Perl vulnerabilities
66 vulnerabilities
Known vulnerabilities in Perl products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 12 products.
Products
11 of 12- Perl47 vulnerabilities
- Dbi10 vulnerabilities
- Database Interface2 vulnerabilities
- Cgi Application Module1 vulnerabilities
- Cgi Lite1 vulnerabilities
- Comprehensive Perl Archive Network1 vulnerabilities
- Convert Uulib1 vulnerabilities
- Pathtools1 vulnerabilities
- Pcre1 vulnerabilities
- Exiftool0 vulnerabilities
- Suidperl0 vulnerabilities
CVE-2018-18314alpineperl+10
EPSS score6.06%
Perl before 5.26.3 has a buffer overflow via a crafted regular expression that triggers invalid write operations.CVE-2018-18312alpineperl+10EPSS score12.77%
Perl before 5.26.3 and 5.28.0 before 5.28.1 has a buffer overflow via a crafted regular expression that triggers invalid write operations.CVE-2018-18311alpineperl+57EPSS score11.68%
Perl before 5.26.3 and 5.28.x before 5.28.1 has a buffer overflow via a crafted regular expression that triggers invalid write operations.CVE-2018-18313alpineperl+11EPSS score9.52%
Perl before 5.26.3 has a buffer over-read via a crafted regular expression that triggers disclosure of sensitive information from process memory.CVE-2018-6797alpineperl+7EPSS score6.48%
An issue was discovered in Perl 5.18 through 5.26. A crafted regular expression can cause a heap-based buffer overflow, with control over the bytes written.CVE-2018-6798alpineperl+7EPSS score3.93%
An issue was discovered in Perl 5.22 through 5.26. Matching a crafted locale dependent regular expression can cause a heap-based buffer over-read and potentially information disclosure.CVE-2018-6913alpineperl+6EPSS score10.67%
Heap-based buffer overflow in the pack function in Perl before 5.26.2 allows context-dependent attackers to execute arbitrary code via a large item count.CVE-2018-12015alpineperl+19EPSS score7.31%
In Perl through 5.26.2, the Archive::Tar module allows remote attackers to bypass a directory-traversal protection mechanism, and overwrite arbitrary files, via an archive file containing a symlink and a regular file with the same name.CVE-2003-1365perlcgi_liteEPSS score1.89%
The escape_dangerous_chars function in CGI::Lite 2.0 and earlier does not correctly remove special characters including (1) "\" (backslash), (2) "?", (3) "~" (tilde), (4) "^" (carat), (5) newline, or (6) carriage return, which could allow remote attackers to read or write arbitrary files, or execute arbitrary commands, in shell scripts that rely on CGI::Lite to filter such dangerous inputs.CVE-2013-1667debianperl+2EPSS score3.58%
The rehash mechanism in Perl 5.8.2 through 5.16.x allows context-dependent attackers to cause a denial of service (memory consumption and crash) via a crafted hash key.CVE-2013-7329debianlibcgi-application-perl+4EPSS score1.88%
The CGI::Application module before 4.50_50 and 4.50_51 for Perl, when run modes are not specified, allows remote attackers to obtain sensitive information (web queries and environment details) via vectors related to the dump_html function.CVE-2013-7490canonicalubuntu_linux+3EPSS score2.74%
An issue was discovered in the DBI module before 1.632 for Perl. Using many arguments to methods for Callbacks may lead to memory corruption.CVE-2013-7422applemac_os_x+3EPSS score3.04%
Integer underflow in regcomp.c in Perl before 5.20, as used in Apple OS X before 10.10.5 and other products, allows context-dependent attackers to execute arbitrary code or cause a denial of service (application crash) via a long digit string associated with an invalid backreference within a regular expression.CVE-2013-7491debianlibdbi-perl+2EPSS score2.66%
An issue was discovered in the DBI module before 1.628 for Perl. Stack corruption occurs when a user-defined function requires a non-trivial amount of memory and the Perl stack gets reallocated.CVE-2015-8607canonicalubuntu_linux+7EPSS score3.12%
The canonpath function in the File::Spec module in PathTools before 3.62, as used in Perl, does not properly preserve the taint attribute of data, which might allow context-dependent attackers to bypass the taint protection mechanism via a crafted string.CVE-2015-8608perlperlEPSS score4.62%
The VDir::MapPathA and VDir::MapPathW functions in Perl 5.22 allow remote attackers to cause a denial of service (out-of-bounds read) and possibly execute arbitrary code via a crafted (1) drive letter or (2) pInName argument.CVE-2015-8853debianperl+4EPSS score2.55%
The (1) S_reghop3, (2) S_reghop4, and (3) S_reghopmaybe3 functions in regexec.c in Perl before 5.24.0 allow context-dependent attackers to cause a denial of service (infinite loop) via crafted utf-8 data, as demonstrated by "a\x80."CVE-2016-2381canonicalubuntu_linux+12EPSS score9.08%
Perl might allow context-dependent attackers to bypass the taint protection mechanism in a child process via duplicate environment variables in envp.CVE-2016-1238apachespamassassin+15EPSS score0.78%
(1) cpan/Archive-Tar/bin/ptar, (2) cpan/Archive-Tar/bin/ptardiff, (3) cpan/Archive-Tar/bin/ptargrep, (4) cpan/CPAN/scripts/cpan, (5) cpan/Digest-SHA/shasum, (6) cpan/Encode/bin/enc2xs, (7) cpan/Encode/bin/encguess, (8) cpan/Encode/bin/piconv, (9) cpan/Encode/bin/ucmlint, (10) cpan/Encode/bin/unidump, (11) cpan/ExtUtils-MakeMaker/bin/instmodsh, (12) cpan/IO-Compress/bin/zipdetails, (13) cpan/JSON-PP/bin/json_pp, (14) cpan/Test-Harness/bin/prove, (15) dist/ExtUtils-ParseXS/lib/ExtUtils/xsubpp, (16) dist/Module-CoreList/corelist, (17) ext/Pod-Html/bin/pod2html, (18) utils/c2ph.PL, (19) utils/h2ph.PL, (20) utils/h2xs.PL, (21) utils/libnetcfg.PL, (22) utils/perlbug.PL, (23) utils/perldoc.PL, (24) utils/perlivp.PL, and (25) utils/splain.PL in Perl 5.x before 5.22.3-RC2 and 5.24 before 5.24.1-RC2 do not properly remove . (period) characters from the end of the includes directory array, which might allow local users to gain privileges via a Trojan horse module under the current working directory.CVE-2016-6185canonicalubuntu_linux+7EPSS score0.79%
The XSLoader::load method in XSLoader in Perl does not properly locate .so files when called in a string eval, which might allow local users to execute arbitrary code via a Trojan horse library under the current working directory.