{"id":"CVE-2017-6512","aliases":["DEBIAN-CVE-2017-6512","DLA-978-1","DSA-3873-1","EUVD-2017-15568","GHSA-wf3v-xjg6-86hx","MGASA-2018-0047","SUSE-SU-2017:2951-1","SUSE-SU-2017:3092-1","SUSE-SU-2021:0449-1","SUSE-SU-2022:3271-1","SUSE-SU-2024:1630-1","UBUNTU-CVE-2017-6512","USN-3625-1","openSUSE-SU-2024:13154-1"],"status":"published","title":"Race condition in the rmtree and remove_tree functions in the File-Path module before 2.13 for...","description":"Race condition in the rmtree and remove_tree functions in the File-Path module before 2.13 for Perl allows attackers to set the mode on arbitrary files via vectors involving directory-permission loosening logic.","severity":{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.02359,"percentile":0.83874,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-362"],"published":"2017-06-01T00:00:00Z","modified":"2026-09-01T20:03:49Z","fixes":[{"ecosystem":"Debian:12","package":"perl","fixed_in":["5.24.1-3"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"perl","fixed_in":["5.24.1-3"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"perl","fixed_in":["5.24.1-3"],"sources":["osv"]},{"ecosystem":"Debian:7","package":"perl","fixed_in":["5.14.2-21+deb7u5"],"sources":["osv"]},{"ecosystem":"Debian:8","package":"perl","fixed_in":["5.20.2-3+deb8u7"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP4","package":"perl","fixed_in":["5.10.0-64.81.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"perl","fixed_in":["5.10.0-64.81.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"perl","fixed_in":["5.10.0-64.81.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"perl-File-Path","fixed_in":["2.150000-8.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"perl-File-Path","fixed_in":["2.150000-8.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"perl","fixed_in":["5.26.1-150300.17.11.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP4","package":"perl","fixed_in":["5.26.1-150300.17.11.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP3","package":"perl","fixed_in":["5.26.1-150300.17.11.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP4","package":"perl","fixed_in":["5.26.1-150300.17.11.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP3","package":"perl","fixed_in":["5.26.1-150300.17.11.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP4","package":"perl","fixed_in":["5.26.1-150300.17.11.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.1","package":"perl","fixed_in":["5.26.1-150300.17.11.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"perl","fixed_in":["5.26.1-150300.17.11.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap Micro 5.2","package":"perl","fixed_in":["5.26.1-150300.17.11.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.3","package":"perl","fixed_in":["5.26.1-150300.17.11.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.4","package":"perl","fixed_in":["5.26.1-150300.17.11.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"perl","fixed_in":["5.18.2-2ubuntu1.4"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"perl","fixed_in":["5.22.1-9ubuntu0.3"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"perl-File-Path","fixed_in":["2.180000-1.15"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.24.1-3"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.24.1-3"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.24.1-3"}]}]},{"source":"osv","ecosystem":"Debian:7","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.2-21+deb7u5"}]}],"versions":["5.14.2-21","5.14.2-21+deb7u1","5.14.2-21+deb7u2","5.14.2-21+deb7u3","5.14.2-21+deb7u4"]},{"source":"osv","ecosystem":"Debian:8","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.20.2-3+deb8u7"}]}],"versions":["5.20.2-3","5.20.2-3+deb8u1","5.20.2-3+deb8u2","5.20.2-3+deb8u3","5.20.2-3+deb8u3+kbsd1","5.20.2-3+deb8u4","5.20.2-3+deb8u5","5.20.2-3+deb8u6"]},{"source":"osv","ecosystem":"Mageia:5","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.20.1-8.7.mga5"}]}],"bundled":4},{"source":"osv","ecosystem":"Mageia:5","package":"perl-libintl-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.230.0-6.1.mga5"}]}],"bundled":4},{"source":"osv","ecosystem":"Mageia:5","package":"perl-MIME-Charset","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.1-4.1.mga5"}]}],"bundled":4},{"source":"osv","ecosystem":"Mageia:5","package":"perl-MIME-EncWords","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.2-4.1.mga5"}]}],"bundled":4},{"source":"osv","ecosystem":"Mageia:5","package":"perl-Module-Build","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.421.0-5.1.mga5"}]}],"bundled":4},{"source":"osv","ecosystem":"Mageia:5","package":"perl-Module-Load-Conditional","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.680.0-1.mga5"}]}],"bundled":4},{"source":"osv","ecosystem":"Mageia:5","package":"perl-Net-DNS","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.90.0-0.mga5"}]}],"bundled":4},{"source":"osv","ecosystem":"Mageia:5","package":"perl-Sys-Syslog","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.330.0-7.1.mga5"}]}],"bundled":4},{"source":"osv","ecosystem":"Mageia:5","package":"perl-Unicode-LineBreak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2014.60.0-5.1.mga5"}]}],"bundled":4},{"source":"osv","ecosystem":"Mageia:5","package":"perl-File-Path","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.90.0-4.1.mga5"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP4","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.10.0-64.81.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.10.0-64.81.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.10.0-64.81.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP2","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.18.2-12.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.18.2-12.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.18.2-12.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.18.2-12.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.18.2-12.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.18.2-12.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.18.2-12.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"perl-File-Path","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.150000-8.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"perl-File-Path","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.150000-8.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.26.1-150300.17.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP4","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.26.1-150300.17.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP3","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.26.1-150300.17.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP4","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.26.1-150300.17.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP3","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.26.1-150300.17.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP4","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.26.1-150300.17.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.1","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.26.1-150300.17.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.26.1-150300.17.11.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap Micro 5.2","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.26.1-150300.17.11.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.26.1-150300.17.11.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.26.1-150300.17.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.26.1-150000.7.18.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.26.1-150000.7.18.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.26.1-150000.7.18.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.18.2-2ubuntu1.4"}]}],"versions":["5.14.2-21build1","5.18.1-4","5.18.1-4build1","5.18.1-5","5.18.2-2","5.18.2-2ubuntu1","5.18.2-2ubuntu1.1","5.18.2-2ubuntu1.3"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.22.1-9ubuntu0.3"}]}],"versions":["5.20.2-6","5.22.1-3","5.22.1-4","5.22.1-5","5.22.1-7","5.22.1-8","5.22.1-9","5.22.1-9ubuntu0.2"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.18.2-2ubuntu1.4"}]}],"versions":["5.14.2-21build1","5.18.1-4","5.18.1-4build1","5.18.1-5","5.18.2-2","5.18.2-2ubuntu1","5.18.2-2ubuntu1.1","5.18.2-2ubuntu1.3"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.22.1-9ubuntu0.3"}]}],"versions":["5.20.2-6","5.22.1-3","5.22.1-4","5.22.1-5","5.22.1-7","5.22.1-8","5.22.1-9","5.22.1-9ubuntu0.2"],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"perl-File-Path","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.180000-1.15"}]}]}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"debian","product":"debian_linux"},{"vendor":"file\\","product":"\\"}],"references":[{"url":"http://cpansearch.perl.org/src/JKEENAN/File-Path-2.13/Changes","tags":["x_refsource_CONFIRM","x_transferred","Release Notes","Third Party Advisory","advisory","report"]},{"url":"https://usn.ubuntu.com/3625-2/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.debian.org/security/2017/dsa-3873","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.securityfocus.com/bid/99180","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"http://www.securitytracker.com/id/1038610","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://security.gentoo.org/glsa/201709-12","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory"]},{"url":"http://security.cucumberlinux.com/security/details.php?id=153","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://rt.cpan.org/Ticket/Display.html?id=121951","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","report"]},{"url":"https://usn.ubuntu.com/3625-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-6512"},{"url":"https://usn.ubuntu.com/3625-1"},{"url":"https://usn.ubuntu.com/3625-2"},{"url":"https://github.com/advisories/GHSA-wf3v-xjg6-86hx"},{"url":"https://security-tracker.debian.org/tracker/CVE-2017-6512","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2018-0047.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=19051","tags":["report"]},{"url":"https://www.debian.org/security/2016/dsa-3628","tags":["web"]},{"url":"https://www.debian.org/security/2017/dsa-3873","tags":["web"]},{"url":"https://www.debian.org/security/2017/dsa-3982","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20172951-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1047178","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2017-6512","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20173092-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1057721","tags":["report"]},{"url":"https://bugzilla.suse.com/1057724","tags":["report"]},{"url":"https://bugzilla.suse.com/999735","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2017-12837","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-12883","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20210449-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20223271-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20241630-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1082216","tags":["report"]},{"url":"https://bugzilla.suse.com/1082233","tags":["report"]},{"url":"https://bugzilla.suse.com/1210999","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-6798","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-6913","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-31484","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2017-6512","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3625-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-3625-2","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-6512","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-8853","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-6185","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-6797","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-6798","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-6913","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2017-6512","description":"Race condition in the rmtree and remove_tree functions in the File-Path module before 2.13 for Perl allows attackers to set the mode on arbitrary files via vectors involving directory-permission loosening logic.","status":"published","published":"2017-06-01T16:00:00Z","modified":"2024-08-05T15:33:19.829Z","updated_at":"2026-11-02T14:33:16.916541Z"}],"euvd":[{"id":"EUVD-2017-15568","description":"Race condition in the rmtree and remove_tree functions in the File-Path module before 2.13 for Perl allows attackers to set the mode on arbitrary files via vectors involving directory-permission loosening logic.","status":"published","published":"2017-06-01T16:00:00Z","modified":"2024-08-05T15:33:19Z","updated_at":"2026-11-03T02:39:12.023695Z"}],"ghsa":[{"id":"GHSA-wf3v-xjg6-86hx","title":"Race condition in the rmtree and remove_tree functions in the File-Path module before 2.13 for...","description":"Race condition in the rmtree and remove_tree functions in the File-Path module before 2.13 for Perl allows attackers to set the mode on arbitrary files via vectors involving directory-permission loosening logic.","status":"published","published":"2022-05-13T01:27:08Z","modified":"2025-04-20T03:39:27Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-362"],"updated_at":"2026-11-02T15:01:47.375435Z"}],"nvd":[{"id":"CVE-2017-6512","description":"Race condition in the rmtree and remove_tree functions in the File-Path module before 2.13 for Perl allows attackers to set the mode on arbitrary files via vectors involving directory-permission loosening logic.","status":"published","published":"2017-06-01T16:29:00.34Z","modified":"2026-06-17T01:22:28.96Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-362"],"updated_at":"2026-11-02T14:03:49.449157Z"}],"osv":[{"id":"CVE-2017-6512","description":"Race condition in the rmtree and remove_tree functions in the File-Path module before 2.13 for Perl allows attackers to set the mode on arbitrary files via vectors involving directory-permission loosening logic.","status":"published","published":"2017-06-01T16:29:00.34Z","modified":"2026-04-16T06:19:55.337780995Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:06.412595Z"},{"id":"DEBIAN-CVE-2017-6512","description":"Race condition in the rmtree and remove_tree functions in the File-Path module before 2.13 for Perl allows attackers to set the mode on arbitrary files via vectors involving directory-permission loosening logic.","status":"published","published":"2017-06-01T16:29:00.34Z","modified":"2026-09-01T20:03:49.260839822Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:29.412243Z"},{"id":"UBUNTU-CVE-2017-6512","description":"Race condition in the rmtree and remove_tree functions in the File-Path module before 2.13 for Perl allows attackers to set the mode on arbitrary files via vectors involving directory-permission loosening logic.","status":"published","published":"2017-06-01T00:00:00Z","modified":"2026-04-22T11:30:09.105382Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"},{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:15.773974Z"},{"id":"DLA-978-1","title":"perl - security update","status":"published","published":"2017-06-05T00:00:00Z","modified":"2026-03-09T02:11:20.428588Z","updated_at":"2026-11-02T15:46:13.584509Z"},{"id":"DSA-3873-1","title":"perl - security update","status":"published","published":"2017-06-05T00:00:00Z","modified":"2026-03-09T01:19:31.332222Z","updated_at":"2026-11-02T15:46:16.523846Z"},{"id":"MGASA-2018-0047","title":"Updated perl packages fix security vulnerability","description":"John Lightsey and Todd Rinaldo reported that the opportunistic loading of\noptional modules can make many programs unintentionally load code from the\ncurrent working directory (which might be changed to another directory\nwithout the user realising) and potentially leading to privilege escalation\n(CVE-2016-1238).\n\nThe cPanel Security Team reported a time of check to time of use (TOCTTOU)\nrace condition flaw in File::Path, a core module from Perl to create or\nremove directory trees. An attacker can take advantage of this flaw to set\nthe mode on an attacker-chosen file to a attacker-chosen value\n(CVE-2017-6512).\n\nJakub Wilk reported a heap buffer overflow flaw in the regular expression\ncompiler, allowing a remote attacker to cause a denial of service via a\n specially crafted regular expression with the case-insensitive modifier\n(CVE-2017-12837).\n\nJakub Wilk reported a buffer over-read flaw in the regular expression\nparser, allowing a remote attacker to cause a denial of service or\ninformation leak (CVE-2017-12883).\n\nThe perl-libintl-perl, perl-MIME-Charset, perl-MIME-EncWords,\nperl-Module-Build, perl-Sys-Syslog, and perl-Unicode-LineBreak packages\nhave been patched and the perl-Module-Load-Conditional and perl-Net-DNS\npackages have been updated to fix CVE-2016-1238 as well.\n\nThe perl-File-Path package has also been patched to fix CVE-2017-6512.\n","status":"published","published":"2018-01-03T15:50:51Z","modified":"2026-04-16T06:24:25.332206802Z","updated_at":"2026-11-02T15:49:40.442238Z"},{"id":"openSUSE-SU-2024:13154-1","title":"perl-File-Path-2.180000-1.15 on GA media","description":"These are all security issues fixed in the perl-File-Path-2.180000-1.15 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:42:01.072363Z","updated_at":"2026-11-02T16:58:36.025801Z"},{"id":"SUSE-SU-2017:2951-1","title":"Security update for perl","description":"This update for perl fixes the following issues:\n\nSecurity issue fixed:\n- CVE-2017-6512: Race condition in the rmtree and remove_tree functions in the\n  File-Path module before 2.13 for Perl allows attackers to set the mode on\n  arbitrary files via vectors involving directory-permission loosening logic.\n  (bnc#1047178)\n\nBug fixes:\n- reformat baselibs.conf as source validator workaround\n","status":"published","published":"2017-11-08T07:46:03Z","modified":"2026-02-04T04:26:38.633462Z","updated_at":"2026-11-02T15:53:44.209561Z"},{"id":"SUSE-SU-2017:3092-1","title":"Security update for perl","description":"This update for perl fixes the following issues:\n\nSecurity issues fixed:\n- CVE-2017-12837: Heap-based buffer overflow in the S_regatom function in regcomp.c in Perl 5 before\n  5.24.3-RC1 and 5.26.x before 5.26.1-RC1 allows remote attackers to cause a denial of service\n  (out-of-bounds write) via a regular expression with a '\\N{}' escape and the case-insensitive\n  modifier. (bnc#1057724)\n- CVE-2017-12883: Buffer overflow in the S_grok_bslash_N function in regcomp.c in Perl 5 before\n  5.24.3-RC1 and 5.26.x before 5.26.1-RC1 allows remote attackers to disclose sensitive information\n  or cause a denial of service (application crash) via a crafted regular expression with an invalid\n  '\\N{U+...}' escape. (bnc#1057721)\n- CVE-2017-6512: Race condition in the rmtree and remove_tree functions in the File-Path module\n  before 2.13 for Perl allows attackers to set the mode on arbitrary files via vectors involving\n  directory-permission loosening logic. (bnc#1047178)\n\nBug fixes:\n- backport set_capture_string changes from upstream (bsc#999735)\n- reformat baselibs.conf as source validator workaround\n","status":"published","published":"2017-11-24T15:19:55Z","modified":"2026-02-04T04:26:17.633511Z","updated_at":"2026-11-02T15:53:44.209561Z"},{"id":"SUSE-SU-2021:0449-1","title":"Security update for perl-File-Path","description":"This update for perl-File-Path fixes the following issues:\n\n\n- Provide `File::Path` version 2.15 to SLE-12-SP5 (jsc#SLE-17088, jsc#ECO-3050)\n- CVE-2017-6512: fix a race condition in the `File-Path` module for Perl.\n  ","status":"published","published":"2021-02-12T10:38:05Z","modified":"2026-02-04T02:20:06.965137Z","updated_at":"2026-11-02T15:53:48.690034Z"},{"id":"SUSE-SU-2022:3271-1","title":"Security update for perl","description":"This update for perl fixes the following issues:\n\n- CVE-2017-6512: Fixed File::Path rmtree/remove_tree race condition (bsc#1047178).\n","status":"published","published":"2022-09-14T04:46:04Z","modified":"2026-02-04T02:57:43.318293Z","updated_at":"2026-11-02T15:53:51.440565Z"},{"id":"SUSE-SU-2024:1630-1","title":"Security update for perl","description":"This update for perl fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2018-6913: Fixed space calculation issues in pp_pack.c (bsc#1082216)\n- CVE-2018-6798: Fixed heap buffer overflow in regexec.c (bsc#1082233)\n- CVE-2023-31484: Enabled TLS certificate verification in CPAN (bsc#1210999)\n- CVE-2017-6512: Fixed File::Path rmtree/remove_tree race condition (bsc#1047178)\n","status":"published","published":"2024-05-14T07:20:51Z","modified":"2026-02-04T03:21:44.562926Z","updated_at":"2026-11-02T15:53:54.652421Z"},{"id":"USN-3625-1","title":"perl vulnerabilities","description":"It was discovered that Perl incorrectly handled certain regular\nexpressions. An attacker could possibly use this issue to cause Perl to\nhang, resulting in a denial of service. This issue only affected Ubuntu\n14.04 LTS. (CVE-2015-8853)\n\nIt was discovered that Perl incorrectly loaded libraries from the current\nworking directory. A local attacker could possibly use this issue to\nexecute arbitrary code. This issue only affected Ubuntu 14.04 LTS and\nUbuntu 16.04 LTS. (CVE-2016-6185)\n\nIt was discovered that Perl incorrectly handled the rmtree and remove_tree\nfunctions. A local attacker could possibly use this issue to set the mode\non arbitrary files. This issue only affected Ubuntu 14.04 LTS and Ubuntu\n16.04 LTS. (CVE-2017-6512)\n\nBrian Carpenter discovered that Perl incorrectly handled certain regular\nexpressions. An attacker could use this issue to cause Perl to crash,\nresulting in a denial of service, or possibly execute arbitrary code. This\nissue has only been addressed in Ubuntu 16.04 LTS and Ubuntu 17.10.\n(CVE-2018-6797)\n\nNguyen Duc Manh discovered that Perl incorrectly handled certain regular\nexpressions. An attacker could use this issue to cause Perl to crash,\nresulting in a denial of service. This issue only affected Ubuntu 16.04 LTS\nand Ubuntu 17.10. (CVE-2018-6798)\n\nGwanYeong Kim discovered that Perl incorrectly handled certain data when\nusing the pack function. An attacker could use this issue to cause Perl to\ncrash, resulting in a denial of service, or possibly execute arbitrary\ncode. (CVE-2018-6913)\n","status":"published","published":"2018-04-16T12:47:44Z","modified":"2026-04-22T09:44:04.737373Z","updated_at":"2026-11-02T16:58:13.496563Z"}]}}