CVE-2007-5116 buffer overflow in the polymorphic opcode regcomp.c

Debian Bug report logs - #450794
CVE-2007-5116 buffer overflow in the polymorphic opcode regcomp.c

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Nico Golde <nion@debian.org>

To: submit@bugs.debian.org

Subject: CVE-2007-5116 buffer overflow in the polymorphic opcode regcomp.c

Date: Sat, 10 Nov 2007 19:00:17 +0100

[Message part 1 (text/plain, inline)]

Package: perl
Version: 5.8.8-11.1
Severity: grave
Tags: security patch

Hi,
the following CVE (Common Vulnerabilities & Exposures) id was
published for perl.

CVE-2007-5116[0]:
| Buffer overflow in the polymorphic opcode support in the Regular
| Expression Engine (regcomp.c) in Perl 5.8 allows context-dependent
| attackers to execute arbitrary code by switching from byte to Unicode
| (UTF) characters in a regular expression.

If you fix this vulnerability please also include the CVE id
in your changelog entry.

This is a serious issue which might lead to code execution. 
This was already fixed in stable security and we are working 
on fixing this in testing-security.

There is a patch for this on:
http://public.activestate.com/cgi-bin/perlbrowse/30647

For further information:
[0] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5116

Kind regards
Nico

-- 
Nico Golde - http://www.ngolde.de - nion@jabber.ccc.de - GPG: 0x73647CFF
For security reasons, all text in this mail is double-rot13 encrypted.

[Message part 2 (application/pgp-signature, inline)]

Message #10 received at 450794@bugs.debian.org (full text, mbox, reply):

From: Nico Golde <nion@debian.org>

To: control@bugs.debian.org

Cc: 450456@bugs.debian.org, 450794@bugs.debian.org

Subject: merging 450456 450794

Date: Sat, 10 Nov 2007 19:06:03 +0100

# Automatically generated email from bts, devscripts version 2.10.10
# white, you forgot to add the bug number to the cve list so i missed your bug ;-P
merge 450456 450794

Message #17 received at 450794@bugs.debian.org (full text, mbox, reply):

From: Brendan O'Dea <bod@debian.org>

To: Nico Golde <nion@debian.org>, 450794@bugs.debian.org

Subject: Re: Bug#450794: CVE-2007-5116 buffer overflow in the polymorphic opcode regcomp.c

Date: Sun, 11 Nov 2007 12:24:42 +1100

On Sat, Nov 10, 2007 at 07:00:17PM +0100, Nico Golde wrote:
>the following CVE (Common Vulnerabilities & Exposures) id was
>published for perl.

Upload is waiting for ftp-master to come back.

--bod

Send a report that this bug log contains spam.