Affected: AlmaLinux:9: perl-Module-ScanDeps

This module scans potential modules used by perl programs and returns a hash reference. Its keys are the module names as they appear in %INC (e.g. Test/More.pm). The values are hash references.

Security Fix(es):

* module-scandeps: local privilege escalation via unsanitized input (CVE-2024-10224)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

Affected: Alpaquita:23: perl-module-scandeps, Alpaquita:stream: perl-module-scandeps

Qualys discovered that if unsanitized input was used with the library Modules::ScanDeps, before version 1.36 a local attacker could possibly execute arbitrary shell commands by open()ing a "pesky pipe" (such as passing "commands|" as a filename) or by passing arbitrary strings to eval().

Affected: openEuler:22.03-LTS-SP3: perl-Module-ScanDeps, openEuler:20.03-LTS-SP4: perl-Module-ScanDeps, openEuler:22.03-LTS-SP1: perl-Module-ScanDeps, openEuler:24.03-LTS: perl-Module-ScanDeps, openEuler:22.03-LTS-SP4: perl-Module-ScanDeps

This module scans potential modules used by perl programs, and returns a hash reference; its keys are the module names as appears in %INC (e.g. Test/More.pm); the values are hash references. Security Fix(es): Qualys discovered that if unsanitized input was used with the library Modules::ScanDeps, before version 1.36 a local attacker could possibly execute arbitrary shell commands by open()ing a "pesky pipe" (such as passing "commands|" as a filename) or by passing arbitrary strings to eval().(CVE-2024-10224)

perl-Module-ScanDeps-1.370.0-1.1 on GA media

module-scandeps: local privilege escalation via unsanitized input

Affected: Ubuntu:Pro:16.04:LTS: libmodule-scandeps-perl, Ubuntu:Pro:18.04:LTS: libmodule-scandeps-perl, Ubuntu:Pro:20.04:LTS: libmodule-scandeps-perl, Ubuntu:22.04:LTS: libmodule-scandeps-perl, Ubuntu:24.04:LTS: libmodule-scandeps-perl

Qualys discovered that if unsanitized input was used with the library Modules::ScanDeps, before version 1.36 a local attacker could possibly execute arbitrary shell commands by open()ing a "pesky pipe" (such as passing "commands|" as a filename) or by passing arbitrary strings to eval().

Ein lokaler Angreifer kann eine Schwachstelle in Red Hat Enterprise Linux in in module-scandeps ausnutzen, um seine Privilegien zu erhöhen.