Heap Buffer Overflow in Perl Versions 5.33.1-5.41.10 via Transcription Operator
A heap buffer overflow vulnerability exists in Perl versions 5.34, 5.36, 5.38, 5.40, and development versions from 5.33.1 through 5.41.10. The issue occurs in the `S_do_trans_invmap` function when non-ASCII bytes are present in the left-hand-side of the `tr` operator, causing an overflow of the destination pointer `d`. A proof-of-concept demonstrates the vulnerability by creating a large string with a specific byte and performing a translation, which results in a segmentation fault. Researchers believe this vulnerability could potentially enable Denial of Service and possibly Code Execution attacks on vulnerable systems with insufficient protections.
Vulmon