Red Hat update for perl



Published: 2019-01-02
Risk High
Patch available YES
Number of vulnerabilities 4
CVE-ID CVE-2018-18311
CVE-2018-18312
CVE-2018-18313
CVE-2018-18314
CWE-ID CWE-190
CWE-122
CWE-787
Exploitation vector Network
Public exploit Public exploit code for vulnerability #1 is available.
Public exploit code for vulnerability #2 is available.
Public exploit code for vulnerability #3 is available.
Public exploit code for vulnerability #4 is available.
Vulnerable software
Subscribe
Red Hat Enterprise Linux for x86_64
Operating systems & Components / Operating system

Vendor Red Hat Inc.

Security Bulletin

This security bulletin contains information about 4 vulnerabilities.

1) Integer overflow

EUVDB-ID: #VU16183

Risk: High

CVSSv3.1:

CVE-ID: CVE-2018-18311

CWE-ID: CWE-190 - Integer overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to cause DoS condition or execute arbitrary code on the target system.

The vulnerability exists due to integer overflow in Perl_my_setenv when processing malicious input. A remote unauthenticated attacker can supply specially crafted data, trigger heap-based buffer overflow and cause the service to crash or execute arbitrary code with elevated privileges.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Red Hat Enterprise Linux for x86_64: 7.0 - 7.6


CPE2.3 External links

http://access.redhat.com/errata/RHSA-2019:0001

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

2) Out-of-bounds write

EUVDB-ID: #VU16184

Risk: High

CVSSv3.1:

CVE-ID: CVE-2018-18312

CWE-ID: CWE-787 - Out-of-bounds write

Exploit availability: No

Description

The vulnerability allows a remote attacker to cause DoS condition or execute arbitrary code on the target system.

The vulnerability exists due to heap-based buffer overflow write during compilation. A remote unauthenticated attacker can supply specially crafted regular expression, trigger memory corruption and cause the service to crash or execute arbitrary code with elevated privileges.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Red Hat Enterprise Linux for x86_64: 7.0 - 7.6


CPE2.3 External links

http://access.redhat.com/errata/RHSA-2019:0001

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

3) Heap-based buffer overflow

EUVDB-ID: #VU16186

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2018-18313

CWE-ID: CWE-122 - Heap-based Buffer Overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to obtain potentially sensitive information on the target system.

The vulnerability exists due to heap-based buffer overflow read during compilation. A remote unauthenticated attacker can supply specially crafted regular expression, trigger memory leak and gain access to arbitrary data.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Red Hat Enterprise Linux for x86_64: 7.0 - 7.6


CPE2.3 External links

http://access.redhat.com/errata/RHSA-2019:0001

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

4) Heap-based buffer overflow

EUVDB-ID: #VU16185

Risk: High

CVSSv3.1:

CVE-ID: CVE-2018-18314

CWE-ID: CWE-122 - Heap-based Buffer Overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to cause DoS condition or execute arbitrary code on the target system.

The vulnerability exists due to heap-based buffer overflow when processing malicious input. A remote unauthenticated attacker can supply specially crafted regular expression, trigger memory corruption and cause the service to crash or execute arbitrary code with elevated privileges.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Red Hat Enterprise Linux for x86_64: 7.0 - 7.6


CPE2.3 External links

http://access.redhat.com/errata/RHSA-2019:0001

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?



###SIDEBAR###