CVE-2026-65062

{"id": "CVE-2026-65062", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-65062", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-23T12:49:13.724053Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 3.8, "attackVector": "LOCAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.0}]}, "affected": [{"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "affectedData": [{"repo": "https://github.com/vividsnow/perl5-data-sortedset-shared", "vendor": "EGOR", "product": "Data::SortedSet::Shared", "versions": [{"status": "affected", "version": "0", "lessThan": "0.03", "versionType": "custom"}], "packageName": "Data-SortedSet-Shared", "programFiles": ["sortedset.h"], "collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected"}]}], "published": "2026-07-21T20:17:05.190", "references": [{"url": "https://metacpan.org/release/EGOR/Data-SortedSet-Shared-0.03/changes", "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}, {"url": "https://metacpan.org/release/EGOR/Data-SortedSet-Shared-0.03/diff/EGOR/Data-SortedSet-Shared-0.02#sortedset.h", "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "description": [{"lang": "en", "value": "CWE-59"}, {"lang": "en", "value": "CWE-732"}]}], "descriptions": [{"lang": "en", "value": "Data::SortedSet::Shared versions before 0.03 for Perl create a world-readable mmap backing file and open it without O_EXCL or O_NOFOLLOW.\n\nThe segment is created in sortedset.h with open(path, O_RDWR|O_CREAT, 0666). The mode is 0666, so under the default umask 022 the file is created mode 0644 (world-readable). O_NOFOLLOW is absent, so a symlink planted at the path is followed, and O_EXCL is absent, so the open silently uses a pre-planted file instead of failing.\n\nA \"Shared\" segment naturally lives in a shared directory such as /tmp or /dev/shm, where any local user can read the IPC payloads stored in the world-readable segment, and a pre-planted file or symlink at the path lets a local attacker win a pre-creation race or redirect the open."}, {"lang": "es", "value": "Las versiones de Data::SortedSet::Shared anteriores a la 0.03 para Perl crean un archivo de respaldo mmap legible por todos y lo abren sin O_EXCL ni O_NOFOLLOW.\n\nEl segmento se crea en sortedset.h con open(path, O_RDWR|O_CREAT, 0666). El modo es 0666, por lo que bajo la umask predeterminada 022 el archivo se crea con el modo 0644 (legible por todos). O_NOFOLLOW est\u00e1 ausente, por lo que se sigue un enlace simb\u00f3lico plantado en la ruta, y O_EXCL est\u00e1 ausente, por lo que la apertura utiliza silenciosamente un archivo pre-plantado en lugar de fallar.\n\nUn segmento \u2019Shared\u2019 reside naturalmente en un directorio compartido como /tmp o /dev/shm, donde cualquier usuario local puede leer las cargas \u00fatiles IPC almacenadas en el segmento legible por todos, y un archivo pre-plantado o enlace simb\u00f3lico en la ruta permite a un atacante local ganar una carrera de pre-creaci\u00f3n o redirigir la apertura."}], "lastModified": "2026-10-24T19:10:00.127", "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}