CVE catalog

CVE-2018-12015

perl: CVE-2018-12015

[CVE catalog]

Severity
Medium · CVSS 5.4CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
Published
Source
[NVD] · [CVE record]
EPSS
7.31% · Oct 25, 2026

In Perl through 5.26.2, the Archive::Tar module allows remote attackers to bypass a directory-traversal protection mechanism, and overwrite arbitrary files, via an archive file containing a symlink and a regular file with the same name.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianperlsid5.42.3-1fixed
Debianperlforky5.42.3-1fixed
Debianperltrixie5.40.1-6+deb13u1fixed
Debianperlbookworm5.36.0-7+deb12u3fixed
Debianperlbookworm-security5.36.0-7+deb12u4fixed
Alpineperl3.105.26.2-r1fixed
Alpineperl3.115.26.2-r1fixed
Alpineperl3.125.26.2-r1fixed
Alpineperl3.135.26.2-r1fixed
Alpineperl3.145.26.2-r1fixed
Alpineperl3.155.26.2-r1fixed
Alpineperl3.165.26.2-r1fixed
Alpineperl3.175.26.2-r1fixed
Alpineperl3.185.26.2-r1fixed
Alpineperl3.195.26.2-r1fixed
Alpineperl3.205.26.2-r1fixed
Alpineperl3.215.26.2-r1fixed
Alpineperl3.225.26.2-r1fixed
Alpineperl3.235.26.2-r1fixed
Alpineperl3.245.26.2-r1fixed
Alpineperl3.55.24.4-r1fixed
Alpineperl3.65.24.4-r1fixed
Alpineperl3.75.26.2-r1fixed
Alpineperl3.85.26.2-r1fixed
Alpineperl3.95.26.2-r1fixed
Ubuntuperl14.045.14.2-21build1vulnerable
Ubuntuperl14.045.18.1-4vulnerable
Ubuntuperl14.045.18.1-4build1vulnerable
Ubuntuperl14.045.18.1-5vulnerable
Ubuntuperl14.045.18.2-2vulnerable
Ubuntuperl14.045.18.2-2ubuntu1vulnerable
Ubuntuperl14.045.18.2-2ubuntu1.1vulnerable
Ubuntuperl14.045.18.2-2ubuntu1.3vulnerable
Ubuntuperl14.045.18.2-2ubuntu1.4vulnerable
Ubuntuperl14.045.18.2-2ubuntu1.6fixed
Ubuntuperl16.045.20.2-6vulnerable
Ubuntuperl16.045.22.1-3vulnerable
Ubuntuperl16.045.22.1-4vulnerable
Ubuntuperl16.045.22.1-5vulnerable
Ubuntuperl16.045.22.1-7vulnerable
Ubuntuperl16.045.22.1-8vulnerable
Ubuntuperl16.045.22.1-9vulnerable
Ubuntuperl16.045.22.1-9ubuntu0.2vulnerable
Ubuntuperl16.045.22.1-9ubuntu0.3vulnerable
Ubuntuperl16.045.22.1-9ubuntu0.5fixed
Ubuntuperl18.045.26.0-8ubuntu1vulnerable
Ubuntuperl18.045.26.1-2ubuntu1vulnerable
Ubuntuperl18.045.26.1-3vulnerable
Ubuntuperl18.045.26.1-4vulnerable
Ubuntuperl18.045.26.1-4build1vulnerable
Ubuntuperl18.045.26.1-5vulnerable
Ubuntuperl18.045.26.1-6vulnerable
Ubuntuperl18.045.26.1-6ubuntu0.1fixed
Ubuntuperl14.045.14.2-21build1vulnerable
Ubuntuperl14.045.18.1-4vulnerable
Ubuntuperl14.045.18.1-4build1vulnerable
Ubuntuperl14.045.18.1-5vulnerable
Ubuntuperl14.045.18.2-2vulnerable
Ubuntuperl14.045.18.2-2ubuntu1vulnerable
Ubuntuperl14.045.18.2-2ubuntu1.1vulnerable
Ubuntuperl14.045.18.2-2ubuntu1.3vulnerable
Ubuntuperl14.045.18.2-2ubuntu1.4vulnerable
Ubuntuperl14.045.18.2-2ubuntu1.6fixed
Ubuntuperl16.045.20.2-6vulnerable
Ubuntuperl16.045.22.1-3vulnerable
Ubuntuperl16.045.22.1-4vulnerable
Ubuntuperl16.045.22.1-5vulnerable
Ubuntuperl16.045.22.1-7vulnerable
Ubuntuperl16.045.22.1-8vulnerable
Ubuntuperl16.045.22.1-9vulnerable
Ubuntuperl16.045.22.1-9ubuntu0.2vulnerable
Ubuntuperl16.045.22.1-9ubuntu0.3vulnerable
Ubuntuperl16.045.22.1-9ubuntu0.5fixed
Ubuntuperl18.045.26.0-8ubuntu1vulnerable
Ubuntuperl18.045.26.1-2ubuntu1vulnerable
Ubuntuperl18.045.26.1-3vulnerable
Ubuntuperl18.045.26.1-4vulnerable
Ubuntuperl18.045.26.1-4build1vulnerable
Ubuntuperl18.045.26.1-5vulnerable
Ubuntuperl18.045.26.1-6vulnerable
Ubuntuperl18.045.26.1-6ubuntu0.1fixed
Suseperllinux enterprise server 12 sp2-bcl5.18.2-12.14.1fixed
Suseperllinux enterprise module for basesystem 155.26.1-7.3.1fixed
Suseperllinux enterprise module for development tools 155.26.1-7.3.1fixed
Suseperlopenstack cloud 75.18.2-12.14.1fixed
Suseperllinux enterprise desktop 12 sp35.18.2-12.14.1fixed
Suseperllinux enterprise server for sap applications 12 sp15.18.2-12.14.1fixed
Suseperllinux enterprise server for sap applications 12 sp25.18.2-12.14.1fixed
Suseperllinux enterprise server 12-ltss5.18.2-12.14.1fixed
Suseperllinux enterprise server 12 sp1-ltss5.18.2-12.14.1fixed
Suseperllinux enterprise server 12 sp2-ltss5.18.2-12.14.1fixed
Suseperllinux enterprise server 12 sp35.18.2-12.14.1fixed
Suseperllinux enterprise server for sap applications 12 sp35.18.2-12.14.1fixed
Suseperlenterprise storage 45.18.2-12.14.1fixed
Suseperllinux enterprise software development kit 11 sp45.10.0-64.81.13.1fixed
Suseperllinux enterprise point of sale 11 sp35.10.0-64.81.13.1fixed
Suseperllinux enterprise server 11 sp3-ltss5.10.0-64.81.13.1fixed
Suseperllinux enterprise server 11 sp3-teradata5.10.0-64.81.13.1fixed
Suseperllinux enterprise server 11 sp45.10.0-64.81.13.1fixed
Suseperllinux enterprise server for sap applications 11 sp45.10.0-64.81.13.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianperlsourcesid5.26.2-6not yet assignedNot reported[900834]
Debianperlsourceforky5.26.2-6not yet assignedNot reported[900834]
Debianperlsourcetrixie5.26.2-6not yet assignedNot reported[900834]
Debianperlsourcebookworm5.26.2-6not yet assignedNot reported[900834]
Alpineperlapk3.105.26.2-r1Not reportedALPINE-CVE-2018-12015Not reported
Alpineperlapk3.115.26.2-r1Not reportedALPINE-CVE-2018-12015Not reported
Alpineperlapk3.125.26.2-r1Not reportedALPINE-CVE-2018-12015Not reported
Alpineperlapk3.135.26.2-r1Not reportedALPINE-CVE-2018-12015Not reported
Alpineperlapk3.145.26.2-r1Not reportedALPINE-CVE-2018-12015Not reported
Alpineperlapk3.155.26.2-r1Not reportedALPINE-CVE-2018-12015Not reported
Alpineperlapk3.165.26.2-r1Not reportedALPINE-CVE-2018-12015Not reported
Alpineperlapk3.175.26.2-r1Not reportedALPINE-CVE-2018-12015Not reported
Alpineperlapk3.185.26.2-r1Not reportedALPINE-CVE-2018-12015Not reported
Alpineperlapk3.195.26.2-r1Not reportedALPINE-CVE-2018-12015Not reported
Alpineperlapk3.205.26.2-r1Not reportedALPINE-CVE-2018-12015Not reported
Alpineperlapk3.215.26.2-r1Not reportedALPINE-CVE-2018-12015Not reported
Alpineperlapk3.225.26.2-r1Not reportedALPINE-CVE-2018-12015Not reported
Alpineperlapk3.235.26.2-r1Not reportedALPINE-CVE-2018-12015Not reported
Alpineperlapk3.245.26.2-r1Not reportedALPINE-CVE-2018-12015Not reported
Alpineperlapk3.55.24.4-r1Not reportedALPINE-CVE-2018-12015Not reported
Alpineperlapk3.65.24.4-r1Not reportedALPINE-CVE-2018-12015Not reported
Alpineperlapk3.75.26.2-r1Not reportedALPINE-CVE-2018-12015Not reported
Alpineperlapk3.85.26.2-r1Not reportedALPINE-CVE-2018-12015Not reported
Alpineperlapk3.95.26.2-r1Not reportedALPINE-CVE-2018-12015Not reported
Ubuntuperldeb14.045.18.2-2ubuntu1.6Not reportedUBUNTU-CVE-2018-12015Not reported
Ubuntuperldeb16.045.22.1-9ubuntu0.5Not reportedUBUNTU-CVE-2018-12015Not reported
Ubuntuperldeb18.045.26.1-6ubuntu0.1Not reportedUBUNTU-CVE-2018-12015Not reported
Ubuntuperldeb14.045.18.2-2ubuntu1.6Not reportedUSN-3684-1Not reported
Ubuntuperldeb16.045.22.1-9ubuntu0.5Not reportedUSN-3684-1Not reported
Ubuntuperldeb18.045.26.1-6ubuntu0.1Not reportedUSN-3684-1Not reported
Suseperlrpmlinux enterprise server 12 sp2-bcl5.18.2-12.14.1Not reportedSUSE-SU-2018:1972-2Not reported
Suseperlrpmlinux enterprise module for basesystem 155.26.1-7.3.1Not reportedSUSE-SU-2018:1977-1Not reported
Suseperlrpmlinux enterprise module for development tools 155.26.1-7.3.1Not reportedSUSE-SU-2018:1977-1Not reported
Suseperlrpmopenstack cloud 75.18.2-12.14.1Not reportedSUSE-SU-2018:1972-1Not reported
Suseperlrpmlinux enterprise desktop 12 sp35.18.2-12.14.1Not reportedSUSE-SU-2018:1972-1Not reported
Suseperlrpmlinux enterprise server for sap applications 12 sp15.18.2-12.14.1Not reportedSUSE-SU-2018:1972-1Not reported
Suseperlrpmlinux enterprise server for sap applications 12 sp25.18.2-12.14.1Not reportedSUSE-SU-2018:1972-1Not reported
Suseperlrpmlinux enterprise server 12-ltss5.18.2-12.14.1Not reportedSUSE-SU-2018:1972-1Not reported
Suseperlrpmlinux enterprise server 12 sp1-ltss5.18.2-12.14.1Not reportedSUSE-SU-2018:1972-1Not reported
Suseperlrpmlinux enterprise server 12 sp2-ltss5.18.2-12.14.1Not reportedSUSE-SU-2018:1972-1Not reported
Suseperlrpmlinux enterprise server 12 sp35.18.2-12.14.1Not reportedSUSE-SU-2018:1972-1Not reported
Suseperlrpmlinux enterprise server for sap applications 12 sp35.18.2-12.14.1Not reportedSUSE-SU-2018:1972-1Not reported
Suseperlrpmenterprise storage 45.18.2-12.14.1Not reportedSUSE-SU-2018:1972-1Not reported
Suseperlrpmlinux enterprise software development kit 11 sp45.10.0-64.81.13.1Not reportedSUSE-SU-2018:1992-1Not reported
Suseperlrpmlinux enterprise point of sale 11 sp35.10.0-64.81.13.1Not reportedSUSE-SU-2018:1992-1Not reported
Suseperlrpmlinux enterprise server 11 sp3-ltss5.10.0-64.81.13.1Not reportedSUSE-SU-2018:1992-1Not reported
Suseperlrpmlinux enterprise server 11 sp3-teradata5.10.0-64.81.13.1Not reportedSUSE-SU-2018:1992-1Not reported
Suseperlrpmlinux enterprise server 11 sp45.10.0-64.81.13.1Not reportedSUSE-SU-2018:1992-1Not reported
Suseperlrpmlinux enterprise server for sap applications 11 sp45.10.0-64.81.13.1Not reportedSUSE-SU-2018:1992-1Not reported

[Debian bug #900834]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • Source package: [perl]

    Details (4)
    • 5.36.0-7+deb12u3 · amd64 · bookworm

      Fixed · Fixed: 5.26.2-6

      dsa · perl · debian · bookworm; dsa · perl · debian · 12

    • 5.36.0-7+deb12u3 · arm64 · bookworm

      Fixed · Fixed: 5.26.2-6

      dsa · perl · debian · bookworm; dsa · perl · debian · 12

    • 5.36.0-7+deb12u2 · amd64 · bookworm-security

      Fixed · Fixed: 5.26.2-6

      dsa · perl · debian · bookworm; dsa · perl · debian · 12

    • 5.36.0-7+deb12u2 · arm64 · bookworm-security

      Fixed · Fixed: 5.26.2-6

      dsa · perl · debian · bookworm; dsa · perl · debian · 12

  • Source package: [perl]

    Details (4)
    • 5.36.0-7+deb12u3 · amd64 · bookworm

      Fixed · Fixed: 5.26.2-6

      dsa · perl · debian · bookworm; dsa · perl · debian · 12

    • 5.36.0-7+deb12u3 · arm64 · bookworm

      Fixed · Fixed: 5.26.2-6

      dsa · perl · debian · bookworm; dsa · perl · debian · 12

    • 5.36.0-7+deb12u2 · amd64 · bookworm-security

      Fixed · Fixed: 5.26.2-6

      dsa · perl · debian · bookworm; dsa · perl · debian · 12

    • 5.36.0-7+deb12u2 · arm64 · bookworm-security

      Fixed · Fixed: 5.26.2-6

      dsa · perl · debian · bookworm; dsa · perl · debian · 12

  • [perl]Fixed
    Details (4)
    • 5.36.0-7+deb12u3 · amd64 · bookworm

      Fixed · Fixed: 5.26.2-6

      dsa · perl · debian · bookworm; dsa · perl · debian · 12

    • 5.36.0-7+deb12u3 · arm64 · bookworm

      Fixed · Fixed: 5.26.2-6

      dsa · perl · debian · bookworm; dsa · perl · debian · 12

    • 5.36.0-7+deb12u2 · amd64 · bookworm-security

      Fixed · Fixed: 5.26.2-6

      dsa · perl · debian · bookworm; dsa · perl · debian · 12

    • 5.36.0-7+deb12u2 · arm64 · bookworm-security

      Fixed · Fixed: 5.26.2-6

      dsa · perl · debian · bookworm; dsa · perl · debian · 12

  • [perl-base]Fixed

    Source package: [perl]

    Details (4)
    • 5.36.0-7+deb12u3 · amd64 · bookworm

      Fixed · Fixed: 5.26.2-6

      dsa · perl · debian · bookworm; dsa · perl · debian · 12

    • 5.36.0-7+deb12u3 · arm64 · bookworm

      Fixed · Fixed: 5.26.2-6

      dsa · perl · debian · bookworm; dsa · perl · debian · 12

    • 5.36.0-7+deb12u2 · amd64 · bookworm-security

      Fixed · Fixed: 5.26.2-6

      dsa · perl · debian · bookworm; dsa · perl · debian · 12

    • 5.36.0-7+deb12u2 · arm64 · bookworm-security

      Fixed · Fixed: 5.26.2-6

      dsa · perl · debian · bookworm; dsa · perl · debian · 12

  • [perl-debug]Fixed

    Source package: [perl]

    Details (4)
    • 5.36.0-7+deb12u3 · amd64 · bookworm

      Fixed · Fixed: 5.26.2-6

      dsa · perl · debian · bookworm; dsa · perl · debian · 12

    • 5.36.0-7+deb12u3 · arm64 · bookworm

      Fixed · Fixed: 5.26.2-6

      dsa · perl · debian · bookworm; dsa · perl · debian · 12

    • 5.36.0-7+deb12u2 · amd64 · bookworm-security

      Fixed · Fixed: 5.26.2-6

      dsa · perl · debian · bookworm; dsa · perl · debian · 12

    • 5.36.0-7+deb12u2 · arm64 · bookworm-security

      Fixed · Fixed: 5.26.2-6

      dsa · perl · debian · bookworm; dsa · perl · debian · 12

  • [perl-doc]Fixed

    Source package: [perl]

    Details (4)
    • 5.36.0-7+deb12u3 · all · bookworm

      Fixed · Fixed: 5.26.2-6

      dsa · perl · debian · bookworm; dsa · perl · debian · 12

    • 5.36.0-7+deb12u3 · all · bookworm

      Fixed · Fixed: 5.26.2-6

      dsa · perl · debian · bookworm; dsa · perl · debian · 12

    • 5.36.0-7+deb12u2 · all · bookworm-security

      Fixed · Fixed: 5.26.2-6

      dsa · perl · debian · bookworm; dsa · perl · debian · 12

    • 5.36.0-7+deb12u2 · all · bookworm-security

      Fixed · Fixed: 5.26.2-6

      dsa · perl · debian · bookworm; dsa · perl · debian · 12

  • Source package: [perl]

    Details (4)
    • 5.36.0-7+deb12u3 · all · bookworm

      Fixed · Fixed: 5.26.2-6

      dsa · perl · debian · bookworm; dsa · perl · debian · 12

    • 5.36.0-7+deb12u3 · all · bookworm

      Fixed · Fixed: 5.26.2-6

      dsa · perl · debian · bookworm; dsa · perl · debian · 12

    • 5.36.0-7+deb12u2 · all · bookworm-security

      Fixed · Fixed: 5.26.2-6

      dsa · perl · debian · bookworm; dsa · perl · debian · 12

    • 5.36.0-7+deb12u2 · all · bookworm-security

      Fixed · Fixed: 5.26.2-6

      dsa · perl · debian · bookworm; dsa · perl · debian · 12

[Debian 13 (Trixie)]

  • Source package: [perl]

    Details (2)
    • 5.40.1-6 · amd64 · trixie

      Fixed · Fixed: 5.26.2-6

      dsa · perl · debian · 13

    • 5.40.1-6 · arm64 · trixie

      Fixed · Fixed: 5.26.2-6

      dsa · perl · debian · 13

  • Source package: [perl]

    Details (2)
    • 5.40.1-6 · amd64 · trixie

      Fixed · Fixed: 5.26.2-6

      dsa · perl · debian · 13

    • 5.40.1-6 · arm64 · trixie

      Fixed · Fixed: 5.26.2-6

      dsa · perl · debian · 13

  • [perl]Fixed
    Details (2)
    • 5.40.1-6 · amd64 · trixie

      Fixed · Fixed: 5.26.2-6

      dsa · perl · debian · 13

    • 5.40.1-6 · arm64 · trixie

      Fixed · Fixed: 5.26.2-6

      dsa · perl · debian · 13

  • [perl-base]Fixed

    Source package: [perl]

    Details (2)
    • 5.40.1-6 · amd64 · trixie

      Fixed · Fixed: 5.26.2-6

      dsa · perl · debian · 13

    • 5.40.1-6 · arm64 · trixie

      Fixed · Fixed: 5.26.2-6

      dsa · perl · debian · 13

  • [perl-debug]Fixed

    Source package: [perl]

    Details (2)
    • 5.40.1-6 · amd64 · trixie

      Fixed · Fixed: 5.26.2-6

      dsa · perl · debian · 13

    • 5.40.1-6 · arm64 · trixie

      Fixed · Fixed: 5.26.2-6

      dsa · perl · debian · 13

  • [perl-doc]Fixed

    Source package: [perl]

    Details (2)
    • 5.40.1-6 · all · trixie

      Fixed · Fixed: 5.26.2-6

      dsa · perl · debian · 13

    • 5.40.1-6 · all · trixie

      Fixed · Fixed: 5.26.2-6

      dsa · perl · debian · 13

  • Source package: [perl]

    Details (2)
    • 5.40.1-6 · all · trixie

      Fixed · Fixed: 5.26.2-6

      dsa · perl · debian · 13

    • 5.40.1-6 · all · trixie

      Fixed · Fixed: 5.26.2-6

      dsa · perl · debian · 13

Observed:

References