CVE-2026-42496
- ULN >
- Oracle Linux CVE repository >
- CVE-2026-42496
CVE Details
| Release Date: | 2026-05-26 | |
| Impact: | Important | What is this? |
Description
Archive::Tar versions before 3.08 for Perl extract symlinks with attacker controlled targets outside the extraction directory. _make_special_file() passes the tar header's linkname to symlink() without validating it against absolute paths or .. segments. The secure-extract mode check that guards regular file extraction does not cover the symlink target. A subsequent open through the extracted name reads or writes the attacker chosen path.
See more information about CVE-2026-42496 from MITRE CVE dictionary and NIST NVD
NOTE: The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 metrics
| Base Score: | 8.2 |
| Vector String: | CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H |
| Version: | 3.1 |
| Attack Vector: | Local |
| Attack Complexity: | Low |
| Privileges Required: | Low |
| User Interaction: | Required |
| Scope: | Changed |
| Confidentiality Impact: | High |
| Integrity Impact: | High |
| Availability Impact: | High |
Errata information
| Platform | Errata | Release Date |
| Oracle Linux version 10 (perl-Archive-Tar) | ELSA-2026-30857 | 2026-07-16 |
| Oracle Linux version 8 (perl) | ELSA-2026-30851 | 2026-06-30 |
| Oracle Linux version 8 (perl-Algorithm-Diff) | ELSA-2026-30851 | 2026-06-30 |
| Oracle Linux version 8 (perl-Archive-Tar) | ELSA-2026-30851 | 2026-06-30 |
| Oracle Linux version 8 (perl-Archive-Tar) | ELSA-2026-30852 | 2026-06-29 |
| Oracle Linux version 8 (perl-Archive-Zip) | ELSA-2026-30851 | 2026-06-30 |
| Oracle Linux version 8 (perl-CPAN) | ELSA-2026-30851 | 2026-06-30 |
| Oracle Linux version 8 (perl-CPAN-DistnameInfo) | ELSA-2026-30851 | 2026-06-30 |
| Oracle Linux version 8 (perl-CPAN-Meta) | ELSA-2026-30851 | 2026-06-30 |
| Oracle Linux version 8 (perl-CPAN-Meta-Requirements) | ELSA-2026-30851 | 2026-06-30 |
| Oracle Linux version 8 (perl-CPAN-Meta-YAML) | ELSA-2026-30851 | 2026-06-30 |
| Oracle Linux version 8 (perl-Carp) | ELSA-2026-30851 | 2026-06-30 |
| Oracle Linux version 8 (perl-Compress-Bzip2) | ELSA-2026-30851 | 2026-06-30 |
| Oracle Linux version 8 (perl-Compress-Raw-Bzip2) | ELSA-2026-30851 | 2026-06-30 |
| Oracle Linux version 8 (perl-Compress-Raw-Lzma) | ELSA-2026-30851 | 2026-06-30 |
| Oracle Linux version 8 (perl-Compress-Raw-Zlib) | ELSA-2026-30851 | 2026-06-30 |
| Oracle Linux version 8 (perl-Config-Perl-V) | ELSA-2026-30851 | 2026-06-30 |
| Oracle Linux version 8 (perl-DB_File) | ELSA-2026-30851 | 2026-06-30 |
| Oracle Linux version 8 (perl-Data-Dumper) | ELSA-2026-30851 | 2026-06-30 |
| Oracle Linux version 8 (perl-Data-OptList) | ELSA-2026-30851 | 2026-06-30 |
| Oracle Linux version 8 (perl-Data-Section) | ELSA-2026-30851 | 2026-06-30 |
| Oracle Linux version 8 (perl-Devel-PPPort) | ELSA-2026-30851 | 2026-06-30 |
| Oracle Linux version 8 (perl-Devel-Size) | ELSA-2026-30851 | 2026-06-30 |
| Oracle Linux version 8 (perl-Digest) | ELSA-2026-30851 | 2026-06-30 |
| Oracle Linux version 8 (perl-Digest-MD5) | ELSA-2026-30851 | 2026-06-30 |
| Oracle Linux version 8 (perl-Digest-SHA) | ELSA-2026-30851 | 2026-06-30 |
| Oracle Linux version 8 (perl-Encode) | ELSA-2026-30851 | 2026-06-30 |
| Oracle Linux version 8 (perl-Encode-Locale) | ELSA-2026-30851 | 2026-06-30 |
| Oracle Linux version 8 (perl-Env) | ELSA-2026-30851 | 2026-06-30 |
| Oracle Linux version 8 (perl-Exporter) | ELSA-2026-30851 | 2026-06-30 |
| Oracle Linux version 8 (perl-ExtUtils-CBuilder) | ELSA-2026-30851 | 2026-06-30 |
| Oracle Linux version 8 (perl-ExtUtils-Install) | ELSA-2026-30851 | 2026-06-30 |
| Oracle Linux version 8 (perl-ExtUtils-MakeMaker) | ELSA-2026-30851 | 2026-06-30 |
| Oracle Linux version 8 (perl-ExtUtils-Manifest) | ELSA-2026-30851 | 2026-06-30 |
| Oracle Linux version 8 (perl-ExtUtils-ParseXS) | ELSA-2026-30851 | 2026-06-30 |
| Oracle Linux version 8 (perl-Fedora-VSP) | ELSA-2026-30851 | 2026-06-30 |
| Oracle Linux version 8 (perl-File-Fetch) | ELSA-2026-30851 | 2026-06-30 |
| Oracle Linux version 8 (perl-File-HomeDir) | ELSA-2026-30851 | 2026-06-30 |
| Oracle Linux version 8 (perl-File-Path) | ELSA-2026-30851 | 2026-06-30 |
| Oracle Linux version 8 (perl-File-Temp) | ELSA-2026-30851 | 2026-06-30 |
| Oracle Linux version 8 (perl-File-Which) | ELSA-2026-30851 | 2026-06-30 |
| Oracle Linux version 8 (perl-Filter) | ELSA-2026-30851 | 2026-06-30 |
| Oracle Linux version 8 (perl-Filter-Simple) | ELSA-2026-30851 | 2026-06-30 |
| Oracle Linux version 8 (perl-Getopt-Long) | ELSA-2026-30851 | 2026-06-30 |
| Oracle Linux version 8 (perl-HTTP-Tiny) | ELSA-2026-30851 | 2026-06-30 |
| Oracle Linux version 8 (perl-IO-Compress) | ELSA-2026-30851 | 2026-06-30 |
| Oracle Linux version 8 (perl-IO-Compress-Lzma) | ELSA-2026-30851 | 2026-06-30 |
| Oracle Linux version 8 (perl-IO-Socket-IP) | ELSA-2026-30851 | 2026-06-30 |
| Oracle Linux version 8 (perl-IPC-Cmd) | ELSA-2026-30851 | 2026-06-30 |
| Oracle Linux version 8 (perl-IPC-SysV) | ELSA-2026-30851 | 2026-06-30 |
| Oracle Linux version 8 (perl-IPC-System-Simple) | ELSA-2026-30851 | 2026-06-30 |
| Oracle Linux version 8 (perl-Importer) | ELSA-2026-30851 | 2026-06-30 |
| Oracle Linux version 8 (perl-JSON-PP) | ELSA-2026-30851 | 2026-06-30 |
| Oracle Linux version 8 (perl-Locale-Maketext) | ELSA-2026-30851 | 2026-06-30 |
| Oracle Linux version 8 (perl-MIME-Base64) | ELSA-2026-30851 | 2026-06-30 |
| Oracle Linux version 8 (perl-MRO-Compat) | ELSA-2026-30851 | 2026-06-30 |
| Oracle Linux version 8 (perl-Math-BigInt) | ELSA-2026-30851 | 2026-06-30 |
| Oracle Linux version 8 (perl-Math-BigInt-FastCalc) | ELSA-2026-30851 | 2026-06-30 |
| Oracle Linux version 8 (perl-Math-BigRat) | ELSA-2026-30851 | 2026-06-30 |
| Oracle Linux version 8 (perl-Module-Build) | ELSA-2026-30851 | 2026-06-30 |
| Oracle Linux version 8 (perl-Module-CoreList) | ELSA-2026-30851 | 2026-06-30 |
| Oracle Linux version 8 (perl-Module-Load) | ELSA-2026-30851 | 2026-06-30 |
| Oracle Linux version 8 (perl-Module-Load-Conditional) | ELSA-2026-30851 | 2026-06-30 |
| Oracle Linux version 8 (perl-Module-Metadata) | ELSA-2026-30851 | 2026-06-30 |
| Oracle Linux version 8 (perl-Object-HashBase) | ELSA-2026-30851 | 2026-06-30 |
| Oracle Linux version 8 (perl-Package-Generator) | ELSA-2026-30851 | 2026-06-30 |
| Oracle Linux version 8 (perl-Params-Check) | ELSA-2026-30851 | 2026-06-30 |
| Oracle Linux version 8 (perl-Params-Util) | ELSA-2026-30851 | 2026-06-30 |
| Oracle Linux version 8 (perl-PathTools) | ELSA-2026-30851 | 2026-06-30 |
| Oracle Linux version 8 (perl-Perl-OSType) | ELSA-2026-30851 | 2026-06-30 |
| Oracle Linux version 8 (perl-PerlIO-via-QuotedPrint) | ELSA-2026-30851 | 2026-06-30 |
| Oracle Linux version 8 (perl-Pod-Checker) | ELSA-2026-30851 | 2026-06-30 |
| Oracle Linux version 8 (perl-Pod-Escapes) | ELSA-2026-30851 | 2026-06-30 |
| Oracle Linux version 8 (perl-Pod-Parser) | ELSA-2026-30851 | 2026-06-30 |
| Oracle Linux version 8 (perl-Pod-Perldoc) | ELSA-2026-30851 | 2026-06-30 |
| Oracle Linux version 8 (perl-Pod-Simple) | ELSA-2026-30851 | 2026-06-30 |
| Oracle Linux version 8 (perl-Pod-Usage) | ELSA-2026-30851 | 2026-06-30 |
| Oracle Linux version 8 (perl-Scalar-List-Utils) | ELSA-2026-30851 | 2026-06-30 |
| Oracle Linux version 8 (perl-Socket) | ELSA-2026-30851 | 2026-06-30 |
| Oracle Linux version 8 (perl-Software-License) | ELSA-2026-30851 | 2026-06-30 |
| Oracle Linux version 8 (perl-Storable) | ELSA-2026-30851 | 2026-06-30 |
| Oracle Linux version 8 (perl-Sub-Exporter) | ELSA-2026-30851 | 2026-06-30 |
| Oracle Linux version 8 (perl-Sub-Install) | ELSA-2026-30851 | 2026-06-30 |
| Oracle Linux version 8 (perl-Sys-Syslog) | ELSA-2026-30851 | 2026-06-30 |
| Oracle Linux version 8 (perl-Term-ANSIColor) | ELSA-2026-30851 | 2026-06-30 |
| Oracle Linux version 8 (perl-Term-Cap) | ELSA-2026-30851 | 2026-06-30 |
| Oracle Linux version 8 (perl-Term-Table) | ELSA-2026-30851 | 2026-06-30 |
| Oracle Linux version 8 (perl-Test-Harness) | ELSA-2026-30851 | 2026-06-30 |
| Oracle Linux version 8 (perl-Test-Simple) | ELSA-2026-30851 | 2026-06-30 |
| Oracle Linux version 8 (perl-Text-Balanced) | ELSA-2026-30851 | 2026-06-30 |
| Oracle Linux version 8 (perl-Text-Diff) | ELSA-2026-30851 | 2026-06-30 |
| Oracle Linux version 8 (perl-Text-Glob) | ELSA-2026-30851 | 2026-06-30 |
| Oracle Linux version 8 (perl-Text-ParseWords) | ELSA-2026-30851 | 2026-06-30 |
| Oracle Linux version 8 (perl-Text-Tabs+Wrap) | ELSA-2026-30851 | 2026-06-30 |
| Oracle Linux version 8 (perl-Text-Template) | ELSA-2026-30851 | 2026-06-30 |
| Oracle Linux version 8 (perl-Thread-Queue) | ELSA-2026-30851 | 2026-06-30 |
| Oracle Linux version 8 (perl-Time-HiRes) | ELSA-2026-30851 | 2026-06-30 |
| Oracle Linux version 8 (perl-Time-Local) | ELSA-2026-30851 | 2026-06-30 |
| Oracle Linux version 8 (perl-URI) | ELSA-2026-30851 | 2026-06-30 |
| Oracle Linux version 8 (perl-Unicode-Collate) | ELSA-2026-30851 | 2026-06-30 |
| Oracle Linux version 8 (perl-Unicode-Normalize) | ELSA-2026-30851 | 2026-06-30 |
| Oracle Linux version 8 (perl-autodie) | ELSA-2026-30851 | 2026-06-30 |
| Oracle Linux version 8 (perl-bignum) | ELSA-2026-30851 | 2026-06-30 |
| Oracle Linux version 8 (perl-constant) | ELSA-2026-30851 | 2026-06-30 |
| Oracle Linux version 8 (perl-experimental) | ELSA-2026-30851 | 2026-06-30 |
| Oracle Linux version 8 (perl-generators) | ELSA-2026-30851 | 2026-06-30 |
| Oracle Linux version 8 (perl-inc-latest) | ELSA-2026-30851 | 2026-06-30 |
| Oracle Linux version 8 (perl-libnet) | ELSA-2026-30851 | 2026-06-30 |
| Oracle Linux version 8 (perl-local-lib) | ELSA-2026-30851 | 2026-06-30 |
| Oracle Linux version 8 (perl-parent) | ELSA-2026-30851 | 2026-06-30 |
| Oracle Linux version 8 (perl-perlfaq) | ELSA-2026-30851 | 2026-06-30 |
| Oracle Linux version 8 (perl-podlators) | ELSA-2026-30851 | 2026-06-30 |
| Oracle Linux version 8 (perl-threads) | ELSA-2026-30851 | 2026-06-30 |
| Oracle Linux version 8 (perl-threads-shared) | ELSA-2026-30851 | 2026-06-30 |
| Oracle Linux version 8 (perl-version) | ELSA-2026-30851 | 2026-06-30 |
| Oracle Linux version 9 (perl-Archive-Tar) | ELSA-2026-30856 | 2026-06-29 |
This page is generated automatically and has not been checked for errors or omissions. For clarification or corrections:
- Oracle customers - enter a support request
- Vulnerability scanning tools vendors and project maintainers - follow the standard ISV process
