ALPINE-CVE-2018-12015 PUBLISHED CVSS 7.5 HIGH

In Perl through 5.26.2, the Archive::Tar module allows remote attackers to bypass a directory-traversal protection mechanism, and overwrite arbitrary files, via an archive file containing a symlink and a regular file with the same name.

Risk Scores

CVSS v3.0
7.5
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Affected Products

VendorProductVersions
Alpine:v3.10perl5.10.0-r1, 5.16.2-r0, 5.16.1-r0
Alpine:v3.6perl5.16.2-r0, 0, 5.10.0-r0
Alpine:v3.20perl5.24.0-r2, 5.24.0-r1, 5.24.0-r0
Alpine:v3.5perl5.16.2-r0, 5.16.3-r0, 5.16.2-r0
Alpine:v3.22perl5.14.0-r0, 5.20.2-r0, 5.22.0-r0
Alpine:v3.18perl5.26.2-r0, 5.26.1-r1, 5.26.1-r0
Alpine:v3.14perl5.10.0-r1, 5.10.0-r0, 0
Alpine:v3.17perl5.16.3-r0, 0, 5.10.0-r1
Alpine:v3.12perl5.22.0-r0, 5.20.2-r1, 5.20.2-r0
Alpine:v3.15perl5.22.2-r0, 5.26.2-r0, 5.26.1-r1
Alpine:v3.13perl5.22.2-r0, 5.20.1-r0, 5.10.1-r2
Alpine:v3.16perl5.24.0-r0, 5.10.0-r0, 0
Alpine:v3.11perl5.26.2-r0, 5.26.1-r1, 5.26.1-r0
Alpine:v3.19perl5.26.1-r0, 0, 5.10.0-r0
Alpine:v3.8perl5.10.1-r1, 5.26.2-r0, 5.26.1-r1
Alpine:v3.7perl0, 5.10.0-r0, 5.10.0-r1
Alpine:v3.23perl5.10.0-r1, 5.10.1-r0, 5.10.1-r1
Alpine:v3.9perl5.26.2-r0, 0, 5.10.0-r0
Alpine:v3.21perl0, 5.10.0-r0, 5.10.1-r0

Timeline

References

Open in Interactive Console →