CVE-2016-1238

It was found that perl can load modules from the current directory if not found in the module directories, via the @INC path. A local, authenticated attacker could create a specially crafted module in a writable directory and trick a user into running a perl program from that directory; if the module is not found in previous @INC paths, it will load and execute the attacker's module.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

The following examples will remove '.' from the module path :

RHEL6 and above : Create a file /usr/local/share/perl5/sitecustomize.pl containing the line "pop @INC if $INC[-1] eq '.';"

RHEL5: Create a perl module with the same code in a BEGIN block, and use the 'PERL5OPT=-m<module-name>' environment variable to load it before execution of a perl program.