CVSS: 9.8EPSS: 3%CPEs: 120EXPL: 0CVE-2012-1151 – perl-DBD-Pg: Format string flaws by turning db notices into Perl warnings and by preparing DBD statement
https://notcve.org/view.php?id=CVE-2012-1151
09 Sep 2012 — Multiple format string vulnerabilities in dbdimp.c in DBD::Pg (aka DBD-Pg or libdbd-pg-perl) module before 2.19.0 for Perl allow remote PostgreSQL database servers to cause a denial of service (process crash) via format string specifiers in (1) a crafted database warning to the pg_warn function or (2) a crafted DBD statement to the dbd_st_prepare function. Múltiples vulnerabilidades de formato de cadena en dbdimp.c en el módulo DBD::Pg (también conocido como DBD-Pg o libdbd-pg-perl) anteriores a c2.19.0 en ... • http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=661536 • CWE-134: Use of Externally-Controlled Format String •
CVSS: 9.8EPSS: 2%CPEs: 176EXPL: 1CVE-2011-2939 – Perl decode_xs heap-based buffer overflow
https://notcve.org/view.php?id=CVE-2011-2939
13 Jan 2012 — Off-by-one error in the decode_xs function in Unicode/Unicode.xs in the Encode module before 2.44, as used in Perl before 5.15.6, might allow context-dependent attackers to cause a denial of service (memory corruption) via a crafted Unicode string, which triggers a heap-based buffer overflow. Error "Off-by-one" en la función decode_xs en Unicode/Unicode.xs en el módulo Encode anterior a v2.44, utilizado en Perl anterior a v5.15.6 , podría permitir a atacantes dependientes de contexto causar una denegación d... • http://cpansearch.perl.org/src/FLORA/perl-5.14.2/pod/perldelta.pod • CWE-122: Heap-based Buffer Overflow CWE-189: Numeric Errors •
CVSS: 7.5EPSS: 1%CPEs: 6EXPL: 4CVE-2011-0761 – Perl 5.10 - Multiple Null Pointer Dereference Denial of Service Vulnerabilities
https://notcve.org/view.php?id=CVE-2011-0761
13 May 2011 — Perl 5.10.x allows context-dependent attackers to cause a denial of service (NULL pointer dereference and application crash) by leveraging an ability to inject arguments into a (1) getpeername, (2) readdir, (3) closedir, (4) getsockname, (5) rewinddir, (6) tell, or (7) telldir function call. Perl v5.10.x permite a atacantes dependientes de contexto provocar una denegación del servicio (desreferencia a un puntero NULL y bloqueo de la aplicación) elevando una habilidad para inyectar argumentos en una llamada ... • https://www.exploit-db.com/exploits/35725 •
CVSS: 9.8EPSS: 2%CPEs: 40EXPL: 6CVE-2011-1487 – Perl 5.x - 'lc()' / 'uc()' TAINT Mode Protection Security Bypass
https://notcve.org/view.php?id=CVE-2011-1487
11 Apr 2011 — The (1) lc, (2) lcfirst, (3) uc, and (4) ucfirst functions in Perl 5.10.x, 5.11.x, and 5.12.x through 5.12.3, and 5.13.x through 5.13.11, do not apply the taint attribute to the return value upon processing tainted input, which might allow context-dependent attackers to bypass the taint protection mechanism via a crafted string. Las funciones (1) lc, (2) lcfirst, (3) uc, y (4) ucfirst en Perl v5.10.x, v5.11.x, y v5.12.x hasta v5.12.3, y v5.13.x hasta v5.13.11, no aplica el atributo taint para devolver el va... • https://www.exploit-db.com/exploits/35554 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 7.5EPSS: 0%CPEs: 9EXPL: 1CVE-2010-1158 – Gentoo Linux Security Advisory 201311-17
https://notcve.org/view.php?id=CVE-2010-1158
20 Apr 2010 — Integer overflow in the regular expression engine in Perl 5.8.x allows context-dependent attackers to cause a denial of service (stack consumption and application crash) by matching a crafted regular expression against a long string. Desbordamiento de entero en el motor de expresiones regulares de Perl v5.8.x permite a atacantes dependiendo del contexto provocar una denegación de servicio (consumo de la pila y caída de la aplicación) cotejando una expresión regular modificada contra una cadena de texto exte... • http://bugs.gentoo.org/show_bug.cgi?id=313565 • CWE-189: Numeric Errors •
CVSS: 7.5EPSS: 1%CPEs: 1EXPL: 0CVE-2009-3626
https://notcve.org/view.php?id=CVE-2009-3626
29 Oct 2009 — Perl 5.10.1 allows context-dependent attackers to cause a denial of service (application crash) via a UTF-8 character with a large, invalid codepoint, which is not properly handled during a regular-expression match. Perl v5.10.1 permite a atacantes dependientes de contexto producir una denegación de servicio (caida de aplicación) a través de un carácter UTF-8 con un codepoint largo invalido, lo que no es adecuadamente gestionado cuando se produce una coincidencia de expresiones regulares. • http://perl5.git.perl.org/perl.git/commit/0abd0d78a73da1c4d13b1c700526b7e5d03b32d4 •
CVSS: 10.0EPSS: 0%CPEs: 2EXPL: 1CVE-2008-5303 – perl: File:: Path rmtree race condition (CVE-2004-0452) reintroduced after upstream rebase to 5.8.8-1
https://notcve.org/view.php?id=CVE-2008-5303
01 Dec 2008 — Race condition in the rmtree function in File::Path 1.08 (lib/File/Path.pm) in Perl 5.8.8 allows local users to to delete arbitrary files via a symlink attack, a different vulnerability than CVE-2005-0448, CVE-2004-0452, and CVE-2008-2827. NOTE: this is a regression error related to CVE-2005-0448. It is different from CVE-2008-5302 due to affected versions. Condición de carrera en la función rmtree en File::Path 1.08 (lib/File/Path.pm) en Perl 5.8.8 permite a usuarios locales borrar archivos arbitrarios a t... • http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=286905 • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') •
CVSS: 10.0EPSS: 0%CPEs: 4EXPL: 3CVE-2008-5302 – perl: File:: Path rmtree race condition (CVE-2005-0448) reintroduced after upstream rebase to 5.8.8-1
https://notcve.org/view.php?id=CVE-2008-5302
01 Dec 2008 — Race condition in the rmtree function in File::Path 1.08 and 2.07 (lib/File/Path.pm) in Perl 5.8.8 and 5.10.0 allows local users to create arbitrary setuid binaries via a symlink attack, a different vulnerability than CVE-2005-0448, CVE-2004-0452, and CVE-2008-2827. NOTE: this is a regression error related to CVE-2005-0448. It is different from CVE-2008-5303 due to affected versions. Condición de carrera en la función rmtree de File::Path 1.08 y 2.07 (lib/File/Path.pm) en Perl 5.8.8 y 5.10.0 permite a usuar... • http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=286905 • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 3CVE-2008-2827 – Perl - 'rmtree()' Function Local Insecure Permissions
https://notcve.org/view.php?id=CVE-2008-2827
23 Jun 2008 — The rmtree function in lib/File/Path.pm in Perl 5.10 does not properly check permissions before performing a chmod, which allows local users to modify the permissions of arbitrary files via a symlink attack, a different vulnerability than CVE-2005-0448 and CVE-2004-0452. La función rmtree en lib/File/Path.pm de Perl 5.10 no comprueba correctamente los permisos antes de realizar chmod, lo que permite a usuarios locales modificar los permisos de archivos de su elección mediante un ataque de enlaces simbólicos... • https://www.exploit-db.com/exploits/31959 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 7.5EPSS: 2%CPEs: 1EXPL: 0CVE-2008-1927 – perl: heap corruption by regular expressions with utf8 characters
https://notcve.org/view.php?id=CVE-2008-1927
23 Apr 2008 — Double free vulnerability in Perl 5.8.8 allows context-dependent attackers to cause a denial of service (memory corruption and crash) via a crafted regular expression containing UTF8 characters. NOTE: this issue might only be present on certain operating systems. Vulnerabilidad de doble liberacioón en Perl 5.8.8 permite a los atacantes, dependiendo del contexto, causar una denegación de servicio (corrupción de memoria y caida) a través de expresiones regulares manipuladas conteniendo caracteres UTF8. NOTE: ... • http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=454792 • CWE-399: Resource Management Errors •