CVE-2016-6185

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2016-08-02 · updated 2026-06-17

Description

The XSLoader::load method in XSLoader in Perl does not properly locate .so files when called in a string eval, which might allow local users to execute arbitrary code via a Trojan horse library under the current working directory.

Affected products

Canonical Ubuntu Linux: 12.04, 14.04, 16.04, 17.10
Debian Linux: 8.0
Fedoraproject Fedora: 22, 23, 24
Oracle Corporation Solaris Operating System: 10, 11.3
perl: from 5.23.0 before 5.24.1; from 5.25.0 before 5.25.3 — fixed in 5.24.1, 5.25.3

How to fix

Upgrade to a fixed version: perl 5.24.1, 5.25.3. Check the vendor advisory for mitigations.

References

http://perl5.git.perl.org/perl.git/commitdiff/08e3451d7
http://www.debian.org/security/2016/dsa-3628
http://www.openwall.com/lists/oss-security/2016/07/07/1
http://www.openwall.com/lists/oss-security/2016/07/08/5
http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html
http://www.securityfocus.com/bid/91685
http://www.securitytracker.com/id/1036260
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5RFDMASVZLFZYBB2GNTZXU6I76E4NA4V/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ITYZJXQH24X2F2LAOQEQAC5KXLYJTJ76/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PRIPTDA6XINBVEJXI2NGLKVEINBREHTN/
https://rt.cpan.org/Public/Bug/Display.html?id=115808
https://security.gentoo.org/glsa/201701-75

Get alerted when CVE-2016-6185 or the next vulnerability affects your stack