PT-2018-2510 · Perl+5 · Perl+5

Published 2018-05-15 · Updated 2024-06-15 · CVE-2018-18311

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Perl versions prior to 5.26.3 Perl versions 5.28.x prior to 5.28.1

Description The issue is related to errors in handling regular expressions, leading to buffer overflow due to unchecked input data size, resulting in integer overflow. This can allow a remote attacker to cause a denial of service or execute arbitrary code.

Recommendations For Perl versions prior to 5.26.3, update to version 5.26.3 or later. For Perl versions 5.28.x prior to 5.28.1, update to version 5.28.1 or later. As a temporary workaround, consider restricting the use of crafted regular expressions that may trigger the buffer overflow until a patch is available.

Fix

Integer Overflow

Memory Corruption

Buffer Overflow

Weakness Enumeration

CWE-190

CWE-787

CWE-119

Related Identifiers

ALT-PU-2019-1131

BDU:2019-00880

CESA-2019_0109

CVE-2018-18311

DLA-1601-1

DSA-4347-1

OPENSUSE-SU-2018_4258-1

OPENSUSE-SU-2024:11158-1

RHSA-2019:0001

RHSA-2019:0010

RHSA-2019:0109

RHSA-2019:1790

RHSA-2019:1942

RHSA-2019:2400

RHSA-2019_0109

RHSA-2026:7604

SUSE-SU-2018:4187-1

SUSE-SU-2018_4187-1

SUSE-SU-2019:2264-1

SUSE-SU-2019_2264-1

USN-3834-1

USN-3834-2

Affected Products

Alt Linux

Centos

Perl

Red Hat

Suse

Ubuntu

References · 72

• https://github.com/Perl/perl5/commit/34716e2a6ee2af96078d62b065b7785c001194be · Patch
• https://access.redhat.com/errata/RHSA-2019:0010 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1646730 · Patch
• https://security.gentoo.org/glsa/201909-01 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-18313 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-3834-2 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2019:0109 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-18311 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2019:2264-1 · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2018-18311 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2018-18311 · Security Note
• https://bdu.fstec.ru/vul/2019-00880 · Security Note
• https://access.redhat.com/errata/RHSA-2019:1942 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-3834-1 · Vendor Advisory
• https://debian.org/security/2018/dsa-4347 · Vendor Advisory