Heap-based buffer overflow in Perl - CVE-2018-6913

Vulnerability identifier: #VU11835

CSH Severity: Low

CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2018-6913

CWE-ID: CWE-122

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local attacker to cause DoS condition or execute arbitrary code on the target system.

The weakness exists due to heap-based buffer overflow. A local attacker can exploit a specially crafted pack() function, trigger memory corruption and cause the service to crash or run Perl code.

Successful exploitation of the vulnerability may result in system compromise.

Perl
Gentoo Linux
Debian Linux
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Real Time 15
SUSE Manager Proxy
SUSE Manager Retail Branch Server
SUSE Manager Server
SUSE Linux Enterprise Micro
SUSE Linux Enterprise Micro for Rancher
openSUSE Leap Micro
SUSE Enterprise Storage
SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS
SUSE Linux Enterprise Server 15 SP2 LTSS
SUSE Linux Enterprise Server 15 SP3 LTSS
SUSE Linux Enterprise Server 15 SP4 LTSS
SUSE Linux Enterprise Desktop 15 SP4 LTSS
SUSE Package Hub 15
Basesystem Module
Development Tools Module
openSUSE Leap
Fedora
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
perl (Alpine package)
perl
perl-base-32bit-debuginfo
perl-base-32bit
perl-32bit-debuginfo
perl-doc
perl-debugsource
perl-base-debuginfo
perl-debuginfo
perl-base
perl-base-64bit
perl-core-DB_File-64bit
perl-64bit-debuginfo
perl-64bit
perl-base-64bit-debuginfo
perl-core-DB_File-64bit-debuginfo
perl-32bit
perl-core-DB_File-32bit-debuginfo
perl-core-DB_File
perl-core-DB_File-debuginfo
perl-core-DB_File-32bit
perl-Module-CoreList
BIG-IQ Centralized Management
RSA Authentication Manager
BIG-IP
PowerStore X
PowerStore T
Storage Resource Manager
EMC Cloud Tiering Appliance
Dell EMC Storage Monitoring and Reporting (SMR)
Dell EMC VxRail Appliance

Update to version 5.26.2.

IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data - addressed in versions 4.5.1, 4.8.0
perl (Alpine package) - update to 5.24.4-r0
RSA Authentication Manager - update to 8.7 SP2 Patch 4
PowerStore X - update to 3.2.1.4-2386214
PowerStore T - update to 4.0.0.2-2365061
Storage Resource Manager - update to 5.0.1.0
Dell EMC Storage Monitoring and Reporting (SMR) - update to 5.0.1.0
perl - addressed in versions 5.24.4-397.fc26, 5.26.2-404.fc27, 5.26.2-410.fc28
perl-base-32bit-debuginfo - addressed in versions 5.26.1-150000.7.18.1, 5.26.1-150300.17.17.1
perl-base-32bit - addressed in versions 5.26.1-150000.7.18.1, 5.26.1-150300.17.17.1
perl-32bit-debuginfo - addressed in versions 5.26.1-150000.7.18.1, 5.26.1-150300.17.17.1
perl-doc - addressed in versions 5.26.1-150000.7.18.1, 5.26.1-150300.17.17.1
perl-debugsource - addressed in versions 5.26.1-150000.7.18.1, 5.26.1-150300.17.17.1
perl-base-debuginfo - addressed in versions 5.26.1-150000.7.18.1, 5.26.1-150300.17.17.1
perl - addressed in versions 5.26.1-150000.7.18.1, 5.26.1-150300.17.17.1
perl-debuginfo - addressed in versions 5.26.1-150000.7.18.1, 5.26.1-150300.17.17.1
perl-base - addressed in versions 5.26.1-150000.7.18.1, 5.26.1-150300.17.17.1
perl-base-64bit - update to 5.26.1-150300.17.17.1
perl-core-DB_File-64bit - update to 5.26.1-150300.17.17.1
perl-64bit-debuginfo - update to 5.26.1-150300.17.17.1
perl-64bit - update to 5.26.1-150300.17.17.1
perl-base-64bit-debuginfo - update to 5.26.1-150300.17.17.1
perl-core-DB_File-64bit-debuginfo - update to 5.26.1-150300.17.17.1
perl-32bit - update to 5.26.1-150300.17.17.1
perl-core-DB_File-32bit-debuginfo - update to 5.26.1-150300.17.17.1
perl-core-DB_File - update to 5.26.1-150300.17.17.1
perl-core-DB_File-debuginfo - update to 5.26.1-150300.17.17.1
perl-core-DB_File-32bit - update to 5.26.1-150300.17.17.1
perl-Module-CoreList - addressed in versions 5.20180414-1.fc26, 5.20180414-1.fc27
Dell EMC VxRail Appliance - update to 8.0.213
EMC Cloud Tiering Appliance - update to 13.2.0.2.31

• https://rt.perl.org/Public/Bug/Display.html?id=131844

• Debian update for perl
• Gentoo update for Perl
• Heap-based buffer overflow in perl (Alpine package)
• Heap-based buffer overflow in IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
• Multiple vulnerabilities in IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
• SUSE update for perl
• SUSE update for perl
• Multiple vulnerabilities in Dell EMC VxRail Appliance
• Multiple vulnerabilities in Dell Storage Resource Manager (SRM) and Dell Storage Monitoring and Reporting (SMR)
• Local denial of service in F5 BIG-IP Perl component
• Local denial of service in F5 BIG-IQ Centralized Management Perl component
• Multiple vulnerabilities in Dell PowerStore X
• Multiple vulnerabilities in Dell PowerStore T Family
• Multiple vulnerabilities in Dell Cloud Tiering Appliance
• Fedora 28 update for perl
• Fedora 27 update for perl, perl-Module-CoreList
• Fedora 26 update for perl, perl-Module-CoreList
• RSA Authentication Manager update for third-party components