The remote host is affected by the vulnerability described in GLSA-201701-75 (Perl: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Perl. Please review the       CVE identifiers referenced below for details.
  Impact :

    A remote attacker could possibly execute arbitrary code with the       privileges of the process, cause a Denial of Service condition, or       escalate privileges.
  Workaround :

    There is no known workaround at this time.

The remote NewStart CGSL host, running version MAIN 6.06, has perl packages installed that are affected by multiple vulnerabilities:

  - Heap-based buffer overflow in the pack function in Perl before 5.26.2 allows context-dependent attackers     to execute arbitrary code via a large item count. (CVE-2018-6913)

  - Directory traversal vulnerability in the Archive::Tar Perl module 1.36 and earlier allows user-assisted     remote attackers to overwrite arbitrary files via a TAR archive that contains a file whose name is an     absolute path or has .. sequences. (CVE-2007-4829)

  - The rmtree function in lib/File/Path.pm in Perl 5.10 does not properly check permissions before performing     a chmod, which allows local users to modify the permissions of arbitrary files via a symlink attack, a     different vulnerability than CVE-2005-0448 and CVE-2004-0452. (CVE-2008-2827)

  - Perl 5.10.1 allows context-dependent attackers to cause a denial of service (application crash) via a     UTF-8 character with a large, invalid codepoint, which is not properly handled during a regular-expression     match. (CVE-2009-3626)

  - The bsd_glob function in the File::Glob module for Perl before 5.14.2 allows context-dependent attackers     to cause a denial of service (crash) via a glob expression with the GLOB_ALTDIRFUNC flag, which triggers     an uninitialized pointer dereference. (CVE-2011-2728)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for Perl fixes the following issues :

  - CVE-2016-6185: Xsloader looking at a '(eval)' directory.
    (bsc#988311)

  - CVE-2016-1238: Searching current directory for optional     modules. (bsc#987887)

  - CVE-2015-8853: Regular expression engine hanging on bad     utf8. (bsc)

  - CVE-2016-2381: Environment dup handling bug.
    (bsc#967082)

  - 'Insecure dependency in require' error in taint mode.
    (bsc#984906)

  - Memory leak in 'use utf8' handling. (bsc#928292)

  - Missing lock prototype to the debugger. (bsc#932894)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for Perl fixes the following issues :

  - CVE-2016-6185: Xsloader looking at a '(eval)' directory.
    (bsc#988311)

  - CVE-2016-1238: Searching current directory for optional     modules. (bsc#987887)

  - CVE-2015-8853: Regular expression engine hanging on bad     utf8. (bsc)

  - CVE-2016-2381: Environment dup handling bug.
    (bsc#967082)

  - 'Insecure dependency in require' error in taint mode.
    (bsc#984906)

  - Memory leak in 'use utf8' handling. (bsc#928292)

  - Missing lock prototype to the debugger. (bsc#932894)

This update was imported from the SUSE:SLE-12:Update update project.

The remote NewStart CGSL host, running version MAIN 6.06 (SP), has perl packages installed that are affected by multiple vulnerabilities:

  - Heap-based buffer overflow in the pack function in Perl before 5.26.2 allows context-dependent attackers     to execute arbitrary code via a large item count. (CVE-2018-6913)

  - Directory traversal vulnerability in the Archive::Tar Perl module 1.36 and earlier allows user-assisted     remote attackers to overwrite arbitrary files via a TAR archive that contains a file whose name is an     absolute path or has .. sequences. (CVE-2007-4829)

  - The rmtree function in lib/File/Path.pm in Perl 5.10 does not properly check permissions before performing     a chmod, which allows local users to modify the permissions of arbitrary files via a symlink attack, a     different vulnerability than CVE-2005-0448 and CVE-2004-0452. (CVE-2008-2827)

  - Perl 5.10.1 allows context-dependent attackers to cause a denial of service (application crash) via a     UTF-8 character with a large, invalid codepoint, which is not properly handled during a regular-expression     match. (CVE-2009-3626)

  - The bsd_glob function in the File::Glob module for Perl before 5.14.2 allows context-dependent attackers     to cause a denial of service (crash) via a glob expression with the GLOB_ALTDIRFUNC flag, which triggers     an uninitialized pointer dereference. (CVE-2011-2728)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The XSLoader::load method in XSLoader in Perl does not properly locate .so files when called in a string     eval, which might allow local users to execute arbitrary code via a Trojan horse library under the current     working directory. (CVE-2016-6185)

Note that Nessus relies on the presence of the package as reported by the vendor.

This fixes CVE-2016-6185 vulnerability (do not let XSLoader load relative paths).

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for perl fixes the following issues :

  - CVE-2016-6185: xsloader looking at a '(eval)' directory     [bsc#988311]

  - CVE-2016-1238: searching current directory for optional     modules [bsc#987887]

  - CVE-2015-8853: regex engine hanging on bad utf8     [bnc976584]

  - CVE-2016-2381: environment dup handling bug [bsc#967082]

  - perl panic with utf8_mg_pos_cache_update [bsc#929027]

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
96861	GLSA-201701-75 : Perl: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2017/1/30	2026/1/2	high
266244	NewStart CGSL MAIN 6.06 : perl Multiple Vulnerabilities (NS-SA-2025-0211)	Nessus	NewStart CGSL Local Security Checks	2025/9/30	2025/9/30	critical
93437	SUSE SLED12 / SLES12 Security Update : perl (SUSE-SU-2016:2263-1)	Nessus	SuSE Local Security Checks	2016/9/12	2026/1/26	high
93583	openSUSE Security Update : perl (openSUSE-2016-1086)	Nessus	SuSE Local Security Checks	2016/9/19	2026/1/23	high
301232	NewStart CGSL MAIN 6.06 (SP) : perl Multiple Vulnerabilities (NS-SA-2026-0016)	Nessus	NewStart CGSL Local Security Checks	2026/3/6	2026/3/9	critical
219825	Linux Distros Unpatched Vulnerability : CVE-2016-6185	Nessus	Misc.	2025/3/4	2026/7/24	high
92388	Fedora 23 : 4:perl (2016-742bde2be7)	Nessus	Fedora Local Security Checks	2016/7/19	2026/1/30	high
93371	SUSE SLES11 Security Update : perl (SUSE-SU-2016:2246-1)	Nessus	SuSE Local Security Checks	2016/9/8	2026/1/27	high

検出

プラグインの検索

high

critical

high

high

critical

high

high

high