CVE-2018-6913

Heap-based buffer overflow in the pack function in Perl before 5.26.2 allows context-dependent attackers to execute arbitrary code via a large item count.

Heap-based buffer overflow in the pack function in Perl before 5.26.2 allows context-dependent attackers to execute arbitrary code via a large item count.

Heap-based buffer overflow in the pack function in Perl before 5.26.2 allows context-dependent attackers to execute arbitrary code via a large item count.

Brian Carpenter reported that a crafted regular expression could cause a heap buffer write overflow, with control over the bytes written (CVE-2018-6797).

Nguyen Duc Manh reported that matching a crafted locale dependent regular expression can cause a heap-based buffer over-read and potentially information disclosure (CVE-2018-6798).

GwanYeong Kim reported that 'pack()' could cause a heap buffer write overflow with a large item count (CVE-2018-6913).

GwanYeong Kim reported that 'pack()' could cause a heap buffer write overflow with a large item count (CVE-2018-6913).

This update for perl fixes the following issues:

Security issue fixed:

• CVE-2018-6913: Fixed space calculation issues in pp_pack.c (bsc#1082216).
• CVE-2018-6798: Fixed heap buffer overflow in regexec.c (bsc#1082233).

This update for perl fixes the following issues:

Security issues fixed:

• CVE-2018-6913: Fixed space calculation issues in pp_pack.c (bsc#1082216).
• CVE-2018-6798: Fixed heap buffer overflow in regexec.c (bsc#1082233).
• CVE-2018-6797: Fixed sharp-s regexp overflow (bsc#1082234).

This update for perl fixes the following issues:

These security issue were fixed:

• CVE-2018-6913: Fixed space calculation issues in pp_pack.c (bsc#1082216).
• CVE-2018-6798: Fixed heap buffer overflow in regexec.c (bsc#1082233).
• CVE-2018-6797: Fixed sharp-s regexp overflow (bsc#1082234).
• CVE-2018-12015: The Archive::Tar module allowed remote attackers to bypass a directory-traversal protection mechanism and overwrite arbitrary files (bsc#1096718)

This non-security issue was fixed:

• fix debugger crash in tab completion with Term::ReadLine::Gnu [bsc#1068565]

This update for perl fixes the following issues:

These security issue were fixed:

• CVE-2018-6913: Fixed space calculation issues in pp_pack.c (bsc#1082216).
• CVE-2018-6798: Fixed heap buffer overflow in regexec.c (bsc#1082233).
• CVE-2018-6797: Fixed sharp-s regexp overflow (bsc#1082234).
• CVE-2018-12015: The Archive::Tar module allowed remote attackers to bypass a directory-traversal protection mechanism and overwrite arbitrary files (bsc#1096718)

This non-security issue was fixed:

• fix debugger crash in tab completion with Term::ReadLine::Gnu [bsc#1068565]

This update for perl fixes the following issues:

Security issues fixed:

• CVE-2018-6913: Fixed space calculation issues in pp_pack.c (bsc#1082216)
• CVE-2018-6798: Fixed heap buffer overflow in regexec.c (bsc#1082233)
• CVE-2023-31484: Enabled TLS certificate verification in CPAN (bsc#1210999)
• CVE-2017-6512: Fixed File::Path rmtree/remove_tree race condition (bsc#1047178)

This update for perl fixes the following issues:

Security issues fixed:

• CVE-2018-6913: Fixed space calculation issues in pp_pack.c (bsc#1082216)
• CVE-2018-6798: Fixed heap buffer overflow in regexec.c (bsc#1082233)

Non-security issue fixed:

• make Net::FTP work with TLS 1.3 (bsc#1213638)

This update for perl fixes the following issues:

Security issues fixed:

• CVE-2018-6913: Fixed space calculation issues in pp_pack.c (bsc#1082216)
• CVE-2018-6798: Fixed heap buffer overflow in regexec.c (bsc#1082233)

Non-security issue fixed:

• make Net::FTP work with TLS 1.3 (bsc#1213638)

It was discovered that Perl incorrectly handled certain regular expressions. An attacker could possibly use this issue to cause Perl to hang, resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS. (CVE-2015-8853)

It was discovered that Perl incorrectly loaded libraries from the current working directory. A local attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2016-6185)

It was discovered that Perl incorrectly handled the rmtree and remove_tree functions. A local attacker could possibly use this issue to set the mode on arbitrary files. This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2017-6512)

Brian Carpenter discovered that Perl incorrectly handled certain regular expressions. An attacker could use this issue to cause Perl to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue has only been addressed in Ubuntu 16.04 LTS and Ubuntu 17.10. (CVE-2018-6797)

Nguyen Duc Manh discovered that Perl incorrectly handled certain regular expressions. An attacker could use this issue to cause Perl to crash, resulting in a denial of service. This issue only affected Ubuntu 16.04 LTS and Ubuntu 17.10. (CVE-2018-6798)

GwanYeong Kim discovered that Perl incorrectly handled certain data when using the pack function. An attacker could use this issue to cause Perl to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2018-6913)