Heap-based buffer overflow in Perl - CVE-2018-18313

Vulnerability identifier: #VU16186

CSH Severity: Low

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2018-18313

CWE-ID: CWE-122

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to obtain potentially sensitive information on the target system.

The vulnerability exists due to heap-based buffer overflow read during compilation. A remote unauthenticated attacker can supply specially crafted regular expression, trigger memory leak and gain access to arbitrary data.

Perl
Debian Linux
Gentoo Linux
Red Hat Enterprise Linux for x86_64
Opensuse
Fedora
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
perl (Alpine package)
perl

Update to version 5.28.1.

Perl - update to 5.28.1
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data - addressed in versions 4.5.1, 4.8.0
perl (Alpine package) - update to 5.24.4-r2
perl - addressed in versions 5.26.3-415.fc28, 5.26-20181205105946.b88aa309, 5.26-20181205105946.0dec8aa7, 5.28.1-425.fc29

• https://rt.perl.org/Public/Bug/Display.html?id=133192

• Debian update for perl
• OpenSUSE Linux update for perl
• Red Hat update for perl
• Gentoo update for Perl
• Heap-based buffer overflow in perl (Alpine package)
• Heap-based buffer overflow in IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
• Multiple vulnerabilities in IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
• Fedora 29 update for perl
• Fedora 28 update for perl
• Fedora 29 Modular update for perl
• Fedora 28 Modular update for perl