CVE-2024-55918

What it actually does

An ambiguity between Perl modules and filenames in Graphics::ColorNames before 3.2.0 allows an attacker who can create a file in the current working directory to cause a malicious file to be loaded instead of the intended module, resulting in HTML injection.

Why it matters to the business

Applications relying on the affected Perl library or dependent Ubuntu packages such as gdb, libiberty, and valgrind may produce unexpected HTML output, enabling web content tampering that could disrupt operations or expose users to injected content in rendered interfaces.

How an attack unfolds

An attacker identifies an application using the vulnerable Perl package and creates a crafted file in its current working directory that exploits the module-filename ambiguity; when the library attempts to load a color names module, the attacker's file is loaded instead, injecting HTML into the generated output.

How to fix it

Upgrade Graphics::ColorNames to version 3.2.0 or later. Apply the listed Ubuntu fixes including gdb 7.7.1-0ubuntu5~14.04.3 on 14.04 LTS, gdb 7.11.1-0ubuntu1~16.5 on 16.04 LTS, libiberty 20131116-1ubuntu0.2 on 14.04 LTS, and valgrind 1:3.10.1-1ubuntu3~14.5 on 14.04 LTS.

How to confirm the fix worked

Confirm the Perl package version is 3.2.0 or newer and verify Ubuntu package installations match the fixed versions using package managers; test module loading behavior in a controlled directory to ensure only intended modules are used.

Typical attack path

1. Locate an application or process using Graphics::ColorNames or affected packages
2. Write a malicious file to the current working directory matching an expected module name
3. Trigger the color names module loading code path
4. Observe or leverage the resulting HTML injection in output

How to detect it

Inspect application working directories for unexpected files that could be mistaken for Perl modules; review process execution logs and output for anomalous HTML content or module loading failures that coincide with file creation events.

What your security team should do

• Immediately update Graphics::ColorNames to 3.2.0 across all Perl environments
• Apply the specified Ubuntu package updates for gdb, libiberty, and valgrind
• Restrict write permissions on application working directories to prevent untrusted file creation
• Review and harden file inclusion logic in Perl applications using this library