CVE-2007-5116
Buffer overflow in the polymorphic opcode support in the Regular Expression Engine (regcomp.c) in...
7.5 HighFix available
Buffer overflow in the polymorphic opcode support in the Regular Expression Engine (regcomp.c) in Perl 5.8 allows context-dependent attackers to execute arbitrary code by switching from byte to Unicode (UTF) characters in a regular expression.
Exploit likelihood
4.83%Up 0.4 points since Feb 4, 2022
What each source reports
NVD Score used
Buffer overflow in the polymorphic opcode support in the Regular Expression Engine (regcomp.c) in Perl 5.8 allows context-dependent attackers to execute arbitrary code by switching from byte to Unicode (UTF) characters in a regular expression.
- Record
CVE-2007-5116- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-119
- Updated
- 2026-11-02
CVE List No score
Buffer overflow in the polymorphic opcode support in the Regular Expression Engine (regcomp.c) in Perl 5.8 allows context-dependent attackers to execute arbitrary code by switching from byte to Unicode (UTF) characters in a regular expression.
- Record
CVE-2007-5116- Updated
- 2026-11-02
EUVDEUVD-2007-5097 No score
Buffer overflow in the polymorphic opcode support in the Regular Expression Engine (regcomp.c) in Perl 5.8 allows context-dependent attackers to execute arbitrary code by switching from byte to Unicode (UTF) characters in a regular expression.
- Record
EUVD-2007-5097- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-3wp4-6pwm-vcxj No score
Buffer overflow in the polymorphic opcode support in the Regular Expression Engine (regcomp.c) in...
Buffer overflow in the polymorphic opcode support in the Regular Expression Engine (regcomp.c) in Perl 5.8 allows context-dependent attackers to execute arbitrary code by switching from byte to Unicode (UTF) characters in a regular expression.
- Record
GHSA-3wp4-6pwm-vcxj- Weakness
- CWE-119
- Updated
- 2026-11-02
OSV No score
Buffer overflow in the polymorphic opcode support in the Regular Expression Engine (regcomp.c) in Perl 5.8 allows context-dependent attackers to execute arbitrary code by switching from byte to Unicode (UTF) characters in a regular expression.
- Record
CVE-2007-5116- Updated
- 2026-11-02
OSVDEBIAN-CVE-2007-5116 No score
Buffer overflow in the polymorphic opcode support in the Regular Expression Engine (regcomp.c) in Perl 5.8 allows context-dependent attackers to execute arbitrary code by switching from byte to Unicode (UTF) characters in a regular expression.
- Record
DEBIAN-CVE-2007-5116- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11158-1 No score
perl-32bit-5.34.0-1.1 on GA media
These are all security issues fixed in the perl-32bit-5.34.0-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11158-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
perlDebian:12 |
before 5.8.8-12 | 5.8.8-12 |
perlDebian:13 |
before 5.8.8-12 | 5.8.8-12 |
perlDebian:14 |
before 5.8.8-12 | 5.8.8-12 |
perlDebian:3.1 |
before 5.8.4-8sarge6, plus listed versions 5.8.4-85.8.4-8sarge15.8.4-8sarge25.8.4-8sarge35.8.4-8sarge45.8.4-8sarge5 |
5.8.4-8sarge6 |
perlDebian:4.0 |
before 5.8.8-7etch1, plus listed versions 5.8.8-7 |
5.8.8-7etch1 |
perlDebian:5.0 |
before 5.8.8-11.1+lenny1 | 5.8.8-11.1+lenny1 |
perlRed Hat:enterprise_linux:3::as |
before 2:5.8.0-97.EL3 | 2:5.8.0-97.EL3 |
perl-CGIRed Hat:enterprise_linux:3::as |
before 2:2.89-97.EL3 | 2:2.89-97.EL3 |
perl-CPANRed Hat:enterprise_linux:3::as |
before 2:1.61-97.EL3 | 2:1.61-97.EL3 |
perl-DB_FileRed Hat:enterprise_linux:3::as |
before 2:1.806-97.EL3 | 2:1.806-97.EL3 |
Show 81 moreShow less
| Package | Affected | Fixed |
|---|---|---|
perl-debuginfoRed Hat:enterprise_linux:3::as |
before 2:5.8.0-97.EL3 | 2:5.8.0-97.EL3 |
perl-suidperlRed Hat:enterprise_linux:3::as |
before 2:5.8.0-97.EL3 | 2:5.8.0-97.EL3 |
perlRed Hat:enterprise_linux:3::desktop |
before 2:5.8.0-97.EL3 | 2:5.8.0-97.EL3 |
perl-CGIRed Hat:enterprise_linux:3::desktop |
before 2:2.89-97.EL3 | 2:2.89-97.EL3 |
perl-CPANRed Hat:enterprise_linux:3::desktop |
before 2:1.61-97.EL3 | 2:1.61-97.EL3 |
perl-DB_FileRed Hat:enterprise_linux:3::desktop |
before 2:1.806-97.EL3 | 2:1.806-97.EL3 |
perl-debuginfoRed Hat:enterprise_linux:3::desktop |
before 2:5.8.0-97.EL3 | 2:5.8.0-97.EL3 |
perl-suidperlRed Hat:enterprise_linux:3::desktop |
before 2:5.8.0-97.EL3 | 2:5.8.0-97.EL3 |
perlRed Hat:enterprise_linux:3::es |
before 2:5.8.0-97.EL3 | 2:5.8.0-97.EL3 |
perl-CGIRed Hat:enterprise_linux:3::es |
before 2:2.89-97.EL3 | 2:2.89-97.EL3 |
perl-CPANRed Hat:enterprise_linux:3::es |
before 2:1.61-97.EL3 | 2:1.61-97.EL3 |
perl-DB_FileRed Hat:enterprise_linux:3::es |
before 2:1.806-97.EL3 | 2:1.806-97.EL3 |
perl-debuginfoRed Hat:enterprise_linux:3::es |
before 2:5.8.0-97.EL3 | 2:5.8.0-97.EL3 |
perl-suidperlRed Hat:enterprise_linux:3::es |
before 2:5.8.0-97.EL3 | 2:5.8.0-97.EL3 |
perlRed Hat:enterprise_linux:3::ws |
before 2:5.8.0-97.EL3 | 2:5.8.0-97.EL3 |
perl-CGIRed Hat:enterprise_linux:3::ws |
before 2:2.89-97.EL3 | 2:2.89-97.EL3 |
perl-CPANRed Hat:enterprise_linux:3::ws |
before 2:1.61-97.EL3 | 2:1.61-97.EL3 |
perl-DB_FileRed Hat:enterprise_linux:3::ws |
before 2:1.806-97.EL3 | 2:1.806-97.EL3 |
perl-debuginfoRed Hat:enterprise_linux:3::ws |
before 2:5.8.0-97.EL3 | 2:5.8.0-97.EL3 |
perl-suidperlRed Hat:enterprise_linux:3::ws |
before 2:5.8.0-97.EL3 | 2:5.8.0-97.EL3 |
perlRed Hat:enterprise_linux:4::as |
before 3:5.8.5-36.el4_5.2 | 3:5.8.5-36.el4_5.2 |
perl-debuginfoRed Hat:enterprise_linux:4::as |
before 3:5.8.5-36.el4_5.2 | 3:5.8.5-36.el4_5.2 |
perl-suidperlRed Hat:enterprise_linux:4::as |
before 3:5.8.5-36.el4_5.2 | 3:5.8.5-36.el4_5.2 |
perlRed Hat:enterprise_linux:4::desktop |
before 3:5.8.5-36.el4_5.2 | 3:5.8.5-36.el4_5.2 |
perl-debuginfoRed Hat:enterprise_linux:4::desktop |
before 3:5.8.5-36.el4_5.2 | 3:5.8.5-36.el4_5.2 |
perl-suidperlRed Hat:enterprise_linux:4::desktop |
before 3:5.8.5-36.el4_5.2 | 3:5.8.5-36.el4_5.2 |
perlRed Hat:enterprise_linux:4::es |
before 3:5.8.5-36.el4_5.2 | 3:5.8.5-36.el4_5.2 |
perl-debuginfoRed Hat:enterprise_linux:4::es |
before 3:5.8.5-36.el4_5.2 | 3:5.8.5-36.el4_5.2 |
perl-suidperlRed Hat:enterprise_linux:4::es |
before 3:5.8.5-36.el4_5.2 | 3:5.8.5-36.el4_5.2 |
perlRed Hat:enterprise_linux:4::ws |
before 3:5.8.5-36.el4_5.2 | 3:5.8.5-36.el4_5.2 |
perl-debuginfoRed Hat:enterprise_linux:4::ws |
before 3:5.8.5-36.el4_5.2 | 3:5.8.5-36.el4_5.2 |
perl-suidperlRed Hat:enterprise_linux:4::ws |
before 3:5.8.5-36.el4_5.2 | 3:5.8.5-36.el4_5.2 |
perlRed Hat:enterprise_linux:5::client |
before 4:5.8.8-10.el5_0.2 | 4:5.8.8-10.el5_0.2 |
perl-debuginfoRed Hat:enterprise_linux:5::client |
before 4:5.8.8-10.el5_0.2 | 4:5.8.8-10.el5_0.2 |
perl-suidperlRed Hat:enterprise_linux:5::client |
before 4:5.8.8-10.el5_0.2 | 4:5.8.8-10.el5_0.2 |
perlRed Hat:enterprise_linux:5::server |
before 4:5.8.8-10.el5_0.2 | 4:5.8.8-10.el5_0.2 |
perl-debuginfoRed Hat:enterprise_linux:5::server |
before 4:5.8.8-10.el5_0.2 | 4:5.8.8-10.el5_0.2 |
perl-suidperlRed Hat:enterprise_linux:5::server |
before 4:5.8.8-10.el5_0.2 | 4:5.8.8-10.el5_0.2 |
perlRed Hat:rhel_application_stack:1 |
before 4:5.8.8-5.el4s1_2 | 4:5.8.8-5.el4s1_2 |
perl-debuginfoRed Hat:rhel_application_stack:1 |
before 4:5.8.8-5.el4s1_2 | 4:5.8.8-5.el4s1_2 |
perl-suidperlRed Hat:rhel_application_stack:1 |
before 4:5.8.8-5.el4s1_2 | 4:5.8.8-5.el4s1_2 |
antRed Hat:certificate_system:7.3 |
before 0:1.6.5-1jpp_1rh | 0:1.6.5-1jpp_1rh |
avalon-logkitRed Hat:certificate_system:7.3 |
before 0:1.2-2jpp_4rh | 0:1.2-2jpp_4rh |
axisRed Hat:certificate_system:7.3 |
before 0:1.2.1-1jpp_3rh | 0:1.2.1-1jpp_3rh |
classpathx-jafRed Hat:certificate_system:7.3 |
before 0:1.0-2jpp_6rh | 0:1.0-2jpp_6rh |
classpathx-mailRed Hat:certificate_system:7.3 |
before 0:1.1.1-2jpp_8rh | 0:1.1.1-2jpp_8rh |
geronimo-ejb-2.1-apiRed Hat:certificate_system:7.3 |
before 0:1.0-0.M4.1jpp_10rh | 0:1.0-0.M4.1jpp_10rh |
geronimo-j2ee-1.4-apisRed Hat:certificate_system:7.3 |
before 0:1.0-0.M4.1jpp_10rh | 0:1.0-0.M4.1jpp_10rh |
geronimo-j2ee-connector-1.5-apiRed Hat:certificate_system:7.3 |
before 0:1.0-0.M4.1jpp_10rh | 0:1.0-0.M4.1jpp_10rh |
geronimo-j2ee-deployment-1.1-apiRed Hat:certificate_system:7.3 |
before 0:1.0-0.M4.1jpp_10rh | 0:1.0-0.M4.1jpp_10rh |
geronimo-j2ee-management-1.0-apiRed Hat:certificate_system:7.3 |
before 0:1.0-0.M4.1jpp_10rh | 0:1.0-0.M4.1jpp_10rh |
geronimo-jms-1.1-apiRed Hat:certificate_system:7.3 |
before 0:1.0-0.M4.1jpp_10rh | 0:1.0-0.M4.1jpp_10rh |
geronimo-jsp-2.0-apiRed Hat:certificate_system:7.3 |
before 0:1.0-0.M4.1jpp_10rh | 0:1.0-0.M4.1jpp_10rh |
geronimo-jta-1.0.1B-apiRed Hat:certificate_system:7.3 |
before 0:1.0-0.M4.1jpp_10rh | 0:1.0-0.M4.1jpp_10rh |
geronimo-servlet-2.4-apiRed Hat:certificate_system:7.3 |
before 0:1.0-0.M4.1jpp_10rh | 0:1.0-0.M4.1jpp_10rh |
geronimo-specsRed Hat:certificate_system:7.3 |
before 0:1.0-0.M4.1jpp_10rh | 0:1.0-0.M4.1jpp_10rh |
geronimo-specs-javadocRed Hat:certificate_system:7.3 |
before 0:1.0-0.M4.1jpp_10rh | 0:1.0-0.M4.1jpp_10rh |
jakarta-commons-modelerRed Hat:certificate_system:7.3 |
before 0:2.0-3jpp_2rh | 0:2.0-3jpp_2rh |
log4jRed Hat:certificate_system:7.3 |
before 0:1.2.12-1jpp_1rh | 0:1.2.12-1jpp_1rh |
mx4jRed Hat:certificate_system:7.3 |
before 1:3.0.1-1jpp_4rh | 1:3.0.1-1jpp_4rh |
pcsc-liteRed Hat:certificate_system:7.3 |
before 0:1.3.3-3.el4 | 0:1.3.3-3.el4 |
pcsc-lite-debuginfoRed Hat:certificate_system:7.3 |
before 0:1.3.3-3.el4 | 0:1.3.3-3.el4 |
pcsc-lite-docRed Hat:certificate_system:7.3 |
before 0:1.3.3-3.el4 | 0:1.3.3-3.el4 |
pcsc-lite-libsRed Hat:certificate_system:7.3 |
before 0:1.3.3-3.el4 | 0:1.3.3-3.el4 |
rhpki-caRed Hat:certificate_system:7.3 |
before 0:7.3.0-20.el4 | 0:7.3.0-20.el4 |
rhpki-java-toolsRed Hat:certificate_system:7.3 |
before 0:7.3.0-10.el4 | 0:7.3.0-10.el4 |
rhpki-kraRed Hat:certificate_system:7.3 |
before 0:7.3.0-14.el4 | 0:7.3.0-14.el4 |
rhpki-manageRed Hat:certificate_system:7.3 |
before 0:7.3.0-19.el4 | 0:7.3.0-19.el4 |
rhpki-native-toolsRed Hat:certificate_system:7.3 |
before 0:7.3.0-6.el4 | 0:7.3.0-6.el4 |
rhpki-ocspRed Hat:certificate_system:7.3 |
before 0:7.3.0-13.el4 | 0:7.3.0-13.el4 |
rhpki-tksRed Hat:certificate_system:7.3 |
before 0:7.3.0-13.el4 | 0:7.3.0-13.el4 |
tomcat5Red Hat:certificate_system:7.3 |
before 0:5.5.23-0jpp_4rh.16 | 0:5.5.23-0jpp_4rh.16 |
tomcat5-common-libRed Hat:certificate_system:7.3 |
before 0:5.5.23-0jpp_4rh.16 | 0:5.5.23-0jpp_4rh.16 |
tomcat5-jasperRed Hat:certificate_system:7.3 |
before 0:5.5.23-0jpp_4rh.16 | 0:5.5.23-0jpp_4rh.16 |
tomcat5-jsp-2.0-apiRed Hat:certificate_system:7.3 |
before 0:5.5.23-0jpp_4rh.16 | 0:5.5.23-0jpp_4rh.16 |
tomcat5-server-libRed Hat:certificate_system:7.3 |
before 0:5.5.23-0jpp_4rh.16 | 0:5.5.23-0jpp_4rh.16 |
tomcat5-servlet-2.4-apiRed Hat:certificate_system:7.3 |
before 0:5.5.23-0jpp_4rh.16 | 0:5.5.23-0jpp_4rh.16 |
xerces-j2Red Hat:certificate_system:7.3 |
before 0:2.7.1-1jpp_1rh | 0:2.7.1-1jpp_1rh |
xml-commonsRed Hat:certificate_system:7.3 |
before 0:1.3.02-2jpp_1rh | 0:1.3.02-2jpp_1rh |
xml-commons-apisRed Hat:certificate_system:7.3 |
before 0:1.3.02-2jpp_1rh | 0:1.3.02-2jpp_1rh |
perlopenSUSE:Tumbleweed |
before 5.34.0-1.1 | 5.34.0-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| affected, aliases, facts, published, references, title | GitHub Advisories, OSV | |
| first indexed | CVE List, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2007-5116 is a high vulnerability (CVSS 7.5) in Larry Wall Perl, published November 6, 2007. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.83%, the 92nd percentile. Fixed in perl 5.8.8-12.
References
secunia.com/advisories/27479
debian.org/security/2007/dsa-1400
marc.info?l=bugtraq&m=120352263023774&w=2
vupen.com/english/advisories/2007/4238
us-cert.gov/cas/techalerts/TA07-352A.html
www-1.ibm.com/support/docview.wss?uid=isg1IZ10244
Show 194 moreShow less
securityfocus.com/archive/1/483563/100/0/threaded
issues.rpath.com/browse/RPL-1813
sunsolve.sun.com/search/document.do?assetkey=1-26-31524-1
ubuntu.com/usn/usn-552-1
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10669
securitytracker.com/id?1018899
redhat.com/support/errata/RHSA-2007-0966.html
lists.vmware.com/pipermail/security-announce/2008/000002.html
bugzilla.redhat.com/show_bug.cgi?id=323571
gentoo.org/security/en/glsa/glsa-200711-28.xml
support.avaya.com/elmodocs2/security/ASA-2008-014.htm
openpkg.com/security/advisories/OpenPKG-SA-2007.023.html
lists.apple.com/archives/security-announce/2007/Dec/msg00002.html
docs.info.apple.com/article.html?artnum=307179
novell.com/linux/security/advisories/2007_24_sr.html
mandriva.com/security/advisories?name=MDKSA-2007:207
ipcop.org/index.php?name=News&file=article&sid=41
exchange.xforce.ibmcloud.com/vulnerabilities/38270
vmware.com/security/advisories/VMSA-2008-0001.html
nvd.nist.gov/vuln/detail/CVE-2007-5116
github.com/advisories/GHSA-3wp4-6pwm-vcxj
security-tracker.debian.org/tracker/CVE-2007-5116
access.redhat.com/errata/RHSA-2007:0966
security.access.redhat.com/data/csaf/v2/advisories/2007/rhsa-2007_0966.json
cve.org/CVERecord?id=CVE-2007-5116
suse.com/security/cve/CVE-2005-3962
This page doesn't list everything
Left out here: 27 references. The JSON record has them.