Out-of-bounds write in Perl - CVE-2018-18312

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU16184

Out-of-bounds write in Perl - CVE-2018-18312

Published: November 30, 2018 / Updated: December 4, 2018


Vulnerability identifier: #VU16184
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2018-18312
CWE-ID: CWE-787
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to cause DoS condition or execute arbitrary code on the target system.

The vulnerability exists due to heap-based buffer overflow write during compilation. A remote unauthenticated attacker can supply specially crafted regular expression, trigger memory corruption and cause the service to crash or execute arbitrary code with elevated privileges.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.


Affected software

Perl
Debian Linux
Gentoo Linux
Red Hat Enterprise Linux for x86_64
Opensuse
Fedora
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
perl (Alpine package)
perl

How to mitigate CVE-2018-18312

Update to version 5.28.1.

Perl - update to 5.28.1
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data - addressed in versions 4.5.1, 4.8.0
perl (Alpine package) - update to 5.24.4-r2
perl - addressed in versions 5.26.3-415.fc28, 5.26-20181205105946.b88aa309, 5.26-20181205105946.0dec8aa7, 5.28.1-425.fc29

External References

Related Security Bulletins