According to the versions of the perl packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - Perl might allow context-dependent attackers to bypass     the taint protection mechanism in a child process via     duplicate environment variables in envp.(CVE-2016-2381)

  - Perl before 5.30.3 on 32-bit platforms allows a     heap-based buffer overflow because nested regular     expression quantifiers have an integer     overflow.(CVE-2020-10543)

  - Perl before 5.30.3 has an integer overflow related to     mishandling of a 'PL_regkind[OP(n)] == NOTHING'     situation. A crafted regular expression could lead to     malformed bytecode with a possibility of instruction     injection.(CVE-2020-10878)

  - regcomp.c in Perl before 5.30.3 allows a buffer     overflow via a crafted regular expression because of     recursive S_study_chunk calls.(CVE-2020-12723)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

MITRE reports :

Perl might allow context-dependent attackers to bypass the taint protection mechanism in a child process via duplicate environment variables in envp.

The remote NewStart CGSL host, running version MAIN 6.06 (SP), has perl packages installed that are affected by multiple vulnerabilities:

  - Heap-based buffer overflow in the pack function in Perl before 5.26.2 allows context-dependent attackers     to execute arbitrary code via a large item count. (CVE-2018-6913)

  - Directory traversal vulnerability in the Archive::Tar Perl module 1.36 and earlier allows user-assisted     remote attackers to overwrite arbitrary files via a TAR archive that contains a file whose name is an     absolute path or has .. sequences. (CVE-2007-4829)

  - The rmtree function in lib/File/Path.pm in Perl 5.10 does not properly check permissions before performing     a chmod, which allows local users to modify the permissions of arbitrary files via a symlink attack, a     different vulnerability than CVE-2005-0448 and CVE-2004-0452. (CVE-2008-2827)

  - Perl 5.10.1 allows context-dependent attackers to cause a denial of service (application crash) via a     UTF-8 character with a large, invalid codepoint, which is not properly handled during a regular-expression     match. (CVE-2009-3626)

  - The bsd_glob function in the File::Glob module for Perl before 5.14.2 allows context-dependent attackers     to cause a denial of service (crash) via a glob expression with the GLOB_ALTDIRFUNC flag, which triggers     an uninitialized pointer dereference. (CVE-2011-2728)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the version of the perl packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability :

  - Perl might allow context-dependent attackers to bypass     the taint protection mechanism in a child process via     duplicate environment variables in envp.(CVE-2016-2381)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for perl fixes the following issues :

  - CVE-2016-6185: xsloader looking at a '(eval)' directory     [bsc#988311]

  - CVE-2016-1238: searching current directory for optional     modules [bsc#987887]

  - CVE-2015-8853: regex engine hanging on bad utf8     [bnc976584]

  - CVE-2016-2381: environment dup handling bug [bsc#967082]

  - perl panic with utf8_mg_pos_cache_update [bsc#929027]

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Stephane Chazelas discovered a bug in the environment handling in Perl. Perl provides a Perl-space hash variable, %ENV, in which environment variables can be looked up. If a variable appears twice in envp, only the last value would appear in %ENV, but getenv would return the first. Perl's taint security mechanism would be applied to the value in %ENV, but not to the other rest of the environment. This could result in an ambiguous environment causing environment variables to be propagated to subprocesses, despite the protections supposedly offered by taint checking.

With this update Perl changes the behavior to match the following :

  - %ENV is populated with the first environment variable,     as getenv would return.
  - Duplicate environment entries are removed.

According to the version of the perl packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - Perl might allow context-dependent attackers to bypass     the taint protection mechanism in a child process via     duplicate environment variables in envp.(CVE-2016-2381)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Fix manipulating environment variables to align with how glibc handles duplicated environment variables. Perl now uses the first variable listed in the environment array and it removes any subsequent entries of the same-named variable from the array, so that child processes have only one variable instance in its environment.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for perl fixes the following issues :

  - CVE-2016-2381: Fixed environment duplicated variable     handling bug [boo#967082]

  - fix memory leak in 'use utf8' handling [boo#928292]

  - CVE-2015-8607: Fixed taint propagation in canonpath     [boo#961528]

The Rocky Linux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_1588 advisory.

    This advisory aggregates security fixes for the perl SRPM in CIQ LTS 9.2. It addresses 18 CVEs:
    CVE-2020-10878, CVE-2008-2827, CVE-2018-6798, CVE-2016-6185, CVE-2018-6797, and 13 more.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
151395	EulerOS Virtualization 3.0.2.2 : perl (EulerOS-SA-2021-2157)	Nessus	Huawei Local Security Checks	2021/7/6	2023/12/11	high
91028	FreeBSD : perl5 -- taint mechanism bypass vulnerability (d9f99491-1656-11e6-94fa-002590263bf5)	Nessus	FreeBSD Local Security Checks	2016/5/11	2021/1/4	high
301232	NewStart CGSL MAIN 6.06 (SP) : perl Multiple Vulnerabilities (NS-SA-2026-0016)	Nessus	NewStart CGSL Local Security Checks	2026/3/6	2026/3/9	critical
147054	EulerOS Virtualization 3.0.6.6 : perl (EulerOS-SA-2021-1508)	Nessus	Huawei Local Security Checks	2021/3/4	2024/1/16	high
93371	SUSE SLES11 Security Update : perl (SUSE-SU-2016:2246-1)	Nessus	SuSE Local Security Checks	2016/9/8	2026/1/27	high
89062	Debian DSA-3501-1 : perl - security update	Nessus	Debian Local Security Checks	2016/3/2	2021/1/11	high
146126	EulerOS 2.0 SP5 : perl (EulerOS-SA-2021-1222)	Nessus	Huawei Local Security Checks	2021/2/4	2024/1/24	high
89882	Fedora 22 : perl-5.20.3-329.fc22 (2016-1fb63e3bf3)	Nessus	Fedora Local Security Checks	2016/3/14	2021/1/11	medium
90164	openSUSE Security Update : perl (openSUSE-2016-386)	Nessus	SuSE Local Security Checks	2016/3/25	2021/1/19	high
89555	Fedora 23 : perl-5.22.1-351.fc23 (2016-5d4fc5ecc9)	Nessus	Fedora Local Security Checks	2016/3/4	2021/1/11	medium
363401	Rocky Linux 9.2 [CIQ] Security Update: perl / perl-Attribute-Handlers / perl-AutoLoader / perl-AutoSplit / etc Multiple Vulnerabilities (ciqsa-2026_1588)	Nessus	Rocky Linux Local Security Checks	2026/10/6	2026/10/7	critical

検出

プラグインの検索

high

high

critical

high

high

high

high

medium

high

medium

critical