Heap-based buffer overflow in Perl - CVE-2018-18314

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU16185

Heap-based buffer overflow in Perl - CVE-2018-18314

Published: November 30, 2018 / Updated: July 15, 2020


Vulnerability identifier: #VU16185
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2018-18314
CWE-ID: CWE-122
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to cause DoS condition or execute arbitrary code on the target system.

The vulnerability exists due to heap-based buffer overflow when processing malicious input. A remote unauthenticated attacker can supply specially crafted regular expression, trigger memory corruption and cause the service to crash or execute arbitrary code with elevated privileges.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.


Affected software

Perl
Debian Linux
Gentoo Linux
Red Hat Enterprise Linux for x86_64
Opensuse
Fedora
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
perl (Alpine package)
perl
Oracle Database Server
Oracle TimesTen In-Memory Database

How to mitigate CVE-2018-18314

Update to version 5.28.1.

Perl - update to 5.28.1
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data - addressed in versions 4.5.1, 4.8.0
perl (Alpine package) - update to 5.24.4-r2
Oracle TimesTen In-Memory Database - update to 18.1.2.1.0
perl - addressed in versions 5.26.3-415.fc28, 5.26-20181205105946.b88aa309, 5.26-20181205105946.0dec8aa7, 5.28.1-425.fc29

External References

Related Security Bulletins