According to the versions of the perl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - (1) cpan/Archive-Tar/bin/ptar, (2)     cpan/Archive-Tar/bin/ptardiff, (3)     cpan/Archive-Tar/bin/ptargrep, (4)     cpan/CPAN/scripts/cpan, (5) cpan/Digest-SHA/shasum, (6)     cpan/Encode/bin/enc2xs, (7) cpan/Encode/bin/encguess,     (8) cpan/Encode/bin/piconv, (9)     cpan/Encode/bin/ucmlint, (10) cpan/Encode/bin/unidump,     (11) cpan/ExtUtils-MakeMaker/bin/instmodsh, (12)     cpan/IO-Compress/bin/zipdetails, (13)     cpan/JSON-PP/bin/json_pp, (14)     cpan/Test-Harness/bin/prove, (15)     dist/ExtUtils-ParseXS/lib/ExtUtils/xsubpp, (16)     dist/Module-CoreList/corelist, (17)     ext/Pod-Html/bin/pod2html, (18) utils/c2ph.PL, (19)     utils/h2ph.PL, (20) utils/h2xs.PL, (21)     utils/libnetcfg.PL, (22) utils/perlbug.PL, (23)     utils/perldoc.PL, (24) utils/perlivp.PL, and (25)     utils/splain.PL in Perl 5.x before 5.22.3-RC2 and 5.24     before 5.24.1-RC2 do not properly remove . (period)     characters from the end of the includes directory     array, which might allow local users to gain privileges     via a Trojan horse module under the current working     directory.(CVE-2016-1238)

  - Integer underflow in regcomp.c in Perl before 5.20, as     used in Apple OS X before 10.10.5 and other products,     allows context-dependent attackers to execute arbitrary     code or cause a denial of service (application crash)     via a long digit string associated with an invalid     backreference within a regular     expression.(CVE-2013-7422)

  - The Dumper method in Data::Dumper before 2.154, as used     in Perl 5.20.1 and earlier, allows context-dependent     attackers to cause a denial of service (stack     consumption and crash) via an Array-Reference with many     nested Array-References, which triggers a large number     of recursive calls to the DD_dump     function.(CVE-2014-4330)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the perl-ExtUtils-ParseXS package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability :

  - It was found that perl can load modules from the     current directory if not found in the module     directories, via the @INC path. A local, authenticated     attacker could create a specially crafted module in a     writable directory and trick a user into running a perl     program from that directory if the module is not found     in previous @INC paths, it will load and execute the     attacker's module.(CVE-2016-1238)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the perl-File-Fetch package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability :

  - It was found that perl can load modules from the     current directory if not found in the module     directories, via the @INC path. A local, authenticated     attacker could create a specially crafted module in a     writable directory and trick a user into running a perl     program from that directory if the module is not found     in previous @INC paths, it will load and execute the     attacker's module.(CVE-2016-1238)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the perl-IPC-Cmd package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability :

  - It was found that perl can load modules from the     current directory if not found in the module     directories, via the @INC path. A local, authenticated     attacker could create a specially crafted module in a     writable directory and trick a user into running a perl     program from that directory if the module is not found     in previous @INC paths, it will load and execute the     attacker's module.(CVE-2016-1238)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - (1) cpan/Archive-Tar/bin/ptar, (2) cpan/Archive-Tar/bin/ptardiff, (3) cpan/Archive-Tar/bin/ptargrep, (4)     cpan/CPAN/scripts/cpan, (5) cpan/Digest-SHA/shasum, (6) cpan/Encode/bin/enc2xs, (7)     cpan/Encode/bin/encguess, (8) cpan/Encode/bin/piconv, (9) cpan/Encode/bin/ucmlint, (10)     cpan/Encode/bin/unidump, (11) cpan/ExtUtils-MakeMaker/bin/instmodsh, (12) cpan/IO-Compress/bin/zipdetails,     (13) cpan/JSON-PP/bin/json_pp, (14) cpan/Test-Harness/bin/prove, (15) dist/ExtUtils-     ParseXS/lib/ExtUtils/xsubpp, (16) dist/Module-CoreList/corelist, (17) ext/Pod-Html/bin/pod2html, (18)     utils/c2ph.PL, (19) utils/h2ph.PL, (20) utils/h2xs.PL, (21) utils/libnetcfg.PL, (22) utils/perlbug.PL,     (23) utils/perldoc.PL, (24) utils/perlivp.PL, and (25) utils/splain.PL in Perl 5.x before 5.22.3-RC2 and     5.24 before 5.24.1-RC2 do not properly remove . (period) characters from the end of the includes directory     array, which might allow local users to gain privileges via a Trojan horse module under the current     working directory. (CVE-2016-1238)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote NewStart CGSL host, running version MAIN 6.06 (SP), has perl packages installed that are affected by multiple vulnerabilities:

  - Heap-based buffer overflow in the pack function in Perl before 5.26.2 allows context-dependent attackers     to execute arbitrary code via a large item count. (CVE-2018-6913)

  - Directory traversal vulnerability in the Archive::Tar Perl module 1.36 and earlier allows user-assisted     remote attackers to overwrite arbitrary files via a TAR archive that contains a file whose name is an     absolute path or has .. sequences. (CVE-2007-4829)

  - The rmtree function in lib/File/Path.pm in Perl 5.10 does not properly check permissions before performing     a chmod, which allows local users to modify the permissions of arbitrary files via a symlink attack, a     different vulnerability than CVE-2005-0448 and CVE-2004-0452. (CVE-2008-2827)

  - Perl 5.10.1 allows context-dependent attackers to cause a denial of service (application crash) via a     UTF-8 character with a large, invalid codepoint, which is not properly handled during a regular-expression     match. (CVE-2009-3626)

  - The bsd_glob function in the File::Glob module for Perl before 5.14.2 allows context-dependent attackers     to cause a denial of service (crash) via a glob expression with the GLOB_ALTDIRFUNC flag, which triggers     an uninitialized pointer dereference. (CVE-2011-2728)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
132183	EulerOS 2.0 SP3 : perl (EulerOS-SA-2019-2648)	Nessus	Huawei Local Security Checks	2019/12/18	2024/4/3	high
140942	EulerOS Virtualization for ARM 64 3.0.6.0 : perl-ExtUtils-ParseXS (EulerOS-SA-2020-1994)	Nessus	Huawei Local Security Checks	2020/9/29	2024/2/19	high
140970	EulerOS Virtualization for ARM 64 3.0.6.0 : perl-File-Fetch (EulerOS-SA-2020-2022)	Nessus	Huawei Local Security Checks	2020/9/29	2024/2/19	high
140974	EulerOS Virtualization for ARM 64 3.0.6.0 : perl-IPC-Cmd (EulerOS-SA-2020-2026)	Nessus	Huawei Local Security Checks	2020/9/29	2024/2/19	high
219255	Linux Distros Unpatched Vulnerability : CVE-2016-1238	Nessus	Misc.	2025/3/4	2026/7/24	high
301232	NewStart CGSL MAIN 6.06 (SP) : perl Multiple Vulnerabilities (NS-SA-2026-0016)	Nessus	NewStart CGSL Local Security Checks	2026/3/6	2026/3/9	critical

検出

プラグインの検索

high

high

high

high

high

critical