CVE-2008-1927
Double free vulnerability in Perl 5.8.8 allows context-dependent attackers to cause a denial of...
5.0 MediumFix available
CVE-2008-1927 is a medium vulnerability (CVSS 5.0) in Perl, published April 23, 2008. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.15%, the 88th percentile. Fixed in perl 5.10.0-1.
- Severity
- 5.0 MediumCVSS 2.0, NVD
- Exploit chance
- 3.15%EPSS, 88th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
5.10.0-1perl +87 more
Description
Double free vulnerability in Perl 5.8.8 allows context-dependent attackers to cause a denial of service (memory corruption and crash) via a crafted regular expression containing UTF8 characters. NOTE: this issue might only be present on certain operating systems.
Exploit likelihood
3.15%Up 0.5 points since Feb 4, 2022
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
perlDebian:12 | before 5.10.0-1 | 5.10.0-1 |
perlDebian:13 | before 5.10.0-1 | 5.10.0-1 |
perlDebian:14 | before 5.10.0-1 | 5.10.0-1 |
perlDebian:4.0 | before 5.8.8-7etch3, plus listed versions 5.8.8-75.8.8-7etch15.8.8-7etch2 | 5.8.8-7etch3 |
perlRed Hat:enterprise_linux:3::as | before 2:5.8.0-98.EL3 | 2:5.8.0-98.EL3 |
perl-CGIRed Hat:enterprise_linux:3::as | before 2:2.89-98.EL3 | 2:2.89-98.EL3 |
perl-CPANRed Hat:enterprise_linux:3::as | before 2:1.61-98.EL3 | 2:1.61-98.EL3 |
perl-DB_FileRed Hat:enterprise_linux:3::as | before 2:1.806-98.EL3 | 2:1.806-98.EL3 |
perl-debuginfoRed Hat:enterprise_linux:3::as | before 2:5.8.0-98.EL3 | 2:5.8.0-98.EL3 |
perl-suidperlRed Hat:enterprise_linux:3::as | before 2:5.8.0-98.EL3 | 2:5.8.0-98.EL3 |
Show 78 moreShow less
| Package | Affected | Fixed |
|---|---|---|
perlRed Hat:enterprise_linux:3::desktop | before 2:5.8.0-98.EL3 | 2:5.8.0-98.EL3 |
perl-CGIRed Hat:enterprise_linux:3::desktop | before 2:2.89-98.EL3 | 2:2.89-98.EL3 |
perl-CPANRed Hat:enterprise_linux:3::desktop | before 2:1.61-98.EL3 | 2:1.61-98.EL3 |
perl-DB_FileRed Hat:enterprise_linux:3::desktop | before 2:1.806-98.EL3 | 2:1.806-98.EL3 |
perl-debuginfoRed Hat:enterprise_linux:3::desktop | before 2:5.8.0-98.EL3 | 2:5.8.0-98.EL3 |
perl-suidperlRed Hat:enterprise_linux:3::desktop | before 2:5.8.0-98.EL3 | 2:5.8.0-98.EL3 |
perlRed Hat:enterprise_linux:3::es | before 2:5.8.0-98.EL3 | 2:5.8.0-98.EL3 |
perl-CGIRed Hat:enterprise_linux:3::es | before 2:2.89-98.EL3 | 2:2.89-98.EL3 |
perl-CPANRed Hat:enterprise_linux:3::es | before 2:1.61-98.EL3 | 2:1.61-98.EL3 |
perl-DB_FileRed Hat:enterprise_linux:3::es | before 2:1.806-98.EL3 | 2:1.806-98.EL3 |
perl-debuginfoRed Hat:enterprise_linux:3::es | before 2:5.8.0-98.EL3 | 2:5.8.0-98.EL3 |
perl-suidperlRed Hat:enterprise_linux:3::es | before 2:5.8.0-98.EL3 | 2:5.8.0-98.EL3 |
perlRed Hat:enterprise_linux:3::ws | before 2:5.8.0-98.EL3 | 2:5.8.0-98.EL3 |
perl-CGIRed Hat:enterprise_linux:3::ws | before 2:2.89-98.EL3 | 2:2.89-98.EL3 |
perl-CPANRed Hat:enterprise_linux:3::ws | before 2:1.61-98.EL3 | 2:1.61-98.EL3 |
perl-DB_FileRed Hat:enterprise_linux:3::ws | before 2:1.806-98.EL3 | 2:1.806-98.EL3 |
perl-debuginfoRed Hat:enterprise_linux:3::ws | before 2:5.8.0-98.EL3 | 2:5.8.0-98.EL3 |
perl-suidperlRed Hat:enterprise_linux:3::ws | before 2:5.8.0-98.EL3 | 2:5.8.0-98.EL3 |
perlRed Hat:enterprise_linux:4::as | before 3:5.8.5-36.el4_6.3 | 3:5.8.5-36.el4_6.3 |
perl-debuginfoRed Hat:enterprise_linux:4::as | before 3:5.8.5-36.el4_6.3 | 3:5.8.5-36.el4_6.3 |
perl-suidperlRed Hat:enterprise_linux:4::as | before 3:5.8.5-36.el4_6.3 | 3:5.8.5-36.el4_6.3 |
perlRed Hat:enterprise_linux:4::desktop | before 3:5.8.5-36.el4_6.3 | 3:5.8.5-36.el4_6.3 |
perl-debuginfoRed Hat:enterprise_linux:4::desktop | before 3:5.8.5-36.el4_6.3 | 3:5.8.5-36.el4_6.3 |
perl-suidperlRed Hat:enterprise_linux:4::desktop | before 3:5.8.5-36.el4_6.3 | 3:5.8.5-36.el4_6.3 |
perlRed Hat:enterprise_linux:4::es | before 3:5.8.5-36.el4_6.3 | 3:5.8.5-36.el4_6.3 |
perl-debuginfoRed Hat:enterprise_linux:4::es | before 3:5.8.5-36.el4_6.3 | 3:5.8.5-36.el4_6.3 |
perl-suidperlRed Hat:enterprise_linux:4::es | before 3:5.8.5-36.el4_6.3 | 3:5.8.5-36.el4_6.3 |
perlRed Hat:enterprise_linux:4::ws | before 3:5.8.5-36.el4_6.3 | 3:5.8.5-36.el4_6.3 |
perl-debuginfoRed Hat:enterprise_linux:4::ws | before 3:5.8.5-36.el4_6.3 | 3:5.8.5-36.el4_6.3 |
perl-suidperlRed Hat:enterprise_linux:4::ws | before 3:5.8.5-36.el4_6.3 | 3:5.8.5-36.el4_6.3 |
perlRed Hat:enterprise_linux:5::client | before 4:5.8.8-10.el5_2.3 | 4:5.8.8-10.el5_2.3 |
perl-debuginfoRed Hat:enterprise_linux:5::client | before 4:5.8.8-10.el5_2.3 | 4:5.8.8-10.el5_2.3 |
perl-suidperlRed Hat:enterprise_linux:5::client | before 4:5.8.8-10.el5_2.3 | 4:5.8.8-10.el5_2.3 |
perlRed Hat:enterprise_linux:5::server | before 4:5.8.8-10.el5_2.3 | 4:5.8.8-10.el5_2.3 |
perl-debuginfoRed Hat:enterprise_linux:5::server | before 4:5.8.8-10.el5_2.3 | 4:5.8.8-10.el5_2.3 |
perl-suidperlRed Hat:enterprise_linux:5::server | before 4:5.8.8-10.el5_2.3 | 4:5.8.8-10.el5_2.3 |
perlRed Hat:rhel_application_stack:1 | before 4:5.8.8-6.el4s1_3 | 4:5.8.8-6.el4s1_3 |
perl-debuginfoRed Hat:rhel_application_stack:1 | before 4:5.8.8-6.el4s1_3 | 4:5.8.8-6.el4s1_3 |
perl-suidperlRed Hat:rhel_application_stack:1 | before 4:5.8.8-6.el4s1_3 | 4:5.8.8-6.el4s1_3 |
antRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs | before 0:1.6.5-1jpp_1rh | 0:1.6.5-1jpp_1rh |
avalon-logkitRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs | before 0:1.2-2jpp_4rh | 0:1.2-2jpp_4rh |
axisRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs | before 0:1.2.1-1jpp_3rh | 0:1.2.1-1jpp_3rh |
classpathx-jafRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs | before 0:1.0-2jpp_6rh | 0:1.0-2jpp_6rh |
classpathx-mailRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs | before 0:1.1.1-2jpp_8rh | 0:1.1.1-2jpp_8rh |
geronimo-ejb-2.1-apiRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs | before 0:1.0-0.M4.1jpp_10rh | 0:1.0-0.M4.1jpp_10rh |
geronimo-j2ee-1.4-apisRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs | before 0:1.0-0.M4.1jpp_10rh | 0:1.0-0.M4.1jpp_10rh |
geronimo-j2ee-connector-1.5-apiRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs | before 0:1.0-0.M4.1jpp_10rh | 0:1.0-0.M4.1jpp_10rh |
geronimo-j2ee-deployment-1.1-apiRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs | before 0:1.0-0.M4.1jpp_10rh | 0:1.0-0.M4.1jpp_10rh |
geronimo-j2ee-management-1.0-apiRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs | before 0:1.0-0.M4.1jpp_10rh | 0:1.0-0.M4.1jpp_10rh |
geronimo-jms-1.1-apiRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs | before 0:1.0-0.M4.1jpp_10rh | 0:1.0-0.M4.1jpp_10rh |
geronimo-jsp-2.0-apiRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs | before 0:1.0-0.M4.1jpp_10rh | 0:1.0-0.M4.1jpp_10rh |
geronimo-jta-1.0.1B-apiRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs | before 0:1.0-0.M4.1jpp_10rh | 0:1.0-0.M4.1jpp_10rh |
geronimo-servlet-2.4-apiRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs | before 0:1.0-0.M4.1jpp_10rh | 0:1.0-0.M4.1jpp_10rh |
geronimo-specsRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs | before 0:1.0-0.M4.1jpp_10rh | 0:1.0-0.M4.1jpp_10rh |
geronimo-specs-javadocRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs | before 0:1.0-0.M4.1jpp_10rh | 0:1.0-0.M4.1jpp_10rh |
jakarta-commons-modelerRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs | before 0:2.0-3jpp_2rh | 0:2.0-3jpp_2rh |
log4jRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs | before 0:1.2.12-1jpp_1rh | 0:1.2.12-1jpp_1rh |
mx4jRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs | before 1:3.0.1-1jpp_4rh | 1:3.0.1-1jpp_4rh |
pcsc-liteRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs | before 0:1.3.3-3.el4 | 0:1.3.3-3.el4 |
pcsc-lite-debuginfoRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs | before 0:1.3.3-3.el4 | 0:1.3.3-3.el4 |
pcsc-lite-docRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs | before 0:1.3.3-3.el4 | 0:1.3.3-3.el4 |
pcsc-lite-libsRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs | before 0:1.3.3-3.el4 | 0:1.3.3-3.el4 |
rhpki-caRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs | before 0:7.3.0-20.el4 | 0:7.3.0-20.el4 |
rhpki-java-toolsRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs | before 0:7.3.0-10.el4 | 0:7.3.0-10.el4 |
rhpki-kraRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs | before 0:7.3.0-14.el4 | 0:7.3.0-14.el4 |
rhpki-manageRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs | before 0:7.3.0-19.el4 | 0:7.3.0-19.el4 |
rhpki-native-toolsRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs | before 0:7.3.0-6.el4 | 0:7.3.0-6.el4 |
rhpki-ocspRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs | before 0:7.3.0-13.el4 | 0:7.3.0-13.el4 |
rhpki-tksRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs | before 0:7.3.0-13.el4 | 0:7.3.0-13.el4 |
tomcat5Red Hat:certificate_system:7.3 From an advisory covering 39 CVEs | before 0:5.5.23-0jpp_4rh.16 | 0:5.5.23-0jpp_4rh.16 |
tomcat5-common-libRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs | before 0:5.5.23-0jpp_4rh.16 | 0:5.5.23-0jpp_4rh.16 |
tomcat5-jasperRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs | before 0:5.5.23-0jpp_4rh.16 | 0:5.5.23-0jpp_4rh.16 |
tomcat5-jsp-2.0-apiRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs | before 0:5.5.23-0jpp_4rh.16 | 0:5.5.23-0jpp_4rh.16 |
tomcat5-server-libRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs | before 0:5.5.23-0jpp_4rh.16 | 0:5.5.23-0jpp_4rh.16 |
tomcat5-servlet-2.4-apiRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs | before 0:5.5.23-0jpp_4rh.16 | 0:5.5.23-0jpp_4rh.16 |
xerces-j2Red Hat:certificate_system:7.3 From an advisory covering 39 CVEs | before 0:2.7.1-1jpp_1rh | 0:2.7.1-1jpp_1rh |
xml-commonsRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs | before 0:1.3.02-2jpp_1rh | 0:1.3.02-2jpp_1rh |
xml-commons-apisRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs | before 0:1.3.02-2jpp_1rh | 0:1.3.02-2jpp_1rh |
What each source reports
NVD Score used
Double free vulnerability in Perl 5.8.8 allows context-dependent attackers to cause a denial of service (memory corruption and crash) via a crafted regular expression containing UTF8 characters. NOTE: this issue might only be present on certain operating systems.
- Record
CVE-2008-1927- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-399
- Updated
- 2026-11-02
CVE ListNo score
Double free vulnerability in Perl 5.8.8 allows context-dependent attackers to cause a denial of service (memory corruption and crash) via a crafted regular expression containing UTF8 characters. NOTE: this issue might only be present on certain operating systems.
- Record
CVE-2008-1927- Updated
- 2026-11-02
EUVDEUVD-2008-1927No score
Double free vulnerability in Perl 5.8.8 allows context-dependent attackers to cause a denial of service (memory corruption and crash) via a crafted regular expression containing UTF8 characters. NOTE: this issue might only be present on certain operating systems.
- Record
EUVD-2008-1927- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-cjr5-49hf-284rNo score
Double free vulnerability in Perl 5.8.8 allows context-dependent attackers to cause a denial of...
Double free vulnerability in Perl 5.8.8 allows context-dependent attackers to cause a denial of service (memory corruption and crash) via a crafted regular expression containing UTF8 characters. NOTE: this issue might only be present on certain operating systems.
- Record
GHSA-cjr5-49hf-284r- Updated
- 2026-11-02
OSVNo score
Double free vulnerability in Perl 5.8.8 allows context-dependent attackers to cause a denial of service (memory corruption and crash) via a crafted regular expression containing UTF8 characters. NOTE: this issue might only be present on certain operating systems.
- Record
CVE-2008-1927- Updated
- 2026-11-02
OSVDEBIAN-CVE-2008-1927No score
Double free vulnerability in Perl 5.8.8 allows context-dependent attackers to cause a denial of service (memory corruption and crash) via a crafted regular expression containing UTF8 characters. NOTE: this issue might only be present on certain operating systems.
- Record
DEBIAN-CVE-2008-1927- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
lists.opensuse.org/opensuse-security-announce/2008-08/msg00006.html
support.avaya.com/elmodocs2/security/ASA-2008-317.htm
vupen.com/english/advisories/2008/2424
secunia.com/advisories/31328
redhat.com/archives/fedora-package-announce/2008-April/msg00607.html
osvdb.org/44588
Show 194 moreShow less
wiki.rpath.com/Advisories:rPSA-2009-0011
rt.perl.org/rt3/Public/Bug/Display.html?id=48156
exchange.xforce.ibmcloud.com/vulnerabilities/41996
ubuntu.com/usn/usn-700-1
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10579
support.apple.com/kb/HT3438
lists.apple.com/archives/security-announce/2009/Feb/msg00000.html
gentoo.org/security/en/glsa/glsa-200805-17.xml
securitytracker.com/id?1020253
vmware.com/security/advisories/VMSA-2008-0013.html
bugs.debian.org/cgi-bin/bugreport.cgi?bug=454792
securityfocus.com/bid/28928
mandriva.com/security/advisories?name=MDVSA-2008:100
debian.org/security/2008/dsa-1556
ipcop.org/index.php?name=News&file=article&sid=41
nvd.nist.gov/vuln/detail/CVE-2008-1927
github.com/advisories/GHSA-cjr5-49hf-284r
security-tracker.debian.org/tracker/CVE-2008-1927
access.redhat.com/errata/RHSA-2008:0522
bugzilla.redhat.com/show_bug.cgi?id=443928
security.access.redhat.com/data/csaf/v2/advisories/2008/rhsa-2008_0522.json
cve.org/CVERecord?id=CVE-2008-1927
This page doesn't list everything
Left out here: 6 references. The JSON record has them.