| Description: | Summary:
Strawberry Perl is prone to multiple vulnerabilities.
Vulnerability Insight:
The flaws are due to
- an error in par_mktmpdir function in the 'PAR::Packer' and 'PAR' modules
creates temporary files in a directory with a predictable name without
verifying ownership and permissions of this directory.
- the 'Digest->new()' function not properly sanitising input before using it
in an 'eval()' call, which can be exploited to inject and execute arbitrary
perl code.
- off-by-one error in the decode_xs function in Unicode/Unicode.xs in the
'Encode' module.
- An error within the 'File::Glob::bsd_glob()' function when handling the
GLOB_ALTDIRFUNC flag can be exploited to cause an access violation and
potentially execute arbitrary code.
Vulnerability Impact:
Successful exploitation will allow attackers to cause an affected
application to crash or execute arbitrary perl code.
Affected Software/OS:
Strawberry Perl PAR module before 1.003
Strawberry Perl Digest module before 1.17
Strawberry Perl Encode module before 2.44
Strawberry Perl PAR::Packer module before 1.012
Solution:
Update to Strawberry Perl 5.14.2 or later
Update to Strawberry Perl PAR module version 1.003 or later
Update to Strawberry Perl Digest module version 1.17 or later
Update to Strawberry Perl Encode module version 2.44 or later
Update Strawberry Perl PAR::Packer module version 1.012 or later
CVSS Score:
7.5
CVSS Vector:
AV:N/AC:L/Au:N/C:P/I:P/A:P
|
