Heap-based Buffer Overflow in Perl 5.18 through 5.26
Summary
CVE-2018-6797: An issue was discovered in Perl 5.18 through 5.26. A crafted regular expression can cause a heap-based buffer overflow, with control over the bytes written. Affects perl across 2 version ranges.
< 5.26.2-r0
>= a9acda3b5f74585852a57b51b724804ac586cb0b, <= 95388f2eb27e74cdbfb715c0097f16aeba4e6e4e
Fixed in 5.26.2-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Perl is a high-level, general-purpose programming language known for its powerful text processing capabilities. It is widely used in various domains, including web development, system administration, and network programming. However, versions 5.18 through 5.26 of Perl are susceptible to a heap-based buffer overflow vulnerability.
Vulnerability Detail
The vulnerability, identified as CVE-2018-6797, arises from a flaw in the regular expression handling of Perl. An attacker can exploit this issue by crafting a malicious regular expression, leading to a heap-based buffer overflow. This allows the attacker to gain control over the bytes written, potentially leading to arbitrary code execution or a denial of service.
How To Fix
Minimum fixed version
5.26.2-r0
This is the first release that contains the fix.
sudo apk add --upgrade perlTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No known workarounds are available for this vulnerability.
Conclusion
The heap-based buffer overflow vulnerability in Perl 5.18 through 5.26 poses a significant risk to affected systems. It is crucial to update Perl to version 5.26.2-r0 or later to mitigate this vulnerability. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for perl →
FAQ
Perl is a high-level programming language known for its text processing capabilities and versatility.
Versions 5.18 through 5.26 of Perl are vulnerable to the heap-based buffer overflow.
A heap-based buffer overflow occurs when a program writes more data to a buffer in the heap than it can hold, leading to memory corruption and potential code execution.
Exploiting this vulnerability can result in arbitrary code execution or a denial of service, depending on the attacker's intentions.
To update Perl, you can follow the official documentation or use package managers specific to your operating system.
References
Related vulnerabilities
Recent vulnerabilities recorded for perl.
