Published: 19/09/2017 Updated: 15/07/2020

CVSS v2 Base Score: 6.4 | Impact Score: 4.9 | Exploitability Score: 10

CVSS v3 Base Score: 9.1 | Impact Score: 5.2 | Exploitability Score: 3.9

VMScore: 571

Vector: AV:N/AC:L/Au:N/C:P/I:N/A:P

Buffer overflow in the S_grok_bslash_N function in regcomp.c in Perl 5 prior to 5.24.3-RC1 and 5.26.x prior to 5.26.1-RC1 allows remote malicious users to disclose sensitive information or cause a denial of service (application crash) via a crafted regular expression with an invalid '\N{U+...}' escape.

Vulnerable Product	Search on Vulmon	Subscribe to Product
perl perl 5.26.0
perl perl

Debian Bug report logs - #875597 perl: CVE-2017-12883: Buffer over-read in regular expression parser Package: src:perl; Maintainer for src:perl is Niko Tyni <ntyni@debianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Tue, 12 Sep 2017 13:33:04 UTC Severity: grave Tags: patch, security, upstream Fo ...

Debian Bug report logs - #875596 perl: CVE-2017-12837: Heap buffer overflow in regular expression compiler Package: src:perl; Maintainer for src:perl is Niko Tyni <ntyni@debianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Tue, 12 Sep 2017 13:33:02 UTC Severity: grave Tags: patch, security, upstre ...

Perl could be made to crash if it received specially crafted input ...

A heap buffer overread was found in perl's grok_bslash_N() function, which is used in the compilation of Unicode nodes in regular expressions, possibly leading to crash or dump of memory segments via the error output An attacker, able to provide a specially crafted regular expression, could look for sensible information in the error message, or cr ...

CWE-119 https://perl5.git.perl.org/perl.git/log/refs/tags/v5.26.1-RC1 https://perl5.git.perl.org/perl.git/log/refs/tags/v5.24.3-RC1 https://perl5.git.perl.org/perl.git/commitdiff/2be4edede4ae226e2eebd4eff28cedd2041f300f#patch1 https://bugzilla.redhat.com/show_bug.cgi?id=1492093 http://www.securityfocus.com/bid/100852 http://mirror.cucumberlinux.com/cucumber/cucumber-1.0/source/lang-base/perl/patches/CVE-2017-12883.patch https://rt.perl.org/Public/Bug/Display.html?id=131598 http://www.debian.org/security/2017/dsa-3982 https://security.netapp.com/advisory/ntap-20180426-0001/https://www.oracle.com/security-alerts/cpujul2020.html https://nvd.nist.gov https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=875597 https://usn.ubuntu.com/3478-2/

CVE-2017-12883

Vulnerability Summary

Vendor Advisories

References

Vulmon Search

About

Products

Connect