CVE-2017-12883
Ubuntu Security Notice USN-3478-1
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
Buffer overflow in the S_grok_bslash_N function in regcomp.c in Perl 5 before 5.24.3-RC1 and 5.26.x before 5.26.1-RC1 allows remote attackers to disclose sensitive information or cause a denial of service (application crash) via a crafted regular expression with an invalid '\N{U+...}' escape.
Un Desbordamiento de búfer en la función S_grok_bslash_N en el archivo regcomp.c en Perl versión 5 anterior a 5.24.3-RC1 y versión 5.26.x anterior a 5.26.1-RC1, permite a los atacantes remotos divulgar información confidencial o causar una denegación de servicio (bloqueo de aplicación) por medio de una expresión creada con un escape '\N{U+...}' inválido.
USN-3478-1 fixed two vulnerabilities in Perl. This update provides the corresponding update for Ubuntu 12.04 ESM. Jakub Wilk discovered that Perl incorrectly handled certain regular expressions. An attacker could use this issue to cause Perl to crash, resulting in a denial of service, or possibly execute arbitrary code. Various other issues were also addressed.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2017-08-16 CVE Reserved
- 2017-09-19 CVE Published
- 2024-08-05 CVE Updated
- 2025-04-05 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
CAPEC
References (10)
| URL | Tag | Source |
|---|---|---|
| http://www.securityfocus.com/bid/100852 | Third Party Advisory | |
| https://rt.perl.org/Public/Bug/Display.html?id=131598 | X_refsource_confirm | |
| https://security.netapp.com/advisory/ntap-20180426-0001 | X_refsource_confirm |
|
| https://www.oracle.com/security-alerts/cpujul2020.html | X_refsource_misc |
|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| http://www.debian.org/security/2017/dsa-3982 | 2020-07-15 | |
| https://perl5.git.perl.org/perl.git/log/refs/tags/v5.24.3-RC1 | 2020-07-15 | |
| https://perl5.git.perl.org/perl.git/log/refs/tags/v5.26.1-RC1 | 2020-07-15 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Perl Search vendor "Perl" | Perl Search vendor "Perl" for product "Perl" | <= 5.24.2 Search vendor "Perl" for product "Perl" and version " <= 5.24.2" | - |
Affected
| ||||||
| Perl Search vendor "Perl" | Perl Search vendor "Perl" for product "Perl" | 5.26.0 Search vendor "Perl" for product "Perl" and version "5.26.0" | - |
Affected
| ||||||