CVE-2018-18311 - 漏洞详情

CVE-2018-18311 (CNNVD-201811-924)

CRITICAL

中文标题:

Perl 输入验证错误漏洞

英文标题:

Perl before 5.26.3 and 5.28.x before 5.28.1 has a buffer overflow via a crafted regular expression t...

CVSS分数: 9.8

发布时间: 2018-12-07 21:00:00

漏洞类型: 输入验证错误

状态: PUBLISHED

数据质量分数: 0.30

数据版本: v3

漏洞描述

中文描述:

Perl是Perl社区的一款通用、解释型、动态的跨平台编程语言。 Perl 5.26.3之前版本和5.28.1之前的5.28.x版本中的Perl_my_setenv存在输入验证错误漏洞。该漏洞源于网络系统或产品未对输入的数据进行正确的验证。

英文描述:

Perl before 5.26.3 and 5.28.x before 5.28.1 has a buffer overflow via a crafted regular expression that triggers invalid write operations.

CWE类型:

CWE-190 CWE-787

受影响产品

厂商	产品	版本	版本范围	平台	CPE
perl	perl	*	-	-	`cpe:2.3:a:perl:perl::::::::`
canonical	ubuntu_linux	12.04	-	-	`cpe:2.3:o:canonical:ubuntu_linux:12.04::::esm:::`
canonical	ubuntu_linux	14.04	-	-	`cpe:2.3:o:canonical:ubuntu_linux:14.04::::lts:::`
canonical	ubuntu_linux	16.04	-	-	`cpe:2.3:o:canonical:ubuntu_linux:16.04::::lts:::`
canonical	ubuntu_linux	18.04	-	-	`cpe:2.3:o:canonical:ubuntu_linux:18.04::::lts:::`
canonical	ubuntu_linux	18.10	-	-	`cpe:2.3:o:canonical:ubuntu_linux:18.10:::::::*`
debian	debian_linux	8.0	-	-	`cpe:2.3:o:debian:debian_linux:8.0:::::::*`
debian	debian_linux	9.0	-	-	`cpe:2.3:o:debian:debian_linux:9.0:::::::*`
netapp	e-series_santricity_os_controller	-	-	-	`cpe:2.3:a:netapp:e-series_santricity_os_controller:-:::::::*`
netapp	snap_creator_framework	-	-	-	`cpe:2.3:a:netapp:snap_creator_framework:-:::::::*`
netapp	snapcenter	-	-	-	`cpe:2.3:a:netapp:snapcenter:-:::::::*`
netapp	snapdriver	-	-	-	`cpe:2.3:a:netapp:snapdriver:-:::::unix::`
redhat	openshift_container_platform	3.11	-	-	`cpe:2.3:a:redhat:openshift_container_platform:3.11:::::::*`
redhat	enterprise_linux	6.0	-	-	`cpe:2.3:o:redhat:enterprise_linux:6.0:::::::*`
redhat	enterprise_linux	7.0	-	-	`cpe:2.3:o:redhat:enterprise_linux:7.0:::::::*`
redhat	enterprise_linux	7.4	-	-	`cpe:2.3:o:redhat:enterprise_linux:7.4:::::::*`
redhat	enterprise_linux	7.5	-	-	`cpe:2.3:o:redhat:enterprise_linux:7.5:::::::*`
redhat	enterprise_linux	7.6	-	-	`cpe:2.3:o:redhat:enterprise_linux:7.6:::::::*`
redhat	enterprise_linux_desktop	7.0	-	-	`cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:::::::*`
redhat	enterprise_linux_eus	7.6	-	-	`cpe:2.3:o:redhat:enterprise_linux_eus:7.6:::::::*`
redhat	enterprise_linux_server	7.0	-	-	`cpe:2.3:o:redhat:enterprise_linux_server:7.0:::::::*`
redhat	enterprise_linux_server_aus	7.6	-	-	`cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:::::::*`
redhat	enterprise_linux_server_tus	7.6	-	-	`cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:::::::*`
redhat	enterprise_linux_workstation	7.0	-	-	`cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:::::::*`
apple	mac_os_x	*	-	-	`cpe:2.3:o:apple:mac_os_x::::::::`
fedoraproject	fedora	29	-	-	`cpe:2.3:o:fedoraproject:fedora:29:::::::*`
mcafee	web_gateway	*	-	-	`cpe:2.3:a:mcafee:web_gateway::::::::`

解决方案

中文解决方案:

（暂无数据）

英文解决方案:

（暂无数据）

临时解决方案:

（暂无数据）

参考链接

[debian-lts-announce] 20181130 [SECURITY] [DLA 1601-1] perl security update mailing-list
cve.org

访问

DSA-4347 vendor-advisory
cve.org

访问

106145 vdb-entry
cve.org

访问

1042181 vdb-entry
cve.org

访问

RHSA-2019:0010 vendor-advisory
cve.org

访问

USN-3834-2 vendor-advisory
cve.org

访问

FEDORA-2018-9dbe983805 vendor-advisory
cve.org

访问

RHSA-2019:0001 vendor-advisory
cve.org

访问

RHSA-2019:0109 vendor-advisory
cve.org

访问

USN-3834-1 vendor-advisory
cve.org

访问

20190326 APPLE-SA-2019-3-25-2 macOS Mojave 10.14.4, Security Update 2019-002 High Sierra, Security Update 2019-002 Sierra mailing-list
cve.org

访问

20190326 APPLE-SA-2019-3-25-2 macOS Mojave 10.14.4, Security Update 2019-002 High Sierra, Security Update 2019-002 Sierra mailing-list
cve.org

访问

RHBA-2019:0327 vendor-advisory
cve.org

访问

RHSA-2019:1790 vendor-advisory
cve.org

访问

RHSA-2019:1942 vendor-advisory
cve.org

访问

RHSA-2019:2400 vendor-advisory
cve.org

访问

GLSA-201909-01 vendor-advisory
cve.org

访问

无标题 x_refsource_MISC
cve.org

访问

无标题 x_refsource_MISC
cve.org

访问

无标题 x_refsource_MISC
cve.org

访问