CVSS: 5.0EPSS: 0%CPEs: 9EXPL: 1CVE-2010-1158
https://notcve.org/view.php?id=CVE-2010-1158
Integer overflow in the regular expression engine in Perl 5.8.x allows context-dependent attackers to cause a denial of service (stack consumption and application crash) by matching a crafted regular expression against a long string. Desbordamiento de entero en el motor de expresiones regulares de Perl v5.8.x permite a atacantes dependiendo del contexto provocar una denegación de servicio (consumo de la pila y caída de la aplicación) cotejando una expresión regular modificada contra una cadena de texto extensa. • http://bugs.gentoo.org/show_bug.cgi?id=313565 http://perldoc.perl.org/perl5100delta.html http://secunia.com/advisories/55314 http://www.openwall.com/lists/oss-security/2010/04/08/9 http://www.openwall.com/lists/oss-security/2010/04/14/3 https://bugzilla.redhat.com/show_bug.cgi?id=580605 • CWE-189: Numeric Errors •
CVSS: 5.0EPSS: 1%CPEs: 1EXPL: 0CVE-2009-3626
https://notcve.org/view.php?id=CVE-2009-3626
Perl 5.10.1 allows context-dependent attackers to cause a denial of service (application crash) via a UTF-8 character with a large, invalid codepoint, which is not properly handled during a regular-expression match. Perl v5.10.1 permite a atacantes dependientes de contexto producir una denegación de servicio (caida de aplicación) a través de un carácter UTF-8 con un codepoint largo invalido, lo que no es adecuadamente gestionado cuando se produce una coincidencia de expresiones regulares. • http://perl5.git.perl.org/perl.git/commit/0abd0d78a73da1c4d13b1c700526b7e5d03b32d4 http://rt.perl.org/rt3/Public/Bug/Display.html?id=69973 http://rt.perl.org/rt3/Ticket/Attachment/617489/295383 http://secunia.com/advisories/37144 http://securitytracker.com/id?1023077 http://www.openwall.com/lists/oss-security/2009/10/23/8 http://www.osvdb.org/59283 http://www.securityfocus.com/bid/36812 http://www.vupen.com/english/advisories/2009/3023 https://exchange.xforce.ibmcloud.com •
CVSS: 6.9EPSS: 0%CPEs: 4EXPL: 3CVE-2008-5302 – perl: File:: Path rmtree race condition (CVE-2005-0448) reintroduced after upstream rebase to 5.8.8-1
https://notcve.org/view.php?id=CVE-2008-5302
Race condition in the rmtree function in File::Path 1.08 and 2.07 (lib/File/Path.pm) in Perl 5.8.8 and 5.10.0 allows local users to create arbitrary setuid binaries via a symlink attack, a different vulnerability than CVE-2005-0448, CVE-2004-0452, and CVE-2008-2827. NOTE: this is a regression error related to CVE-2005-0448. It is different from CVE-2008-5303 due to affected versions. Condición de carrera en la función rmtree de File::Path 1.08 y 2.07 (lib/File/Path.pm) en Perl 5.8.8 y 5.10.0 permite a usuarios locales crear binarios setuid arbitrarios a través de un ataque por enlace simbólico. Se trata de una vulnerabilidad diferente que CVE-2005-0448, CVE-2004-0452 y CVE-2008-2827. • http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=286905 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=286922#36 http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705 http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10735 http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html http://secunia.com/advisories/32980 http://secunia.com/advisories/33314 http://secunia.com&#x • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') •
CVSS: 6.9EPSS: 0%CPEs: 2EXPL: 1CVE-2008-5303 – perl: File:: Path rmtree race condition (CVE-2004-0452) reintroduced after upstream rebase to 5.8.8-1
https://notcve.org/view.php?id=CVE-2008-5303
Race condition in the rmtree function in File::Path 1.08 (lib/File/Path.pm) in Perl 5.8.8 allows local users to to delete arbitrary files via a symlink attack, a different vulnerability than CVE-2005-0448, CVE-2004-0452, and CVE-2008-2827. NOTE: this is a regression error related to CVE-2005-0448. It is different from CVE-2008-5302 due to affected versions. Condición de carrera en la función rmtree en File::Path 1.08 (lib/File/Path.pm) en Perl 5.8.8 permite a usuarios locales borrar archivos arbitrarios a través de un ataque de enlace simbólico, una vulnerabilidad diferente a CVE-2005-0448, CVE-2004-0452 y CVE-2008-2827. NOTA: esto es un error de regresión relacionado con CVE-2005-0448. • http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=286905 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=286922#36 http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705 http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10735 http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html http://secunia.com/advisories/32980 http://secunia.com/advisories/33314 http://secunia.com/advisories/40052 http://support.apple.com/kb/HT4077 http://wiki.rp • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') •
CVSS: 4.6EPSS: 0%CPEs: 1EXPL: 3CVE-2008-2827 – Perl - 'rmtree()' Function Local Insecure Permissions
https://notcve.org/view.php?id=CVE-2008-2827
The rmtree function in lib/File/Path.pm in Perl 5.10 does not properly check permissions before performing a chmod, which allows local users to modify the permissions of arbitrary files via a symlink attack, a different vulnerability than CVE-2005-0448 and CVE-2004-0452. La función rmtree en lib/File/Path.pm de Perl 5.10 no comprueba correctamente los permisos antes de realizar chmod, lo que permite a usuarios locales modificar los permisos de archivos de su elección mediante un ataque de enlaces simbólicos, una vulnerabilidad distinta a CVE-2005-0448 y CVE-2004-0452. • https://www.exploit-db.com/exploits/31959 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=487319 http://lists.opensuse.org/opensuse-security-announce/2008-08/msg00006.html http://rt.cpan.org/Public/Bug/Display.html?id=36982 http://secunia.com/advisories/30790 http://secunia.com/advisories/30837 http://secunia.com/advisories/31687 http://www.mandriva.com/security/advisories?name=MDVSA-2008:165 http://www.securityfocus.com/bid/29902 http://www.securitytracker.com/id?1020373 h • CWE-264: Permissions, Privileges, and Access Controls •