CVE catalog

CVE-2017-16248

libcatalyst-plugin-static-simple-perl: CVE-2017-16248

[CVE catalog]

Severity
Medium
Published
Source
[NVD] · [CVE record]
EPSS
2.43% · Oct 25, 2026

The Catalyst-Plugin-Static-Simple module before 0.34 for Perl allows remote attackers to read arbitrary files if there is a '.' character anywhere in the pathname, which differs from the intended policy of allowing access only when the filename itself has a '.' character.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianlibcatalyst-plugin-static-simple-perlsid0.38-1fixed
Debianlibcatalyst-plugin-static-simple-perlforky0.38-1fixed
Debianlibcatalyst-plugin-static-simple-perltrixie0.37-1fixed
Debianlibcatalyst-plugin-static-simple-perlbookworm0.37-1fixed
Ubuntulibcatalyst-plugin-static-simple-perl16.040.33-1vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianlibcatalyst-plugin-static-simple-perlsourcesid0.34-1not yet assignedNot reported[880458]
Debianlibcatalyst-plugin-static-simple-perlsourceforky0.34-1not yet assignedNot reported[880458]
Debianlibcatalyst-plugin-static-simple-perlsourcetrixie0.34-1not yet assignedNot reported[880458]
Debianlibcatalyst-plugin-static-simple-perlsourcebookworm0.34-1not yet assignedNot reported[880458]

[Debian bug #880458]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [libcatalyst-plugin-static-simple-perl]Fixed
    Details (2)

    • 0.37-1 · all · bookworm

      Fixed · Fixed: 0.34-1

      dsa · libcatalyst-plugin-static-simple-perl · debian · bookworm; dsa · libcatalyst-plugin-static-simple-perl · debian · 12

    • 0.37-1 · all · bookworm

      Fixed · Fixed: 0.34-1

      dsa · libcatalyst-plugin-static-simple-perl · debian · bookworm; dsa · libcatalyst-plugin-static-simple-perl · debian · 12

[Debian 13 (Trixie)]

  • [libcatalyst-plugin-static-simple-perl]Fixed
    Details (2)

    • 0.37-1 · all · trixie

      Fixed · Fixed: 0.34-1

      dsa · libcatalyst-plugin-static-simple-perl · debian · 13

    • 0.37-1 · all · trixie

      Fixed · Fixed: 0.34-1

      dsa · libcatalyst-plugin-static-simple-perl · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database]