CVSS: 7.5EPSS: 0%CPEs: 19EXPL: 0CVE-2016-2381
https://notcve.org/view.php?id=CVE-2016-2381
Perl might allow context-dependent attackers to bypass the taint protection mechanism in a child process via duplicate environment variables in envp. Perl podría permitir a atacantes dependientes de contexto eludir los mecanismos de protección taint en un proceso hijo a través de variables de entorno duplicadas en envp. • http://lists.opensuse.org/opensuse-updates/2016-03/msg00112.html http://perl5.git.perl.org/perl.git/commitdiff/ae37b791a73a9e78dedb89fb2429d2628cf58076 http://www.debian.org/security/2016/dsa-3501 http://www.gossamer-threads.com/lists/perl/porters/326387 http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html http://www.securityfocus.com/b • CWE-20: Improper Input Validation •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2013-7422
https://notcve.org/view.php?id=CVE-2013-7422
Integer underflow in regcomp.c in Perl before 5.20, as used in Apple OS X before 10.10.5 and other products, allows context-dependent attackers to execute arbitrary code or cause a denial of service (application crash) via a long digit string associated with an invalid backreference within a regular expression. Desbordamiento inferior de enteros en regcomp.c en Perl en versiones anteriores a 5.20, tal como se utiliza en Apple OS X en versiones anteriores a 10.10.5 y otros productos, permite a atacantes dependientes del contexto ejecutar código arbitrario o causar una denegación de servicio (caída de aplicación) a través de una cadena larga de dígitos asociados con una referencia inversa no válida dentro de una expresión regular. • http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html http://perl5.git.perl.org/perl.git/commit/0c2990d652e985784f095bba4bc356481a66aa06 http://www.securityfocus.com/bid/75704 http://www.ubuntu.com/usn/USN-2916-1 https://security.gentoo.org/glsa/201507-11 https://support.apple.com/kb/HT205031 • CWE-189: Numeric Errors •
CVSS: 2.1EPSS: 0%CPEs: 2EXPL: 4CVE-2014-4330 – Perl 5.20.1 Deep Recursion Stack Overflow
https://notcve.org/view.php?id=CVE-2014-4330
The Dumper method in Data::Dumper before 2.154, as used in Perl 5.20.1 and earlier, allows context-dependent attackers to cause a denial of service (stack consumption and crash) via an Array-Reference with many nested Array-References, which triggers a large number of recursive calls to the DD_dump function. El método Dumper en Data::Dumper anterior a 2.154, utilizado en Perl 5.20.1 y anteriores, permite a atacantes dependientes de contexto causar una denegación de servicio (consumo de la pila y caída) a través de una referencia de array con muchas referencias de array anidadas, lo que provoca un número grande de llamadas recursivas a la función DD_dump. A stack overflow was discovered when serializing data via the Data::Dumper extension which is part of Perl-Core. By using the "Dumper" method on a large Array-Reference which recursively contains other Array-References, it is possible to cause many recursive calls to the DD_dump native function and ultimately exhaust all available stack memory. • http://advisories.mageia.org/MGASA-2014-0406.html http://lists.fedoraproject.org/pipermail/package-announce/2014-September/139441.html http://packetstormsecurity.com/files/128422/Perl-5.20.1-Deep-Recursion-Stack-Overflow.html http://seclists.org/fulldisclosure/2014/Sep/84 http://seclists.org/oss-sec/2014/q3/692 http://secunia.com/advisories/61441 http://secunia.com/advisories/61961 http://www.mandriva.com/security/advisories?name=MDVSA-2015:136 http://www.nntp.perl.org/group/perl.p • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 4.3EPSS: 0%CPEs: 3EXPL: 1CVE-2010-4777 – Perl 5.x - 'Perl_reg_numbered_buff_fetch()' Remote Denial of Service
https://notcve.org/view.php?id=CVE-2010-4777
The Perl_reg_numbered_buff_fetch function in Perl 5.10.0, 5.12.0, 5.14.0, and other versions, when running with debugging enabled, allows context-dependent attackers to cause a denial of service (assertion failure and application exit) via crafted input that is not properly handled when using certain regular expressions, as demonstrated by causing SpamAssassin and OCSInventory to crash. La función Perl_reg_numbered_buff_fetch en Perl 5.10.0, 5.12.0, 5.14.0 y otras versiones, cuando funciona con debugging activado, permite a atacantes dependientes de contexto causar una denegación de servicio (fallo de aserción y cierre de la aplicación) a través de una entrada manipulada que no es manejada adecuadamente cuando hace uso de ciertas expresiones regulares, como se ha demostrado causando la caída de SpamAssassin y OCSInventory. • https://www.exploit-db.com/exploits/35489 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=628836 http://forums.ocsinventory-ng.org/viewtopic.php?id=7215 http://lists.opensuse.org/opensuse-security-announce/2011-05/msg00005.html http://lists.opensuse.org/opensuse-updates/2011-05/msg00025.html https://bugzilla.redhat.com/show_bug.cgi?id=694166 https://listi.jpberlin.de/pipermail/postfixbuch-users/2011-February/055885.html https://rt.perl.org/Public/Bug/Display.html?id=76538 • CWE-20: Improper Input Validation •
CVSS: 7.5EPSS: 1%CPEs: 61EXPL: 0CVE-2013-1667 – perl: DoS in rehashing code
https://notcve.org/view.php?id=CVE-2013-1667
The rehash mechanism in Perl 5.8.2 through 5.16.x allows context-dependent attackers to cause a denial of service (memory consumption and crash) via a crafted hash key. El mecanismo de rehash en Perl v5.8.2 a través v5.16.x permite a atacantes dependientes de contexto provocar una denegación de servicio (consumo de memoria y caída) mediante una tecla de almohadilla diseñada. • http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=702296 http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705 http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10735 http://lists.apple.com/archives/security-announce/2013/Oct/msg00004.html http://marc.info/?l=bugtraq&m=137891988921058&w=2 http://osvdb.org/90892 http://perl5.git.perl.org/perl.git/commitdiff/6e79fe5 http://perl5.git.perl.org/perl.git/commitdiff/9d83adc http://perl5.git.perl.org/perl.git&# • CWE-399: Resource Management Errors •