Heap-based buffer overflow in Perl - CVE-2018-6797

Vulnerability identifier: #VU11833

CSH Severity: Low

CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2018-6797

CWE-ID: CWE-122

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local attacker to cause DoS condition or execute arbitrary code on the target system.

The weakness exists in S_regatom() in 'regcomp.c' due to heap-based buffer overflow. A local attacker can exploit a specially crafted regular expression, trigger memory corruption and cause the service to crash or run Perl code.

Successful exploitation of the vulnerability may result in system compromise.

Perl
Debian Linux
Gentoo Linux
Red Hat Enterprise Linux for x86_64
macOS
Fedora
perl (Alpine package)
perl
perl-Module-CoreList

Update to version 5.26.2.

perl (Alpine package) - update to 5.24.4-r0
perl - addressed in versions 5.24.4-397.fc26, 5.26.2-404.fc27, 5.26.2-410.fc28
perl-Module-CoreList - addressed in versions 5.20180414-1.fc26, 5.20180414-1.fc27

• https://rt.perl.org/Public/Bug/Display.html?id=132227

• Debian update for perl
• Red Hat update for perl
• Multiple vulnerabilities in Apple MacOS
• Gentoo update for Perl
• Heap-based buffer overflow in perl (Alpine package)
• Fedora 28 update for perl
• Fedora 27 update for perl, perl-Module-CoreList
• Fedora 26 update for perl, perl-Module-CoreList