PT-2018-2511 · Perl+3 · Perl+3

Published 2018-08-04 · Updated 2024-06-15 · CVE-2018-18312

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Perl versions prior to 5.26.3 Perl versions 5.28.0 prior to 5.28.1

Description The issue is related to errors in processing regular expressions, which can lead to a buffer overflow, allowing an attacker to execute arbitrary code. This can be triggered by a crafted regular expression that causes invalid write operations.

Recommendations For Perl versions prior to 5.26.3, update to version 5.26.3 or later. For Perl versions 5.28.0 prior to 5.28.1, update to version 5.28.1 or later.

Exploit

Fix

Heap Based Buffer Overflow

Buffer Overflow

Weakness Enumeration

CWE-122

CWE-119

Related Identifiers

ALT-PU-2019-1131

BDU:2019-00881

CVE-2018-18312

DSA-4347-1

OPENSUSE-SU-2018_4258-1

OPENSUSE-SU-2024:11158-1

RHSA-2019:0001

RHSA-2019:0010

RHSA-2026:7604

SUSE-SU-2018:4187-1

USN-3834-1

Affected Products

Alt Linux

Perl

Suse

Ubuntu

References · 50

• 🔥 https://rt.perl.org/Public/Bug/Display.html?id=133423 · Exploit
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RWQGEB543QN7SSBRKYJM6PSOC3RLYGSM · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2018:4187-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-18314 · Vendor Advisory
• https://usn.ubuntu.com/3834-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-18312 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:11158-1 · Vendor Advisory
• https://debian.org/security/2018/dsa-4347 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se16-bulletin-20220829SE16 · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2018-18312 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2018-18312 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-18312 · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-00881 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-18312 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-4347-1 · Vendor Advisory