Free and open-source vulnerability scanner
Mageni eases for you the vulnerability scanning, assessment, and management process. It is free and open-source.
Install NowAvailable for macOS, Windows, and Linux
Strawberry Perl Modules Multiple Vulnerabilities (Windows)
Information
Severity
Severity
Family
Family
CVSSv2 Base
CVSSv2 Base
CVSSv2 Vector
CVSSv2 Vector
Solution Type
Solution Type
Created
Created
Modified
Modified
Summary
The host is installed with Strawberry Perl and is prone to multiple vulnerabilities.
Insight
Insight
The flaws are due to - an error in par_mktmpdir function in the 'PAR::Packer' and 'PAR' modules creates temporary files in a directory with a predictable name without verifying ownership and permissions of this directory. - the 'Digest->new()' function not properly sanitising input before using it in an 'eval()' call, which can be exploited to inject and execute arbitrary perl code. - off-by-one error in the decode_xs function in Unicode/Unicode.xs in the 'Encode' module. - An error within the 'File::Glob::bsd_glob()' function when handling the GLOB_ALTDIRFUNC flag can be exploited to cause an access violation and potentially execute arbitrary code.
Affected Software
Affected Software
Strawberry Perl PAR module before 1.003 Strawberry Perl Digest module before 1.17 Strawberry Perl Encode module before 2.44 Strawberry Perl PAR::Packer module before 1.012 on winows
Solution
Solution
Upgrade to Strawberry Perl 5.14.2 or later, Upgrade to Strawberry Perl PAR module version 1.003 or later Upgrade to Strawberry Perl Digest module version 1.17 or later Upgrade to Strawberry Perl Encode module version 2.44 or later Upgrade Strawberry Perl PAR::Packer module version 1.012 or later ***** NOTE: Ignore this warning if above mentioned versions of modules are already installed. *****