diff options
| author |   afresh1 <afresh1@openbsd.org> | 2016-07-25 10:53:00 +0000 |
|---|---|---|
| committer | afresh1 <afresh1@openbsd.org> | 2016-07-25 10:53:00 +0000 |
| commit | 0b7734b3d77bb9b21afec6f4621cae6c805dbd45 (patch) | |
| tree | cdadbc2f02c3a5f0ddbe5c87a332d0e6c004dbfe /gnu/usr.bin/perl/dist/ExtUtils-ParseXS/lib/ExtUtils/ParseXS | |
| parent | err() instead of errx(); noted by tim (diff) | |
| download | wireguard-openbsd-0b7734b3d77bb9b21afec6f4621cae6c805dbd45.tar.xz wireguard-openbsd-0b7734b3d77bb9b21afec6f4621cae6c805dbd45.zip | |
Patch perl CVE-2016-1238
The problem relates to Perl 5 ("perl") loading modules from the
includes directory array ("@INC") in which the last element is the
current directory ("."). That means that, when "perl" wants to
load a module (during first compilation or during lazy loading of
a module in run-time), perl will look for the module in the current
directory at the end, since '.' is the last include directory in
its array of include directories to seek. The issue is with requiring
libraries that are in "." but are not otherwise installed.
The major problem with this behavior is that it unexpectedly puts
a user at risk whenever they execute any Perl scripts from a directory
that is writable by other accounts on the system. For instance, if
a user is logged in as root and changes directory into /tmp or an
account's home directory, it is possible to now run any shell
commands that are written in C, Python or Ruby without fear.
The same isn't true for any shell commands that are written in Perl,
since a significant proportion of Perl scripts will execute code
in the current working directory whenever they are run. For example,
if a user on a shared system creates the file /tmp/Pod/Perldoc/Toterm.pm,
and then I log in as root, change directory to /tmp, and run "perldoc
perlrun", it will execute the code they have placed in the file.
ok deraadt@
Diffstat (limited to 'gnu/usr.bin/perl/dist/ExtUtils-ParseXS/lib/ExtUtils/ParseXS')
4 files changed, 4 insertions, 4 deletions
diff --git a/gnu/usr.bin/perl/dist/ExtUtils-ParseXS/lib/ExtUtils/ParseXS/Constants.pm b/gnu/usr.bin/perl/dist/ExtUtils-ParseXS/lib/ExtUtils/ParseXS/Constants.pm index 34fbc21e167..a7ea14c0a53 100644 --- a/gnu/usr.bin/perl/dist/ExtUtils-ParseXS/lib/ExtUtils/ParseXS/Constants.pm +++ b/gnu/usr.bin/perl/dist/ExtUtils-ParseXS/lib/ExtUtils/ParseXS/Constants.pm @@ -3,7 +3,7 @@ use strict; use warnings; use Symbol; -our $VERSION = '3.24'; +our $VERSION = '3.24_01'; =head1 NAME diff --git a/gnu/usr.bin/perl/dist/ExtUtils-ParseXS/lib/ExtUtils/ParseXS/CountLines.pm b/gnu/usr.bin/perl/dist/ExtUtils-ParseXS/lib/ExtUtils/ParseXS/CountLines.pm index 473f531f750..e78f2935386 100644 --- a/gnu/usr.bin/perl/dist/ExtUtils-ParseXS/lib/ExtUtils/ParseXS/CountLines.pm +++ b/gnu/usr.bin/perl/dist/ExtUtils-ParseXS/lib/ExtUtils/ParseXS/CountLines.pm @@ -1,7 +1,7 @@ package ExtUtils::ParseXS::CountLines; use strict; -our $VERSION = '3.24'; +our $VERSION = '3.24_01'; our $SECTION_END_MARKER; diff --git a/gnu/usr.bin/perl/dist/ExtUtils-ParseXS/lib/ExtUtils/ParseXS/Eval.pm b/gnu/usr.bin/perl/dist/ExtUtils-ParseXS/lib/ExtUtils/ParseXS/Eval.pm index 4b8cbd6337e..fb2125fe6ab 100644 --- a/gnu/usr.bin/perl/dist/ExtUtils-ParseXS/lib/ExtUtils/ParseXS/Eval.pm +++ b/gnu/usr.bin/perl/dist/ExtUtils-ParseXS/lib/ExtUtils/ParseXS/Eval.pm @@ -2,7 +2,7 @@ package ExtUtils::ParseXS::Eval; use strict; use warnings; -our $VERSION = '3.24'; +our $VERSION = '3.24_01'; =head1 NAME diff --git a/gnu/usr.bin/perl/dist/ExtUtils-ParseXS/lib/ExtUtils/ParseXS/Utilities.pm b/gnu/usr.bin/perl/dist/ExtUtils-ParseXS/lib/ExtUtils/ParseXS/Utilities.pm index 8fb3492090b..8839102db79 100644 --- a/gnu/usr.bin/perl/dist/ExtUtils-ParseXS/lib/ExtUtils/ParseXS/Utilities.pm +++ b/gnu/usr.bin/perl/dist/ExtUtils-ParseXS/lib/ExtUtils/ParseXS/Utilities.pm @@ -5,7 +5,7 @@ use Exporter; use File::Spec; use ExtUtils::ParseXS::Constants (); -our $VERSION = '3.24'; +our $VERSION = '3.24_01'; our (@ISA, @EXPORT_OK); @ISA = qw(Exporter); |