CVE-2012-5195: Buffer Overflow

Published Dec 18, 2012

Updated

Heap-based buffer overflow in the Perlrepeatcpy function in util.c in Perl 5.12.x before 5.12.5, 5.14.x before 5.14.3, and 5.15.x before 15.15.5 allows context-dependent attackers to cause a denial of service (memory consumption and crash) or possibly execute arbitrary code via the 'x' string repeat operator.

Affected Software

23 affected components

Perl Perl=5.12.0

Perl Perl=5.12.0-rc0

Perl Perl=5.12.0-rc1

Perl Perl=5.12.0-rc2

Perl Perl=5.12.0-rc3

Perl Perl=5.12.0-rc4

Perl Perl=5.12.0-rc5

Perl Perl=5.12.1

Perl Perl=5.12.1-rc1

Perl Perl=5.12.1-rc2

Perl Perl=5.12.2

Perl Perl=5.12.2-rc1

Perl Perl=5.12.3

Perl Perl=5.12.3-rc1

Perl Perl=5.12.3-rc2

Perl Perl=5.12.3-rc3

Perl Perl=5.12.4

Perl Perl=5.14.0

Perl Perl=5.14.0-rc1

Perl Perl=5.14.0-rc2

Perl Perl=5.14.0-rc3

Perl Perl=5.14.1

Perl Perl=5.14.2

Remediation

Patch Available

http://perl5.git.perl.org/perl.git/commit/2709980d5a193ce6f3a16f0d19879a6560dcde44

Event History

Dec 18, 2012

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2012-5195?

CVE-2012-5195 is classified as a critical vulnerability due to its potential to cause a denial of service or execute arbitrary code.

How do I fix CVE-2012-5195?

To fix CVE-2012-5195, upgrade Perl to version 5.12.5 or later, 5.14.3 or later, or 5.15.5 or later.

What versions of Perl are affected by CVE-2012-5195?

CVE-2012-5195 affects Perl versions 5.12.x before 5.12.5, 5.14.x before 5.14.3, and 5.15.x before 5.15.5.

What types of attacks can exploit CVE-2012-5195?

CVE-2012-5195 can be exploited by context-dependent attackers to cause memory consumption and crashes.

Is CVE-2012-5195 a buffer overflow vulnerability?

Yes, CVE-2012-5195 is a heap-based buffer overflow vulnerability in the Perl_repeatcpy function.