[security-announce] Security Update: perl: CVE-2016-1238

Sona Sarmadi sona.sarmadi at enea.com
Fri Oct 28 17:11:19 CEST 2016


		Enea Linux Security Advisory

====================================================================
Product/package: Enea Linux 6.0: (perl: 5.22.1)
Severity: Medium
Architecture: All
CVE Name: CVE-2016-1238
 ====================================================================

The following issue have been fixed in perl 5.22.1 in Enea Linux 6.0.

Description
=========
(1) cpan/Archive-Tar/bin/ptar, (2) cpan/Archive-Tar/bin/ptardiff, (3)
cpan/Archive-Tar/bin/ptargrep, (4) cpan/CPAN/scripts/cpan, (5)
cpan/Digest-SHA/shasum, (6) cpan/Encode/bin/enc2xs, (7)
cpan/Encode/bin/encguess, (8) cpan/Encode/bin/piconv, (9)
cpan/Encode/bin/ucmlint, (10) cpan/Encode/bin/unidump, (11)
cpan/ExtUtils-MakeMaker/bin/instmodsh, (12)
cpan/IO-Compress/bin/zipdetails, (13) cpan/JSON-PP/bin/json_pp, (14)
cpan/Test-Harness/bin/prove, (15)
dist/ExtUtils-ParseXS/lib/ExtUtils/xsubpp, (16)
dist/Module-CoreList/corelist, (17) ext/Pod-Html/bin/pod2html, (18)
utils/c2ph.PL, (19) utils/h2ph.PL, (20) utils/h2xs.PL, (21)
utils/libnetcfg.PL, (22) utils/perlbug.PL, (23) utils/perldoc.PL, (24)
utils/perlivp.PL, and (25) utils/splain.PL in Perl 5.x before 5.22.3-RC2
and 5.24 before 5.24.1-RC2 do not properly remove . (period) characters
from the end of the includes directory array, which might allow local
users to gain privileges via a Trojan horse module under the current
working directory.

References:
===========
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1238
http://www.securityfocus.com/bid/92136

Reference to the upstream fix
========================================================
http://perl5.git.perl.org/perl.git/commit/cee96d52c39b1e7b36e1c62d38bcd8d86e9a41ab

Correction for Enea Linux
=========================
http://git.enea.com/cgit/linux/poky.git/patch/?id=529bbe2cc2cebeec0ee6cef27aba2d1aafe79d38

How to get the latest patches
=============================
- If you have already cloned needed repositories, update it to get new
security patches.

cd Enea-Linux-6.0
$ repo sync

- If you have not yet cloned needed repositories, do it as described
below. (Security patches are fetched implicitly when cloning the repos).

Use repo tool to download the source for the Enea Linux 6.0 standard,
follow the steps below:
1. Make sure that the repo tool is installed. If not, follow the
instructions below:

$ curl https://storage.googleapis.com/git-repo-downloads/repo >
~/bin/repo $ chmod a+x ~/bin/repo

The instruction assumes that ~/bin exists and is included in the PATH
variable.

2.Use the repo tool to download the source:
$ mkdir Enea-Linux-6.0
$ cd Enea-Linux-6.0
$ repo init \
-u git://git.enea.com/linux/el_manifests-standard.git \
 -b krogoth\
-m <manifest file> $ repo sync

The parameter <manifest file> depends on the target:
P2041RDB: p2041rdb/default.xml
LS1021a-IoT: ls1021aiot/default.xml
QEMUARM: qemuarm/default.xml
QEMUPCC: qemuppc/default.xml
QEMUX86: qemux86/default.xml

If you have any questions regarding the security patches and security
updates please contact security at enea.com.

For general security in Enea Linux products refer to Enea Linux Security
page:
http://www.enea.com/solutions/Enea-Linux/Security/

For the CVEs fixed at Enea Linux releases see CVE list:
http://www.enea.com/solutions/Enea-Linux/Security/CVEs-list/

For custom packages/releases please use the Support Channel:
http://www.enea.com/solutions/support.

Enea Security Team
Sona Sarmadi
Mobile: +46 70 971 4475
www.enea.com





-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 473 bytes
Desc: OpenPGP digital signature
URL: <http://mail.lists.enea.com/pipermail/security-announce/attachments/20161028/c037c008/attachment.sig>


More information about the security-announce mailing list