Heap-based buffer overflow in Perl - CVE-2024-56406

Vulnerability identifier: #VU107411

CSH Severity: High

CVSS v4: 9.2 [CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-56406

CWE-ID: CWE-122

Exploitation vector: Remote access

Exploit availability: Public exploit is available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error within the S_do_trans_invmap() function. A remote attacker can pass specially crafted input to the application, trigger a heap-based buffer overflow and execute arbitrary code on the target system.

Perl
Debian Linux
OpenBSD
Slackware Linux
openEuler
Ubuntu
Anolis OS
Fedora
Rapid Infrastructure Automation
DataStax Hyper-Converged Database
Oracle Commerce Guided Search
Oracle Communications Billing and Revenue Management
Oracle Fusion Middleware
Enterprise Manager Base Platform
perl-overloading
perl-Config-Extensions
perl-less
perl-deprecate
perl-DBM_Filter
perl-Module-Loaded
perl-encoding-warnings
perl-I18N-Langinfo
perl-Locale-Maketext-Simple
perl-ExtUtils-Constant
perl-Hash-Util
perl-I18N-LangTags
perl-if
perl-lib
perl-Class-Struct
perl-NEXT
perl-Unicode-UCD
perl-Tie-Memoize
perl-SelectSaver
perl-Attribute-Handlers
perl-Text-Abbrev
perl-I18N-Collate
perl-filetest
perl-Net
perl-Time
perl-Memoize
perl-User-pwent
perl-subs
perl-vmsish
perl-vars
perl-DirHandle
perl-Tie-File
perl-Devel-SelfStubber
perl-Search-Dict
perl-blib
perl-Symbol
perl-sigtrap
perl-locale
perl-FileCache
perl-English
perl-ExtUtils-Miniperl
perl-autouse
perl-File-stat
perl-File-DosGlob
perl-open
perl-Getopt-Std
perl-Pod-Functions
perl-NDBM_File
perl-Fcntl
perl-ODBM_File
perl-Term-ReadLine
perl-IPC-Open3
perl-Benchmark
perl-GDBM_File
perl-Sys-Hostname
perl-Hash-Util-FieldHash
perl-mro
perl-SelfLoader
perl-Test
perl-Devel-Peek
perl-Pod-Html
perl-overload
perl-ExtUtils-Embed
perl-Errno
perl-diagnostics
perl-File-Find
perl-IO
perl-DynaLoader
perl-FindBin
perl-Opcode
perl-Math-Complex
perl-debugger
perl-B
perl-File-Compare
perl-Term-Complete
perl-Time-Piece
perl-FileHandle
perl-POSIX
perl-sort
perl-Thread-Semaphore
perl-base
perl-fields
perl-Dumpvalue
perl-File-Copy
perl-Safe
perl-File-Basename
perl-Thread
perl-Tie
perl (Ubuntu package)
perl-help
perl-libs
perl-devel
perl-debuginfo
perl-debugsource
perl
perl (Debian package)
perl-doc
perl-libnetcfg
perl-macros
perl-meta-notation
perl-utils
perl-interpreter
perl-ph
perl-tests
perl-AutoLoader
perl-AutoSplit
PowerScale OneFS

Install updates from vendor's website.

Perl - addressed in versions 5.38.4, 5.40.2
Rapid Infrastructure Automation - update to 1.1.5.3
DataStax Hyper-Converged Database - update to 1.2.5
perl-overloading - update to 0.02-17
perl-Config-Extensions - update to 0.03-17
perl-less - update to 0.03-17
perl-deprecate - update to 0.04-17
perl-DBM_Filter - update to 0.06-17
perl-Module-Loaded - update to 0.08-17
perl-encoding-warnings - update to 0.13-17
perl-I18N-Langinfo - update to 0.21-17
perl-Locale-Maketext-Simple - update to 0.21-17
perl-ExtUtils-Constant - update to 0.25-17
perl-Hash-Util - update to 0.28-17
perl-I18N-LangTags - update to 0.45-17
perl-if - update to 0.61.000-17
perl-lib - update to 0.65-17
perl-Class-Struct - update to 0.66-17
perl-NEXT - update to 0.69-17
perl-Unicode-UCD - update to 0.78-17
perl-Tie-Memoize - update to 1.1-17
perl-SelectSaver - update to 1.02-17
perl-Attribute-Handlers - update to 1.02-17
perl-Text-Abbrev - update to 1.02-17
perl-I18N-Collate - update to 1.02-17
perl-filetest - update to 1.03-17
perl-Net - update to 1.03-17
perl-Time - update to 1.03-17
perl-Memoize - update to 1.03-17
perl-User-pwent - update to 1.03-17
perl-subs - update to 1.04-17
perl-vmsish - update to 1.04-17
perl-vars - update to 1.05-17
perl-DirHandle - update to 1.05-17
perl-Tie-File - update to 1.06-17
perl-Devel-SelfStubber - update to 1.06-17
perl-Search-Dict - update to 1.07-17
perl-blib - update to 1.07-17
perl-Symbol - update to 1.09-17
perl-sigtrap - update to 1.10-17
perl-locale - update to 1.10-17
perl-FileCache - update to 1.10-17
perl-English - update to 1.11-17
perl-ExtUtils-Miniperl - update to 1.11-17
perl-autouse - update to 1.11-17
perl-File-stat - update to 1.12-17
perl-File-DosGlob - update to 1.12-17
perl-open - update to 1.13-17
perl-Getopt-Std - update to 1.13-17
perl-Pod-Functions - update to 1.14-17
perl-NDBM_File - update to 1.15-17
perl-Fcntl - update to 1.15-17
perl-ODBM_File - update to 1.17-17
perl-Term-ReadLine - update to 1.17-17
perl-IPC-Open3 - update to 1.22-17
perl-Benchmark - update to 1.23-17
perl-GDBM_File - update to 1.23-17
perl-Sys-Hostname - update to 1.24-17
perl-Hash-Util-FieldHash - update to 1.26-17
perl-mro - update to 1.26-17
perl-SelfLoader - update to 1.26-17
perl-Test - update to 1.31-17
perl-Devel-Peek - update to 1.32-17
perl-Pod-Html - update to 1.33-17
perl-overload - update to 1.35-17
perl-ExtUtils-Embed - update to 1.35-17
perl-Errno - update to 1.36-17
perl-diagnostics - update to 1.39-17
perl-File-Find - update to 1.40-17
perl-IO - update to 1.50-17
perl-DynaLoader - update to 1.52-17
perl-FindBin - update to 1.53-17
perl-Opcode - update to 1.57-17
perl-Math-Complex - update to 1.59-17
perl-debugger - update to 1.60-17
perl-B - update to 1.83-17
perl-File-Compare - update to 1.100.700-17
perl-Term-Complete - update to 1.403-17
perl-Time-Piece - update to 1.3401-17
perl-FileHandle - update to 2.03-17
perl-POSIX - update to 2.03-17
perl-sort - update to 2.05-17
perl-Thread-Semaphore - update to 2.13-17
perl-base - update to 2.27-17
perl-fields - update to 2.27-17
perl-Dumpvalue - update to 2.27-17
perl-File-Copy - update to 2.39-17
perl-Safe - update to 2.43-17
perl-File-Basename - update to 2.85-17
perl-Thread - update to 3.05-17
perl-Tie - update to 4.6-17
perl (Ubuntu package) - addressed in versions 5.34.0-3ubuntu1.4, 5.38.2-3.2ubuntu0.1, 5.38.2-5ubuntu0.1, 5.40.1-2ubuntu0.1
perl-help - addressed in versions 5.34.0-13, 5.34.0-15, 5.38.0-9
perl-libs - addressed in versions 5.34.0-13, 5.34.0-15, 5.38.0-9
perl-devel - addressed in versions 5.34.0-13, 5.34.0-15, 5.38.0-9
perl-debuginfo - addressed in versions 5.34.0-13, 5.34.0-15, 5.38.0-9
perl-debugsource - addressed in versions 5.34.0-13, 5.34.0-15, 5.38.0-9
perl - addressed in versions 5.34.0-13, 5.34.0-15, 5.38.0-9
perl - update to 5.34.3
perl (Debian package) - update to 5.36.0-7+deb12u2
perl-doc - update to 5.36.3-17
perl - update to 5.36.3-17
perl-libnetcfg - update to 5.36.3-17
perl-macros - update to 5.36.3-17
perl-meta-notation - update to 5.36.3-17
perl-utils - update to 5.36.3-17
perl-interpreter - update to 5.36.3-17
perl-libs - update to 5.36.3-17
perl-ph - update to 5.36.3-17
perl-tests - update to 5.36.3-17
perl-devel - update to 5.36.3-17
perl - addressed in versions 5.38.4-508.fc40, 5.40.2-515.fc41, 5.40.2-517.fc42
perl-AutoLoader - update to 5.74-17
perl-AutoSplit - update to 5.74-17
PowerScale OneFS - addressed in versions 9.10.1.3, 9.11.0.1

• Exploit #11314 - [CVE-2024-56406] Heap buffer overflow vulnerability with tr// (April 14, 2025)

• https://github.com/Perl/perl5/commit/87f42aa0e0096e9a346c9672aa3a0bd3bef8c1dd.patch
• https://metacpan.org/release/SHAY/perl-5.38.4/changes
• https://metacpan.org/release/SHAY/perl-5.40.2/changes

• Arbitrary code execution in Perl
• OpenBSD update for Perl
• Debian update for perl
• Fedora 40 update for perl
• Fedora 41 update for perl
• Fedora 42 update for perl
• Ubuntu update for perl
• Slackware Linux update for perl
• Ubuntu update for perl
• openEuler 22.03 LTS SP4 update for perl
• openEuler 22.03 LTS SP3 update for perl
• openEuler 24.03 LTS SP1 update for perl
• openEuler 24.03 LTS update for perl
• Multiple vulnerabilities in IBM Rapid Infrastructure Automation
• Anolis OS update for perl
• Heap-based buffer overflow in Oracle Communications Billing and Revenue Management
• Dell PowerScale OneFS update for third-party components
• Multiple vulnerabilities in Oracle Fusion Middleware
• Multiple vulnerabilities in Enterprise Manager Base Platform
• Multiple vulnerabilities in Oracle Commerce Guided Search
• Multiple vulnerabilities in IBM DataStax Hyper-Converged Database