Read the docs
TI-2002-01257 Aliases CVE-2002-1323GHSA-qmvp-2m2m-rm8h

Safe.pm 2.0.7 and earlier, when used in Perl 5.8.0 and earlier, may allow attackers to…

Priority LOW 22Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Partial · Partial · Partial
Fix status
Fixed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA and Red Hat.

Summary

Safe.pm 2.0.7 and earlier, when used in Perl 5.8.0 and earlier, may allow attackers to break out of safe compartments in (1) Safe::reval or (2) Safe::rdo using a redefined @_ variable, which is not reset between successive calls.

Why it matters now

EPSS 0.00462 40th percentileScored 2026-11-07
Fix Fixed Red Hat: 2 advisories

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 48

CPEVersionsRoleVendor
cpe:2.3:a:safe.pm:safe.pm:2.0_6:*:*:*:*:*:*:*2.0_6VulnerableSafe.pm
cpe:2.3:a:safe.pm:safe.pm:2.0_7:*:*:*:*:*:*:*2.0_7VulnerableSafe.pm
cpe:2.3:a:sun:linux:5.0.7:*:*:*:*:*:*:*5.0.7VulnerableSun
cpe:2.3:o:sgi:irix:6.5:*:*:*:*:*:*:*6.5VulnerableSgi
cpe:2.3:o:sgi:irix:6.5.1:*:*:*:*:*:*:*6.5.1VulnerableSgi
cpe:2.3:o:sgi:irix:6.5.2:*:*:*:*:*:*:*6.5.2VulnerableSgi
cpe:2.3:o:sgi:irix:6.5.3:*:*:*:*:*:*:*6.5.3VulnerableSgi
cpe:2.3:o:sgi:irix:6.5.4:*:*:*:*:*:*:*6.5.4VulnerableSgi
cpe:2.3:o:sgi:irix:6.5.5:*:*:*:*:*:*:*6.5.5VulnerableSgi
cpe:2.3:o:sgi:irix:6.5.6:*:*:*:*:*:*:*6.5.6VulnerableSgi
  • cpe:2.3:a:safe.pm:safe.pm:2.0_6:*:*:*:*:*:*:* Versions 2.0_6 Vulnerable ·Safe.pm
  • cpe:2.3:a:safe.pm:safe.pm:2.0_7:*:*:*:*:*:*:* Versions 2.0_7 Vulnerable ·Safe.pm
  • cpe:2.3:a:sun:linux:5.0.7:*:*:*:*:*:*:* Versions 5.0.7 Vulnerable ·Sun
  • cpe:2.3:o:sgi:irix:6.5:*:*:*:*:*:*:* Versions 6.5 Vulnerable ·Sgi
  • cpe:2.3:o:sgi:irix:6.5.1:*:*:*:*:*:*:* Versions 6.5.1 Vulnerable ·Sgi
  • cpe:2.3:o:sgi:irix:6.5.2:*:*:*:*:*:*:* Versions 6.5.2 Vulnerable ·Sgi
  • cpe:2.3:o:sgi:irix:6.5.3:*:*:*:*:*:*:* Versions 6.5.3 Vulnerable ·Sgi
  • cpe:2.3:o:sgi:irix:6.5.4:*:*:*:*:*:*:* Versions 6.5.4 Vulnerable ·Sgi
  • cpe:2.3:o:sgi:irix:6.5.5:*:*:*:*:*:*:* Versions 6.5.5 Vulnerable ·Sgi
  • cpe:2.3:o:sgi:irix:6.5.6:*:*:*:*:*:*:* Versions 6.5.6 Vulnerable ·Sgi
Show 38 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:sgi:irix:6.5.7:*:*:*:*:*:*:*6.5.7VulnerableSgi
cpe:2.3:o:sgi:irix:6.5.8:*:*:*:*:*:*:*6.5.8VulnerableSgi
cpe:2.3:o:sgi:irix:6.5.9:*:*:*:*:*:*:*6.5.9VulnerableSgi
cpe:2.3:o:sgi:irix:6.5.10:*:*:*:*:*:*:*6.5.10VulnerableSgi
cpe:2.3:o:sgi:irix:6.5.11:*:*:*:*:*:*:*6.5.11VulnerableSgi
cpe:2.3:o:sgi:irix:6.5.12:*:*:*:*:*:*:*6.5.12VulnerableSgi
cpe:2.3:o:sgi:irix:6.5.13:*:*:*:*:*:*:*6.5.13VulnerableSgi
cpe:2.3:o:sgi:irix:6.5.14:*:*:*:*:*:*:*6.5.14VulnerableSgi
cpe:2.3:o:sgi:irix:6.5.15:*:*:*:*:*:*:*6.5.15VulnerableSgi
cpe:2.3:o:sgi:irix:6.5.16:*:*:*:*:*:*:*6.5.16VulnerableSgi
cpe:2.3:o:sgi:irix:6.5.17:*:*:*:*:*:*:*6.5.17VulnerableSgi
cpe:2.3:o:sgi:irix:6.5.17f:*:*:*:*:*:*:*6.5.17fVulnerableSgi
cpe:2.3:o:sgi:irix:6.5.17m:*:*:*:*:*:*:*6.5.17mVulnerableSgi
cpe:2.3:o:sgi:irix:6.5.18:*:*:*:*:*:*:*6.5.18VulnerableSgi
cpe:2.3:o:sgi:irix:6.5.18f:*:*:*:*:*:*:*6.5.18fVulnerableSgi
cpe:2.3:o:sgi:irix:6.5.18m:*:*:*:*:*:*:*6.5.18mVulnerableSgi
cpe:2.3:o:sgi:irix:6.5.19:*:*:*:*:*:*:*6.5.19VulnerableSgi
cpe:2.3:o:sgi:irix:6.5.19f:*:*:*:*:*:*:*6.5.19fVulnerableSgi
cpe:2.3:o:sgi:irix:6.5.19m:*:*:*:*:*:*:*6.5.19mVulnerableSgi
cpe:2.3:o:sgi:irix:6.5.20f:*:*:*:*:*:*:*6.5.20fVulnerableSgi
cpe:2.3:o:sgi:irix:6.5.20m:*:*:*:*:*:*:*6.5.20mVulnerableSgi
cpe:2.3:o:sgi:irix:6.5.21f:*:*:*:*:*:*:*6.5.21fVulnerableSgi
cpe:2.3:o:sgi:irix:6.5.21m:*:*:*:*:*:*:*6.5.21mVulnerableSgi
cpe:2.3:o:sgi:irix:6.5.22:*:*:*:*:*:*:*6.5.22VulnerableSgi
cpe:2.3:o:redhat:enterprise_linux:2.1:*:advanced_server:*:*:*:*:*2.1VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux:2.1:*:advanced_server_ia64:*:*:*:*:*2.1VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux:2.1:*:enterprise_server:*:*:*:*:*2.1VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux:2.1:*:enterprise_server_ia64:*:*:*:*:*2.1VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux:2.1:*:workstation:*:*:*:*:*2.1VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux:2.1:*:workstation_ia64:*:*:*:*:*2.1VulnerableRed Hat
cpe:2.3:o:redhat:linux_advanced_workstation:2.1:*:*:*:*:*:*:*2.1VulnerableRed Hat
cpe:2.3:o:sco:open_unix:8.0:*:*:*:*:*:*:*8.0VulnerableSco
cpe:2.3:o:sco:unixware:7.1.2:*:*:*:*:*:*:*7.1.2VulnerableSco
cpe:2.3:o:sco:unixware:7.1.3:*:*:*:*:*:*:*7.1.3VulnerableSco
cpe:2.3:o:sun:solaris:8.0:*:x86:*:*:*:*:*8.0VulnerableSun
cpe:2.3:o:sun:solaris:9.0:*:sparc:*:*:*:*:*9.0VulnerableSun
cpe:2.3:o:sun:solaris:9.0:*:x86:*:*:*:*:*9.0VulnerableSun
cpe:2.3:o:sun:sunos:5.8:*:*:*:*:*:*:*5.8VulnerableSun
  • cpe:2.3:o:sgi:irix:6.5.7:*:*:*:*:*:*:* Versions 6.5.7 Vulnerable ·Sgi
  • cpe:2.3:o:sgi:irix:6.5.8:*:*:*:*:*:*:* Versions 6.5.8 Vulnerable ·Sgi
  • cpe:2.3:o:sgi:irix:6.5.9:*:*:*:*:*:*:* Versions 6.5.9 Vulnerable ·Sgi
  • cpe:2.3:o:sgi:irix:6.5.10:*:*:*:*:*:*:* Versions 6.5.10 Vulnerable ·Sgi
  • cpe:2.3:o:sgi:irix:6.5.11:*:*:*:*:*:*:* Versions 6.5.11 Vulnerable ·Sgi
  • cpe:2.3:o:sgi:irix:6.5.12:*:*:*:*:*:*:* Versions 6.5.12 Vulnerable ·Sgi
  • cpe:2.3:o:sgi:irix:6.5.13:*:*:*:*:*:*:* Versions 6.5.13 Vulnerable ·Sgi
  • cpe:2.3:o:sgi:irix:6.5.14:*:*:*:*:*:*:* Versions 6.5.14 Vulnerable ·Sgi
  • cpe:2.3:o:sgi:irix:6.5.15:*:*:*:*:*:*:* Versions 6.5.15 Vulnerable ·Sgi
  • cpe:2.3:o:sgi:irix:6.5.16:*:*:*:*:*:*:* Versions 6.5.16 Vulnerable ·Sgi
  • cpe:2.3:o:sgi:irix:6.5.17:*:*:*:*:*:*:* Versions 6.5.17 Vulnerable ·Sgi
  • cpe:2.3:o:sgi:irix:6.5.17f:*:*:*:*:*:*:* Versions 6.5.17f Vulnerable ·Sgi
  • cpe:2.3:o:sgi:irix:6.5.17m:*:*:*:*:*:*:* Versions 6.5.17m Vulnerable ·Sgi
  • cpe:2.3:o:sgi:irix:6.5.18:*:*:*:*:*:*:* Versions 6.5.18 Vulnerable ·Sgi
  • cpe:2.3:o:sgi:irix:6.5.18f:*:*:*:*:*:*:* Versions 6.5.18f Vulnerable ·Sgi
  • cpe:2.3:o:sgi:irix:6.5.18m:*:*:*:*:*:*:* Versions 6.5.18m Vulnerable ·Sgi
  • cpe:2.3:o:sgi:irix:6.5.19:*:*:*:*:*:*:* Versions 6.5.19 Vulnerable ·Sgi
  • cpe:2.3:o:sgi:irix:6.5.19f:*:*:*:*:*:*:* Versions 6.5.19f Vulnerable ·Sgi
  • cpe:2.3:o:sgi:irix:6.5.19m:*:*:*:*:*:*:* Versions 6.5.19m Vulnerable ·Sgi
  • cpe:2.3:o:sgi:irix:6.5.20f:*:*:*:*:*:*:* Versions 6.5.20f Vulnerable ·Sgi
  • cpe:2.3:o:sgi:irix:6.5.20m:*:*:*:*:*:*:* Versions 6.5.20m Vulnerable ·Sgi
  • cpe:2.3:o:sgi:irix:6.5.21f:*:*:*:*:*:*:* Versions 6.5.21f Vulnerable ·Sgi
  • cpe:2.3:o:sgi:irix:6.5.21m:*:*:*:*:*:*:* Versions 6.5.21m Vulnerable ·Sgi
  • cpe:2.3:o:sgi:irix:6.5.22:*:*:*:*:*:*:* Versions 6.5.22 Vulnerable ·Sgi
  • cpe:2.3:o:redhat:enterprise_linux:2.1:*:advanced_server:*:*:*:*:* Versions 2.1 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:2.1:*:advanced_server_ia64:*:*:*:*:* Versions 2.1 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:2.1:*:enterprise_server:*:*:*:*:* Versions 2.1 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:2.1:*:enterprise_server_ia64:*:*:*:*:* Versions 2.1 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:2.1:*:workstation:*:*:*:*:* Versions 2.1 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:2.1:*:workstation_ia64:*:*:*:*:* Versions 2.1 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:linux_advanced_workstation:2.1:*:*:*:*:*:*:* Versions 2.1 Vulnerable ·Red Hat
  • cpe:2.3:o:sco:open_unix:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Sco
  • cpe:2.3:o:sco:unixware:7.1.2:*:*:*:*:*:*:* Versions 7.1.2 Vulnerable ·Sco
  • cpe:2.3:o:sco:unixware:7.1.3:*:*:*:*:*:*:* Versions 7.1.3 Vulnerable ·Sco
  • cpe:2.3:o:sun:solaris:8.0:*:x86:*:*:*:*:* Versions 8.0 Vulnerable ·Sun
  • cpe:2.3:o:sun:solaris:9.0:*:sparc:*:*:*:*:* Versions 9.0 Vulnerable ·Sun
  • cpe:2.3:o:sun:solaris:9.0:*:x86:*:*:*:*:* Versions 9.0 Vulnerable ·Sun
  • cpe:2.3:o:sun:sunos:5.8:*:*:*:*:*:*:* Versions 5.8 Vulnerable ·Sun

Remediation

Red Hat 2 advisories

  • RHSA-2003:256 Released 2003-09-22 · Red Hat rating Important
    : : : Updated Perl packages fix security issues.
    • Red Hat Linux 7.1
    • Red Hat Linux 7.2
    • Red Hat Linux 7.3
    • Red Hat Linux 8.0
    • Red Hat Linux 9
  • RHSA-2003:257 Released 2003-09-22 · Red Hat rating Important
    perl security update
    • Red Hat Enterprise Linux AS (Advanced Server) version 2.1
    • Red Hat Enterprise Linux ES version 2.1
    • Red Hat Enterprise Linux WS version 2.1
    • Red Hat Linux Advanced Workstation 2.1

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux AS (Advanced Server) version 2.1 Fixed RHSA-2003:257
Red Hat Enterprise Linux ES version 2.1Fixed RHSA-2003:257
Red Hat Enterprise Linux WS version 2.1Fixed RHSA-2003:257
Red Hat Linux 7.1Fixed RHSA-2003:256
Red Hat Linux 7.2Fixed RHSA-2003:256
Red Hat Linux 7.3Fixed RHSA-2003:256
Red Hat Linux 8.0Fixed RHSA-2003:256
Red Hat Linux 9Fixed RHSA-2003:256
Red Hat Linux Advanced Workstation 2.1Fixed RHSA-2003:257

Timeline

  1. 2026-10-02 Threatist record created from CVE-2002-1323
  2. 2026-10-03 Alias added: GHSA-qmvp-2m2m-rm8h

References

Patch 2

Advisory 3

Other 8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences