Anolis OS update for perl

1) Off-by-one

EUVDB-ID: #VU83508

Risk: High

CVSSv4.0: 7.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2023-47038

CWE-ID: CWE-193 - Off-by-one Error

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to an off-by-one error when processing regular expressions. A remote attacker can trigger an off-by-one error and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

Anolis OS: 23

perl-vmsish: before 1.04-15

perl-vars: before 1.05-15

perl-utils: before 5.36.3-15

perl-subs: before 1.04-15

perl-sort: before 2.05-15

perl-sigtrap: before 1.10-15

perl-overloading: before 0.02-15

perl-overload: before 1.35-15

perl-open: before 1.13-15

perl-meta-notation: before 5.36.3-15

perl-macros: before 5.36.3-15

perl-locale: before 1.10-15

perl-libnetcfg: before 5.36.3-15

perl-less: before 0.03-15

perl-if: before 0.61.000-15

perl-filetest: before 1.03-15

perl-fields: before 2.27-15

perl-encoding-warnings: before 0.13-15

perl-doc: before 5.36.3-15

perl-diagnostics: before 1.39-15

perl-deprecate: before 0.04-15

perl-debugger: before 1.60-15

perl-blib: before 1.07-15

perl-base: before 2.27-15

perl-autouse: before 1.11-15

perl-User-pwent: before 1.03-15

perl-Unicode-UCD: before 0.78-15

perl-Time: before 1.03-15

perl-Tie-Memoize: before 1.1-15

perl-Tie-File: before 1.06-15

perl-Tie: before 4.6-15

perl-Thread-Semaphore: before 2.13-15

perl-Thread: before 3.05-15

perl-Text-Abbrev: before 1.02-15

perl-Test: before 1.31-15

perl-Term-ReadLine: before 1.17-15

perl-Term-Complete: before 1.403-15

perl-Symbol: before 1.09-15

perl-SelfLoader: before 1.26-15

perl-SelectSaver: before 1.02-15

perl-Search-Dict: before 1.07-15

perl-Safe: before 2.43-15

perl-Pod-Html: before 1.33-15

perl-Pod-Functions: before 1.14-15

perl-Net: before 1.03-15

perl-NEXT: before 0.69-15

perl-Module-Loaded: before 0.08-15

perl-Memoize: before 1.03-15

perl-Math-Complex: before 1.59-15

perl-Locale-Maketext-Simple: before 0.21-15

perl-IPC-Open3: before 1.22-15

perl-I18N-LangTags: before 0.45-15

perl-I18N-Collate: before 1.02-15

perl-Getopt-Std: before 1.13-15

perl-FindBin: before 1.53-15

perl-FileHandle: before 2.03-15

perl-FileCache: before 1.10-15

perl-File-stat: before 1.12-15

perl-File-Find: before 1.40-15

perl-File-Copy: before 2.39-15

perl-File-Compare: before 1.100.700-15

perl-File-Basename: before 2.85-15

perl-ExtUtils-Miniperl: before 1.11-15

perl-ExtUtils-Embed: before 1.35-15

perl-ExtUtils-Constant: before 0.25-15

perl-English: before 1.11-15

perl-Dumpvalue: before 2.27-15

perl-DirHandle: before 1.05-15

perl-Devel-SelfStubber: before 1.06-15

perl-DBM_Filter: before 0.06-15

perl-Config-Extensions: before 0.03-15

perl-Class-Struct: before 0.66-15

perl-Benchmark: before 1.23-15

perl-AutoSplit: before 5.74-15

perl-AutoLoader: before 5.74-15

perl-Attribute-Handlers: before 1.02-15

perl-tests: before 5.36.3-15

perl-ph: before 5.36.3-15

perl-mro: before 1.26-15

perl-libs: before 5.36.3-15

perl-lib: before 0.65-15

perl-interpreter: before 5.36.3-15

perl-devel: before 5.36.3-15

perl-Time-Piece: before 1.3401-15

perl-Sys-Hostname: before 1.24-15

perl-POSIX: before 2.03-15

perl-Opcode: before 1.57-15

perl-ODBM_File: before 1.17-15

perl-NDBM_File: before 1.15-15

perl-IO: before 1.50-15

perl-I18N-Langinfo: before 0.21-15

perl-Hash-Util-FieldHash: before 1.26-15

perl-Hash-Util: before 0.28-15

perl-GDBM_File: before 1.23-15

perl-File-DosGlob: before 1.12-15

perl-Fcntl: before 1.15-15

perl-Errno: before 1.36-15

perl-DynaLoader: before 1.52-15

perl-Devel-Peek: before 1.32-15

perl-B: before 1.83-15

perl: before 5.36.3-15

CPE2.3

• cpe:2.3:o:openanolis:anolis_os:23:*:*:*:*:*:*:*
• cpe:2.3:a:openanolis:perl-vmsish:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perl-vars:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perl-utils:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perl-subs:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perl-sort:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perl-sigtrap:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perl-overloading:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perl-overload:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perl-open:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perl-meta-notation:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perl-macros:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perl-locale:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perl-libnetcfg:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perl-less:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perl-if:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perl-filetest:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perl-fields:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perl-encoding-warnings:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perl-doc:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perl-diagnostics:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perl-deprecate:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perl-debugger:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perl-blib:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perl-base:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perl-autouse:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perl-user-pwent:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perl-unicode-ucd:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perl-time:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perl-tie-memoize:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perl-tie-file:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perl-tie:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perl-thread-semaphore:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perl-thread:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perl-text-abbrev:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perl-test:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perl-term-readline:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perl-term-complete:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perl-symbol:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perl-selfloader:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perl-selectsaver:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perl-search-dict:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perl-safe:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perl-pod-html:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perl-pod-functions:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perl-net:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perl-next:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perl-module-loaded:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perl-memoize:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perl-math-complex:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perl-locale-maketext-simple:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perl-ipc-open3:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perl-i18n-langtags:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perl-i18n-collate:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perl-getopt-std:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perl-findbin:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perl-filehandle:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perl-filecache:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perl-file-stat:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perl-file-find:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perl-file-copy:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perl-file-compare:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perl-file-basename:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perl-extutils-miniperl:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perl-extutils-embed:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perl-extutils-constant:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perl-english:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perl-dumpvalue:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perl-dirhandle:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perl-devel-selfstubber:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perl-dbm_filter:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perl-config-extensions:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perl-class-struct:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perl-benchmark:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perl-autosplit:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perl-autoloader:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perl-attribute-handlers:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perl-tests:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perl-ph:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perl-mro:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perl-libs:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perl-lib:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perl-interpreter:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perl-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perl-time-piece:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perl-sys-hostname:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perl-posix:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perl-opcode:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perl-odbm_file:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perl-ndbm_file:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perl-io:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perl-i18n-langinfo:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perl-hash-util-fieldhash:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perl-hash-util:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perl-gdbm_file:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perl-file-dosglob:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perl-fcntl:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perl-errno:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perl-dynaloader:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perl-devel-peek:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perl-b:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perl:*:*:*:*:*:anolis_os:*:*

External links

https://anas.openanolis.cn/errata/detail/ANSA-2023:0814

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.