) and potentially leading to privilege escalation\n(CVE-2016-1238).\n\nThe cPanel Security Team reported a time of check to time of use (TOCTTOU)\nrace condition flaw in File::Path, a core module from Perl to create or\nremove directory trees. An attacker can take advantage of this flaw to set\nthe mode on an attacker-chosen file to a attacker-chosen value\n(CVE-2017-6512).\n\nJakub Wilk reported a heap buffer overflow flaw in the regular expression\ncompiler, allowing a remote attacker to cause a denial of service via a\n specially crafted regular expression with the case-insensitive modifier\n(CVE-2017-12837).\n\nJakub Wilk reported a buffer over-read flaw in the regular expression\nparser, allowing a remote attacker to cause a denial of service or\ninformation leak (CVE-2017-12883).\n\nThe perl-libintl-perl, perl-MIME-Charset, perl-MIME-EncWords,\nperl-Module-Build, perl-Sys-Syslog, and perl-Unicode-LineBreak packages\nhave been patched and the perl-Module-Load-Conditional and perl-Net-DNS\npackages have been updated to fix CVE-2016-1238 as well.\n\nThe perl-File-Path package has also been patched to fix CVE-2017-6512.\n","status":"published","published":"2018-01-03T15:50:51Z","modified":"2026-04-16T06:24:25.332206802Z","updated_at":"2026-11-02T15:49:40.442238Z"},{"id":"MGASA-2018-0425","title":"Updated spamassassin packages fix security vulnerabilities","description":"Updated spamassassin package fixes security vulnerabilities:\n\nA reliance on \".\" in @INC in one configuration script (CVE-2016-1238).\n\nA denial of service vulnerability arises with certain unclosed tags in\nemails that cause markup to be handled incorrectly leading to scan\ntimeouts (CVE-2017-15705).\n\nA potential Remote Code Execution bug with the PDFInfo plugin\n(CVE-2018-11780).\n\nA local user code injection in the meta rule syntax (CVE-2018-11781).\n","status":"published","published":"2018-10-30T18:01:43Z","modified":"2026-04-16T06:22:29.978632277Z","updated_at":"2026-11-02T15:49:40.793816Z"},{"id":"openSUSE-SU-2019:0297-1","title":"Security update for amavisd-new","description":"This update for amavisd-new fixes the following issues:\n\nSecurity issue fixed: \n\n- CVE-2016-1238: Workedaround a perl vulnerability by removing a trailing dot element from @INC\t(bsc#987887).\n\nOther issues addressed:\n\n- update to version 2.11.1 (bsc#1123389).\n- amavis-services: bumping up syslog level from LOG_NOTICE to LOG_ERR\n  for a message 'PID \u003cpid\u003e went away', and removed redundant newlines\n  from some log messages\n- avoid warning messages 'Use of uninitialized value in subroutine entry' in Encode::MIME::Header\n  when the $check argument is undefined \n- @sa_userconf_maps has been extended to allow loading of per-recipient (or per-policy bank, or global) SpamAssassin configuration set from LDAP. \n  For consistency with SQL a @sa_userconf_maps entry prefixed with 'ldap:' will load SpamAssassin configuration set using the load_scoreonly_ldap() method.\n- add some Sanesecurity.Foxhole false positives to the default list @virus_name_to_spam_score_maps\n\n- update amavis-milter to version 2.6.1:\n  * Fixed a  bug when creating amavisd-new policy bank names\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2019-03-23T11:10:44Z","modified":"2026-02-04T04:38:47.732605Z","updated_at":"2026-11-02T16:58:30.39372Z"},{"id":"openSUSE-SU-2019:1831-1","title":"Security update for spamassassin","description":"This update for spamassassin to version 3.4.2 fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2018-11781: Fixed an issue where a local user could inject code in the meta rule syntax (bsc#1108748).\n- CVE-2018-11780: Fixed a potential remote code execution vulnerability in the PDFInfo plugin (bsc#1108750).\n- CVE-2017-15705: Fixed a denial of service through unclosed tags in crafted emails (bsc#1108745).\n- CVE-2016-1238: Fixed an issue where perl would load modules from the current directory (bsc#1108749).\n\nNon-security issues fixed:\n\n- Use systemd timers instead of cron (bsc#1115411)\n- Fixed incompatibility with Net::DNS \u003e= 1.01 (bsc#1107765)\n- Fixed warning about deprecated regex during sa-update (bsc#1069831)\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2019-08-06T15:40:29Z","modified":"2026-02-04T04:27:25.52352Z","updated_at":"2026-11-02T16:58:30.784344Z"},{"id":"openSUSE-SU-2024:10523-1","title":"perl-Archive-Extract-0.78-1.1 on GA media","description":"These are all security issues fixed in the perl-Archive-Extract-0.78-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:48:11.66111Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"openSUSE-SU-2024:10614-1","title":"amavisd-new-2.12.1-3.2 on GA media","description":"These are all security issues fixed in the amavisd-new-2.12.1-3.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:37:08.685265Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"openSUSE-SU-2024:10860-1","title":"ikiwiki-3.20200202.3-2.7 on GA media","description":"These are all security issues fixed in the ikiwiki-3.20200202.3-2.7 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:32:41.040879Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"openSUSE-SU-2024:11162-1","title":"perl-MIME-Charset-1.012.2-1.16 on GA media","description":"These are all security issues fixed in the perl-MIME-Charset-1.012.2-1.16 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:40:22.643854Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"openSUSE-SU-2024:11163-1","title":"perl-Test-File-1.448-1.5 on GA media","description":"These are all security issues fixed in the perl-Test-File-1.448-1.5 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:33:31.009018Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"openSUSE-SU-2024:11706-1","title":"perl-ExtUtils-MakeMaker-7.64-1.1 on GA media","description":"These are all security issues fixed in the perl-ExtUtils-MakeMaker-7.64-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:12:03.496448Z","updated_at":"2026-11-02T16:58:35.195147Z"},{"id":"openSUSE-SU-2025:14657-1","title":"perl-IO-Compress-2.213.0-1.1 on GA media","description":"These are all security issues fixed in the perl-IO-Compress-2.213.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-01-16T00:00:00Z","modified":"2026-02-04T04:33:24.319949Z","updated_at":"2026-11-02T16:58:36.976155Z"},{"id":"SUSE-SU-2016:2246-1","title":"Security update for perl","description":"\nThis update for perl fixes the following issues:\n\n- CVE-2016-6185: xsloader looking at a '(eval)' directory [bsc#988311]\n  \n- CVE-2016-1238: searching current directory for optional modules [bsc#987887]\n\n- CVE-2015-8853: regex engine hanging on bad utf8 [bnc976584]\n\n- CVE-2016-2381: environment dup handling bug [bsc#967082]\n\n- perl panic with utf8_mg_pos_cache_update [bsc#929027]\n\n","status":"published","published":"2016-09-06T09:26:55Z","modified":"2026-02-04T04:01:51.556839Z","updated_at":"2026-11-02T15:53:43.438985Z"},{"id":"SUSE-SU-2016:2263-1","title":"Security update for perl","description":"\nThis update for Perl fixes the following issues:\n\n- CVE-2016-6185: Xsloader looking at a '(eval)' directory. (bsc#988311)\n- CVE-2016-1238: Searching current directory for optional modules. (bsc#987887)\n- CVE-2015-8853: Regular expression engine hanging on bad utf8. (bsc)\n- CVE-2016-2381: Environment dup handling bug. (bsc#967082)\n- 'Insecure dependency in require' error in taint mode. (bsc#984906)\n- Memory leak in 'use utf8' handling. (bsc#928292)\n- Missing lock prototype to the debugger. (bsc#932894)\n","status":"published","published":"2016-09-08T09:37:50Z","modified":"2026-02-04T02:42:35.667255Z","updated_at":"2026-11-02T15:53:43.438985Z"},{"id":"SUSE-SU-2017:2699-1","title":"Security update for SLES 12 Docker image","description":"The SUSE Linux Enterprise Server 12 container image has been updated to include\nsecurity and stability fixes.\n\nThe following issues related to building of the container images have been fixed:\n\n- Included krb5 package to avoid the inclusion of krb5-mini which gets selected as a\n  dependency by the Build Service solver. (bsc#1056193)\n- Do not install recommended packages when building container images. (bsc#975726)\n\nA number of security issues that have been already fixed by updates released for\nSUSE Linux Enterprise Server 12 are now included in the base image. A package/CVE\ncross-reference is available below.\n\npam:\n\n- CVE-2015-3238\n\nlibtasn1:\n\n- CVE-2015-3622\n- CVE-2016-4008\n\nlibidn:\n\n- CVE-2015-2059\n- CVE-2015-8948\n- CVE-2016-6261\n- CVE-2016-6262\n- CVE-2016-6263\n\nzlib:\n\n- CVE-2016-9840\n- CVE-2016-9841\n- CVE-2016-9842\n- CVE-2016-9843\n\ncurl:\n\n- CVE-2016-5419\n- CVE-2016-5420\n- CVE-2016-5421\n- CVE-2016-7141\n- CVE-2016-7167\n- CVE-2016-8615\n- CVE-2016-8616\n- CVE-2016-8617\n- CVE-2016-8618\n- CVE-2016-8619\n- CVE-2016-8620\n- CVE-2016-8621\n- CVE-2016-8622\n- CVE-2016-8623\n- CVE-2016-8624\n- CVE-2016-9586\n- CVE-2017-1000100\n- CVE-2017-1000101\n- CVE-2017-7407\n\nopenssl:\n\n- CVE-2016-2105\n- CVE-2016-2106\n- CVE-2016-2107\n- CVE-2016-2108\n- CVE-2016-2109\n- CVE-2016-2177\n- CVE-2016-2178\n- CVE-2016-2179\n- CVE-2016-2180\n- CVE-2016-2181\n- CVE-2016-2182\n- CVE-2016-2183\n- CVE-2016-6302\n- CVE-2016-6303\n- CVE-2016-6304\n- CVE-2016-6306\n\nlibxml2:\n\n- CVE-2014-0191\n- CVE-2015-8806\n- CVE-2016-1762\n- CVE-2016-1833\n- CVE-2016-1834\n- CVE-2016-1835\n- CVE-2016-1837\n- CVE-2016-1838\n- CVE-2016-1839\n- CVE-2016-1840\n- CVE-2016-2073\n- CVE-2016-3627\n- CVE-2016-3705\n- CVE-2016-4447\n- CVE-2016-4448\n- CVE-2016-4449\n- CVE-2016-4483\n- CVE-2016-4658\n- CVE-2016-9318\n- CVE-2016-9597\n- CVE-2017-9047\n- CVE-2017-9048\n- CVE-2017-9049\n- CVE-2017-9050\n\nutil-linux:\n\n- CVE-2015-5218\n- CVE-2016-5011\n- CVE-2017-2616\n\ncracklib:\n\n- CVE-2016-6318\n\nsystemd:\n\n- CVE-2014-9770\n- CVE-2015-8842\n- CVE-2016-7796\n\npcre:\n\n- CVE-2014-8964\n- CVE-2015-2325\n- CVE-2015-2327\n- CVE-2015-2328\n- CVE-2015-3210\n- CVE-2015-3217\n- CVE-2015-5073\n- CVE-2015-8380\n- CVE-2015-8381\n- CVE-2015-8382\n- CVE-2015-8383\n- CVE-2015-8384\n- CVE-2015-8385\n- CVE-2015-8386\n- CVE-2015-8387\n- CVE-2015-8388\n- CVE-2015-8389\n- CVE-2015-8390\n- CVE-2015-8391\n- CVE-2015-8392\n- CVE-2015-8393\n- CVE-2015-8394\n- CVE-2015-8395\n- CVE-2016-1283\n- CVE-2016-3191\n\nappamor:\n\n- CVE-2017-6507\n\nbash:\n\n- CVE-2014-6277\n- CVE-2014-6278\n- CVE-2016-0634\n- CVE-2016-7543\n\ncpio:\n\n- CVE-2016-2037\n\nglibc:\n\n- CVE-2016-1234\n- CVE-2016-3075\n- CVE-2016-3706\n- CVE-2016-4429\n- CVE-2017-1000366\n\nperl:\n\n- CVE-2015-8853\n- CVE-2016-1238\n- CVE-2016-2381\n- CVE-2016-6185\n\nlibssh2_org:\n\n- CVE-2016-0787\n\nexpat:\n\n- CVE-2012-6702\n- CVE-2015-1283\n- CVE-2016-0718\n- CVE-2016-5300\n- CVE-2016-9063\n- CVE-2017-9233\n\nncurses:\n\n- CVE-2017-10684\n- CVE-2017-10685\n- CVE-2017-11112\n- CVE-2017-11113\n\nlibksba:\n\n- CVE-2016-4574\n- CVE-2016-4579\n\nlibgcrypt:\n\n- CVE-2015-7511\n- CVE-2016-6313\n- CVE-2017-7526\n\ndbus-1:\n\n- CVE-2014-7824\n- CVE-2015-0245\n\nFinally, the following packages received non-security fixes:\n\n- augeas\n- bzip2\n- ca-certificates-mozilla\n- coreutils\n- cryptsetup\n- cyrus-sasl\n- dirmngr\n- e2fsprogs\n- findutils\n- gpg2\n- insserv-compat\n- kmod\n- libcap\n- libsolv\n- libzypp\n- openldap2\n- p11-kit\n- permissions\n- procps\n- rpm\n- sed\n- shadow\n- zypper\n","status":"published","published":"2017-10-10T19:37:24Z","modified":"2026-02-04T03:24:03.922844Z","updated_at":"2026-11-02T15:53:44.209561Z"},{"id":"SUSE-SU-2017:2700-1","title":"Security update for SLES 12-SP1 Docker image","description":"The SUSE Linux Enterprise Server 12 SP1 container image has been updated to include\nsecurity and stability fixes.\n\nThe following issues related to building of the container images have been fixed:\n\n- Included krb5 package to avoid the inclusion of krb5-mini which gets selected as a\n  dependency by the Build Service solver. (bsc#1056193)\n- Do not install recommended packages when building container images. (bsc#975726)\n\nA number of security issues that have been already fixed by updates released for\nSUSE Linux Enterprise Server 12 SP1 are now included in the base image. A package/CVE\ncross-reference is available below.\n\npam:\n\n- CVE-2015-3238\n\nlibtasn1:\n\n- CVE-2015-3622\n- CVE-2016-4008\n\nexpat:\n\nexpat:\n\n- CVE-2012-6702\n- CVE-2015-1283\n- CVE-2016-0718\n- CVE-2016-5300\n- CVE-2016-9063\n- CVE-2017-9233\n\nlibidn:\n\n- CVE-2015-2059\n- CVE-2015-8948\n- CVE-2016-6261\n- CVE-2016-6262\n- CVE-2016-6263\n\n\nzlib:\n\n- CVE-2016-9840\n- CVE-2016-9841\n- CVE-2016-9842\n- CVE-2016-9843\n\ncurl:\n\n- CVE-2016-5419\n- CVE-2016-5420\n- CVE-2016-5421\n- CVE-2016-7141\n- CVE-2016-7167\n- CVE-2016-8615\n- CVE-2016-8616\n- CVE-2016-8617\n- CVE-2016-8618\n- CVE-2016-8619\n- CVE-2016-8620\n- CVE-2016-8621\n- CVE-2016-8622\n- CVE-2016-8623\n- CVE-2016-8624\n- CVE-2016-9586\n- CVE-2017-1000100\n- CVE-2017-1000101\n- CVE-2017-7407\n\nopenssl:\n\n- CVE-2016-2105\n- CVE-2016-2106\n- CVE-2016-2107\n- CVE-2016-2108\n- CVE-2016-2109\n- CVE-2016-2177\n- CVE-2016-2178\n- CVE-2016-2179\n- CVE-2016-2180\n- CVE-2016-2181\n- CVE-2016-2182\n- CVE-2016-2183\n- CVE-2016-6302\n- CVE-2016-6303\n- CVE-2016-6304\n- CVE-2016-6306\n- CVE-2016-7056\n- CVE-2016-8610\n- CVE-2017-3731\n\ncracklib:\n\n- CVE-2016-6318\n\npcre:\n\n- CVE-2014-8964\n- CVE-2015-2325\n- CVE-2015-2327\n- CVE-2015-2328\n- CVE-2015-3210\n- CVE-2015-3217\n- CVE-2015-5073\n- CVE-2015-8380\n- CVE-2015-8381\n- CVE-2015-8382\n- CVE-2015-8383\n- CVE-2015-8384\n- CVE-2015-8385\n- CVE-2015-8386\n- CVE-2015-8387\n- CVE-2015-8388\n- CVE-2015-8389\n- CVE-2015-8390\n- CVE-2015-8391\n- CVE-2015-8392\n- CVE-2015-8393\n- CVE-2015-8394\n- CVE-2015-8395\n- CVE-2016-1283\n- CVE-2016-3191\n\nappamor:\n\n- CVE-2017-6507\n\nbash:\n\n- CVE-2014-6277\n- CVE-2014-6278\n- CVE-2016-0634\n- CVE-2016-7543\n\ncpio:\n\n- CVE-2016-2037\n\nglibc:\n\n- CVE-2016-1234\n- CVE-2016-3075\n- CVE-2016-3706\n- CVE-2016-4429\n- CVE-2017-1000366\n\nperl:\n\n- CVE-2015-8853\n- CVE-2016-1238\n- CVE-2016-2381\n- CVE-2016-6185\n\nlibssh2_org:\n\n- CVE-2016-0787\n\nutil-linux:\n\n- CVE-2016-5011\n- CVE-2017-2616\n\nncurses:\n\n- CVE-2017-10684\n- CVE-2017-10685\n- CVE-2017-11112\n- CVE-2017-11113\n\nlibksba:\n\n- CVE-2016-4574\n- CVE-2016-4579\n\nlibxml2:\n\n- CVE-2014-0191\n- CVE-2015-8806\n- CVE-2016-1762\n- CVE-2016-1833\n- CVE-2016-1834\n- CVE-2016-1835\n- CVE-2016-1837\n- CVE-2016-1838\n- CVE-2016-1839\n- CVE-2016-1840\n- CVE-2016-2073\n- CVE-2016-3627\n- CVE-2016-3705\n- CVE-2016-4447\n- CVE-2016-4448\n- CVE-2016-4449\n- CVE-2016-4483\n- CVE-2016-4658\n- CVE-2016-9318\n- CVE-2016-9597\n- CVE-2017-9047\n- CVE-2017-9048\n- CVE-2017-9049\n- CVE-2017-9050\n\nlibgcrypt:\n\n- CVE-2015-7511\n- CVE-2016-6313\n- CVE-2017-7526\n\nupdate-alternatives:\n\n- CVE-2015-0860\n\nsystemd:\n\n- CVE-2014-9770\n- CVE-2015-8842\n- CVE-2016-7796\n\ndbus-1:\n\n- CVE-2014-7824\n- CVE-2015-0245\n\nFinally, the following packages received non-security fixes:\n\n- augeas\n- bzip2\n- ca-certificates-mozilla\n- coreutils\n- cryptsetup\n- cyrus-sasl\n- dirmngr\n- e2fsprogs\n- findutils\n- gpg2\n- insserv-compat\n- kmod\n- libcap\n- libsolv\n- libzypp\n- lua51\n- lvm2\n- netcfg\n- p11-kit\n- permissions\n- procps\n- rpm\n- sed\n- sg3_utils\n- shadow\n- zypper\n","status":"published","published":"2017-10-10T19:37:36Z","modified":"2026-02-04T03:03:17.897778Z","updated_at":"2026-11-02T15:53:44.209561Z"},{"id":"SUSE-SU-2019:0505-1","title":"Security update for amavisd-new","description":"This update for amavisd-new fixes the following issues:\n\nwmavisd-new was updated to version 2.11.1 (bsc#1123389):\n\n* removed a trailing dot element from @INC, as a workaround for a perl\n  vulnerability CVE-2016-1238 (bsc#987887)\n* amavis-services: bumping up syslog level from LOG_NOTICE to LOG_ERR\n  for a message 'PID \u003cpid\u003e went away', and removed redundant newlines\n  from some log messages\n* safe_decode() and safe_decode_utf8(): avoid warning messages\n  'Use of uninitialized value in subroutine entry'\n  in Encode::MIME::Header when the $check argument is undefined\n* @sa_userconf_maps has been extended to allow loading of per-recipient\n  (or per-policy bank, or global) SpamAssassin configuration set from\n  LDAP. For consistency with SQL a @sa_userconf_maps entry prefixed with\n  'ldap:' will load SpamAssassin configuration set using the\n  load_scoreonly_ldap() method;  a patch by Atanas Karashenski\n* add some Sanesecurity.Foxhole false positives to the default\n  list @virus_name_to_spam_score_maps\n* updated some comments\n\nUpdate amavis-milter to version 2.6.1:\n\n* Fixed bug when creating amavisd-new policy bank names\n","status":"published","published":"2019-02-27T07:43:59Z","modified":"2026-02-04T03:48:58.872687Z","updated_at":"2026-11-02T15:53:45.926331Z"},{"id":"SUSE-SU-2019:1961-1","title":"Security update for spamassassin","description":"This update for spamassassin to version 3.4.2 fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2017-15705: Fixed denial of service via unclosed tags in crafted emails (bsc#1108745).\n- CVE-2018-11781: Fixed a code injection in the meta rule syntax by local users (bsc#1108748).\n- CVE-2018-11780: Fixed a potential remote code execution vulnerability in PDFInfo plugin (bsc#1108750).\n\nNon-security issues fixed:\n\n- Added four new plugins (disabled by default): HashBL, ResourceLimits, FromNameSpoof, Phishing\n- sa-update script: optional support for SHA-256 / SHA-512 been added for better validation of rules\n- GeoIP2 support has been added to RelayCountry and URILocalBL plugins\n- Several new or enhanced configuration options\n","status":"published","published":"2019-07-24T08:32:56Z","modified":"2026-02-04T03:42:55.070409Z","updated_at":"2026-11-02T15:53:46.44301Z"},{"id":"SUSE-SU-2019:2011-1","title":"Security update for spamassassin","description":"This update for spamassassin to version 3.4.2 fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2018-11781: Fixed an issue where a local user could inject code in the meta rule syntax (bsc#1108748).\n- CVE-2018-11780: Fixed a potential remote code execution vulnerability in the PDFInfo plugin (bsc#1108750).\n- CVE-2017-15705: Fixed a denial of service through unclosed tags in crafted emails (bsc#1108745).\n- CVE-2016-1238: Fixed an issue where perl would load modules from the current directory (bsc#1108749).\n\nNon-security issues fixed:\n\n- Use systemd timers instead of cron (bsc#1115411)\n- Fixed incompatibility with Net::DNS \u003e= 1.01 (bsc#1107765)\n- Fixed warning about deprecated regex during sa-update (bsc#1069831)\n","status":"published","published":"2019-07-29T12:46:29Z","modified":"2026-02-04T04:01:02.871865Z","updated_at":"2026-11-02T15:53:46.44301Z"}]}}