CVE-2016-2381

Published: Apr 8, 2016Modified: May 6, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

Perl might allow context-dependent attackers to bypass the taint protection mechanism in a child process via duplicate environment variables in envp.

Affected (19)

Products: Perl: Perl · Debian: Debian Linux · Oracle: Communications Billing And Revenue Management, Configuration Manager, Database Server, Enterprise Manager Base Platform, Solaris, Timesten In Memory Database · +2 more

Show all products

Perl: Perl · Debian: Debian Linux · Oracle: Communications Billing And Revenue Management, Configuration Manager, Database Server, Enterprise Manager Base Platform, Solaris, Timesten In Memory Database · Opensuse: Opensuse · Canonical: Ubuntu Linux

1 product

1 product

6 products

Communications Billing And Revenue Management

Configuration Manager

Database Server

Enterprise Manager Base Platform

Timesten In Memory Database

1 product

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Perl Perl	Before 5.23.9

Configuration B

2 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 7.0
Debian Debian Linux	Version 8.0

Configuration C

12 vulnerable

Vulnerable Software	Affected Versions
Oracle Communications Billing And Revenue Management	Version 7.5
Oracle Configuration Manager	Before 12.1.2.0.4
Oracle Configuration Manager	Version 12.1.2.0.6
Oracle Database Server	Version 11.2.0.4
Oracle Database Server	Version 12.1.0.2
Oracle Database Server	Version 12.2.0.1
Oracle Database Server	Version 18c
Oracle Database Server	Version 19c
Oracle Enterprise Manager Base Platform	Version 13.2.0.0.0
Oracle Enterprise Manager Base Platform	Version 13.3.0.0.0
Oracle Solaris	Version 11.3
Oracle Timesten In Memory Database	Before 18.1.2.1.0

Configuration D

1 vulnerable

Vulnerable Software	Affected Versions
Opensuse Opensuse	Version 13.2

Configuration E

3 vulnerable

Vulnerable Software	Affected Versions
Canonical Ubuntu Linux	Version 12.04
Canonical Ubuntu Linux	Version 14.04
Canonical Ubuntu Linux	Version 15.10

Related CWEs

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (26)

http://lists.opensuse.org/opensuse-updates/2016-03/msg00112.html

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://perl5.git.perl.org/perl.git/commitdiff/ae37b791a73a9e78dedb89fb2429d2628cf58076

Source: cve@mitre.org

Vendor Advisory

http://www.debian.org/security/2016/dsa-3501

Source: cve@mitre.org

Third Party Advisory

http://www.gossamer-threads.com/lists/perl/porters/326387

Source: cve@mitre.org

Third Party Advisory

http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html

Source: cve@mitre.org

Third Party Advisory

http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html

Source: cve@mitre.org

Third Party Advisory

http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html

Source: cve@mitre.org

Third Party Advisory

http://www.securityfocus.com/bid/83802

Source: cve@mitre.org

Third Party AdvisoryVDB Entry

http://www.ubuntu.com/usn/USN-2916-1

Source: cve@mitre.org

Third Party Advisory

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05240731

Source: cve@mitre.org

Third Party Advisory

https://security.gentoo.org/glsa/201701-75

Source: cve@mitre.org

Third Party Advisory

https://www.oracle.com/security-alerts/cpuapr2020.html

Source: cve@mitre.org

Third Party Advisory

https://www.oracle.com/security-alerts/cpujul2020.html

Source: cve@mitre.org

Third Party Advisory

http://lists.opensuse.org/opensuse-updates/2016-03/msg00112.html

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

http://perl5.git.perl.org/perl.git/commitdiff/ae37b791a73a9e78dedb89fb2429d2628cf58076

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://www.debian.org/security/2016/dsa-3501

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

http://www.gossamer-threads.com/lists/perl/porters/326387

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

http://www.securityfocus.com/bid/83802

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryVDB Entry

http://www.ubuntu.com/usn/USN-2916-1

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05240731

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://security.gentoo.org/glsa/201701-75

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://www.oracle.com/security-alerts/cpuapr2020.html

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://www.oracle.com/security-alerts/cpujul2020.html

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.