According to the version of the perl packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability :

  - Perl might allow context-dependent attackers to bypass     the taint protection mechanism in a child process via     duplicate environment variables in envp.(CVE-2016-2381)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Stephane Chazelas discovered a bug in the environment handling in Perl. Perl provides a Perl-space hash variable, %ENV, in which environment variables can be looked up. If a variable appears twice in envp, only the last value would appear in %ENV, but getenv would return the first. Perl's taint security mechanism would be applied to the value in %ENV, but not to the other rest of the environment. This could result in an ambiguous environment causing environment variables to be propagated to subprocesses, despite the protections supposedly offered by taint checking.

With this update Perl changes the behavior to match the following :

  - %ENV is populated with the first environment variable,     as getenv would return.
  - Duplicate environment entries are removed.

This update for perl fixes the following issues :

  - CVE-2016-6185: xsloader looking at a '(eval)' directory     [bsc#988311]

  - CVE-2016-1238: searching current directory for optional     modules [bsc#987887]

  - CVE-2015-8853: regex engine hanging on bad utf8     [bnc976584]

  - CVE-2016-2381: environment dup handling bug [bsc#967082]

  - perl panic with utf8_mg_pos_cache_update [bsc#929027]

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the perl packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - Perl might allow context-dependent attackers to bypass     the taint protection mechanism in a child process via     duplicate environment variables in envp.(CVE-2016-2381)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Fix manipulating environment variables to align with how glibc handles duplicated environment variables. Perl now uses the first variable listed in the environment array and it removes any subsequent entries of the same-named variable from the array, so that child processes have only one variable instance in its environment.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for perl fixes the following issues :

  - CVE-2016-2381: Fixed environment duplicated variable     handling bug [boo#967082]

  - fix memory leak in 'use utf8' handling [boo#928292]

  - CVE-2015-8607: Fixed taint propagation in canonpath     [boo#961528]

ID	Name	Product	Family	Published	Updated	Severity
147054	EulerOS Virtualization 3.0.6.6 : perl (EulerOS-SA-2021-1508)	Nessus	Huawei Local Security Checks	3/4/2021	1/16/2024	high
89062	Debian DSA-3501-1 : perl - security update	Nessus	Debian Local Security Checks	3/2/2016	1/11/2021	high
93371	SUSE SLES11 Security Update : perl (SUSE-SU-2016:2246-1)	Nessus	SuSE Local Security Checks	9/8/2016	1/27/2026	high
146126	EulerOS 2.0 SP5 : perl (EulerOS-SA-2021-1222)	Nessus	Huawei Local Security Checks	2/4/2021	1/24/2024	high
89555	Fedora 23 : perl-5.22.1-351.fc23 (2016-5d4fc5ecc9)	Nessus	Fedora Local Security Checks	3/4/2016	1/11/2021	medium
89882	Fedora 22 : perl-5.20.3-329.fc22 (2016-1fb63e3bf3)	Nessus	Fedora Local Security Checks	3/14/2016	1/11/2021	medium
90164	openSUSE Security Update : perl (openSUSE-2016-386)	Nessus	SuSE Local Security Checks	3/25/2016	1/19/2021	high

Detections

Analytics

Plugins Search

high

high

high

high

medium

medium

high