CVE-2016-1238

Name of the Vulnerable Software and Affected Versions Perl versions prior to 5.22.3-RC2 Perl versions 5.24 prior to 5.24.1-RC2

Description The issue is related to errors in privilege management in the Perl interpreter, specifically with the handling of the included directory array ("@INC"). This could allow a local user to gain privileges via a Trojan horse module under the current working directory by exploiting the failure to properly remove period characters from the end of the includes directory array.

Recommendations For Perl versions prior to 5.22.3-RC2, update to version 5.22.3-RC2 or later. For Perl versions 5.24 prior to 5.24.1-RC2, update to version 5.24.1-RC2 or later. As a temporary workaround, consider restricting access to the vulnerable modules under the current working directory to minimize the risk of exploitation.