CVE-2017-0374

lib/Config/Model.pm in Config-Model (aka libconfig-model-perl) before 2.102 allows local users to gain privileges via a crafted model in the current working directory, related to use of . with the INC array.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
7.8 HIGH
LOCAL
LOW
LOW
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
debianCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 11%
VendorProductVersion
config-model_projectconfig-model
𝑥
≤ 2.101
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
libconfig-model-perl
bullseye
2.141-1
fixed
jessie
no-dsa
wheezy
no-dsa
bookworm
2.152-1
fixed
sid
2.154-1
fixed
trixie
2.154-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
libconfig-model-perl
noble
not-affected
mantic
not-affected
lunar
not-affected
kinetic
not-affected
jammy
not-affected
impish
not-affected
hirsute
not-affected
groovy
not-affected
focal
not-affected
eoan
not-affected
disco
not-affected
cosmic
not-affected
bionic
not-affected
artful
not-affected
zesty
ignored
yakkety
ignored
xenial
needed
trusty
dne
References
http://cpansearch.perl.org/src/DDUMONT/Config-Model-2.102/Changes
https://anonscm.debian.org/cgit/pkg-perl/packages/libconfig-model-perl.git/commit/?h=stretch&id=0de8471e5a8958ad37446dfcd0362a269e3ec573
https://security-tracker.debian.org/tracker/CVE-2017-0374
http://cpansearch.perl.org/src/DDUMONT/Config-Model-2.102/Changes
https://anonscm.debian.org/cgit/pkg-perl/packages/libconfig-model-perl.git/commit/?h=stretch&id=0de8471e5a8958ad37446dfcd0362a269e3ec573
https://security-tracker.debian.org/tracker/CVE-2017-0374